Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
{type: pkcs11js.CKA_CLASS, value: pkcs11js.CKO_PRIVATE_KEY},
{type: pkcs11js.CKA_KEY_TYPE, value: pkcs11js.CKK_EC},
{type: pkcs11js.CKA_PRIVATE, value: this._pkcs11Login},
{type: pkcs11js.CKA_TOKEN, value: this._pkcs11Login && pkcs11Token},
{type: pkcs11js.CKA_SIGN, value: true},
{type: pkcs11js.CKA_DERIVE, value: true}
];
const publicKeyTemplate = [
// { type: pkcs11js.CKA_ID, value: ski },
{type: pkcs11js.CKA_CLASS, value: pkcs11js.CKO_PUBLIC_KEY},
{type: pkcs11js.CKA_KEY_TYPE, value: pkcs11js.CKK_EC},
{type: pkcs11js.CKA_PRIVATE, value: false},
{type: pkcs11js.CKA_TOKEN, value: this._pkcs11Login && pkcs11Token},
{type: pkcs11js.CKA_VERIFY, value: true},
{
type: pkcs11js.CKA_EC_PARAMS,
value: Buffer.from(_pkcs11ParamsSizeToOid[this._keySize], 'hex')
}
];
/*
* Call PKCS11 API to generate the key pair.
*
* Return public and private key handles.
*/
const handles = pkcs11.C_GenerateKeyPair(
pkcs11Session, {mechanism: pkcs11js.CKM_EC_KEY_PAIR_GEN},
publicKeyTemplate, privateKeyTemplate);
/*
* Template for querying key attributes (debug only).
*/
const objectTemplate = [
* CKA_ALWAYS_SENSITIVE, CKA_MODIFIABLE, CKA_ECDSA_PARAMS,
* and CKA_EC_POINT are new for v2.0 */
extractable: { v: pkcs11.CKA_EXTRACTABLE, t: TYPE_BOOL },
local: { v: pkcs11.CKA_LOCAL, t: TYPE_BOOL },
neverExtractable: { v: pkcs11.CKA_NEVER_EXTRACTABLE, t: TYPE_BOOL },
alwaysSensitive: { v: pkcs11.CKA_ALWAYS_SENSITIVE, t: TYPE_BOOL },
/* CKA_KEY_GEN_MECHANISM is new for v2.11 */
keyGenMechanism: { v: pkcs11.CKA_KEY_GEN_MECHANISM, t: TYPE_NUMBER },
modifiable: { v: pkcs11.CKA_MODIFIABLE, t: TYPE_BOOL },
/* CKA_ECDSA_PARAMS is deprecated in v2.11,
* CKA_EC_PARAMS is preferred. */
paramsECDSA: { v: pkcs11.CKA_ECDSA_PARAMS, t: TYPE_BUFFER },
paramsEC: { v: pkcs11.CKA_EC_PARAMS, t: TYPE_BUFFER },
pointEC: { v: pkcs11.CKA_EC_POINT, t: TYPE_BUFFER },
/* CKA_SECONDARY_AUTH, CKA_AUTH_PIN_FLAGS,
* are new for v2.10. Deprecated in v2.11 and onwards. */
secondaryAuth: { v: pkcs11.CKA_SECONDARY_AUTH, t: TYPE_BOOL },
authPinFlags: { v: pkcs11.CKA_AUTH_PIN_FLAGS, t: TYPE_BUFFER },
/* CKA_ALWAYS_AUTHENTICATE ...
* CKA_UNWRAP_TEMPLATE are new for v2.20 */
alwaysAuth: { v: pkcs11.CKA_ALWAYS_AUTHENTICATE, t: TYPE_BUFFER },
wrapWithTrusted: { v: pkcs11.CKA_WRAP_WITH_TRUSTED, t: TYPE_BUFFER },
wrapTemplate: { v: pkcs11.CKA_WRAP_TEMPLATE, t: TYPE_BUFFER },
unwrapTemplate: { v: pkcs11.CKA_UNWRAP_TEMPLATE, t: TYPE_BUFFER },
it("#1", () => {
const privateTemplate = [
{ type: pkcs11.CKA_ID, value: new Buffer("1234567890") },
{ type: pkcs11.CKA_SIGN, value: true },
{ type: pkcs11.CKA_DERIVE, value: true },
];
const publicTemplate = [
{ type: pkcs11.CKA_ID, value: new Buffer("1234567890") },
{ type: pkcs11.CKA_EC_PARAMS, value: new Buffer("06082A8648CE3D030107", "hex") },
{ type: pkcs11.CKA_VERIFY, value: true },
{ type: pkcs11.CKA_DERIVE, value: true },
];
const keys = mod.C_GenerateKeyPair(session, { mechanism: pkcs11.CKM_ECDSA_KEY_PAIR_GEN, parameter: null }, publicTemplate, privateTemplate);
let attrs = mod.C_GetAttributeValue(session, keys.privateKey, [
{ type: pkcs11.CKA_TOKEN }
]);
});
});
before(() => {
const privateTemplate = [
{ type: pkcs11.CKA_ID, value: new Buffer("1234567890") },
{ type: pkcs11.CKA_SIGN, value: true },
];
const publicTemplate = [
{ type: pkcs11.CKA_ID, value: new Buffer("1234567890") },
{ type: pkcs11.CKA_EC_PARAMS, value: new Buffer("06082A8648CE3D030107", "hex") },
{ type: pkcs11.CKA_VERIFY, value: true },
];
const keys = mod.C_GenerateKeyPair(session, { mechanism: pkcs11.CKM_ECDSA_KEY_PAIR_GEN, parameter: null }, publicTemplate, privateTemplate);
privateKey = keys.privateKey;
publicKey = keys.publicKey;
});
_pkcs11QueryEcparamsEcpt(pkcs11, pkcs11Session, publicKey) {
/*
* Get EC params (to derive key size) and EC point.
*/
const attribs =
this._pkcs11GetAttributeValue(
this._pkcs11, this._pkcs11Session, publicKey,
[
{type: pkcs11js.CKA_EC_PARAMS},
{type: pkcs11js.CKA_EC_POINT}
]);
logger.debug(__func() + 'attribuites: ' +
util.inspect(attribs, {depth: null}));
let ecparams, ecpt;
if (attribs[0].type === pkcs11js.CKA_EC_PARAMS) {
ecparams = attribs[0].value;
ecpt = attribs[1].value;
} else {
ecparams = attribs[1].value;
ecpt = attribs[1].value;
}
/*
* Workaround for opencryptoki bug reporting wrong ecpt length.
*/
ecpt = this._fixEcpt(ecpt);
return {ecparams: ecparams, ecpt: ecpt};
}
coefficient: { v: pkcs11.CKA_COEFFICIENT, t: TYPE_BUFFER },
prime: { v: pkcs11.CKA_PRIME, t: TYPE_BUFFER },
subprime: { v: pkcs11.CKA_SUBPRIME, t: TYPE_BUFFER },
base: { v: pkcs11.CKA_BASE, t: TYPE_BUFFER },
primeBits: { v: pkcs11.CKA_PRIME_BITS, t: TYPE_NUMBER },
subprimeBits: { v: pkcs11.CKA_SUBPRIME_BITS, t: TYPE_NUMBER },
valueBits: { v: pkcs11.CKA_VALUE_BITS, t: TYPE_NUMBER },
valueLen: { v: pkcs11.CKA_VALUE_LEN, t: TYPE_NUMBER },
extractable: { v: pkcs11.CKA_EXTRACTABLE, t: TYPE_BOOL },
local: { v: pkcs11.CKA_LOCAL, t: TYPE_BOOL },
neverExtractable: { v: pkcs11.CKA_NEVER_EXTRACTABLE, t: TYPE_BOOL },
alwaysSensitive: { v: pkcs11.CKA_ALWAYS_SENSITIVE, t: TYPE_BOOL },
keyGenMechanism: { v: pkcs11.CKA_KEY_GEN_MECHANISM, t: TYPE_NUMBER },
modifiable: { v: pkcs11.CKA_MODIFIABLE, t: TYPE_BOOL },
paramsECDSA: { v: pkcs11.CKA_ECDSA_PARAMS, t: TYPE_BUFFER },
paramsEC: { v: pkcs11.CKA_EC_PARAMS, t: TYPE_BUFFER },
pointEC: { v: pkcs11.CKA_EC_POINT, t: TYPE_BUFFER },
secondaryAuth: { v: pkcs11.CKA_SECONDARY_AUTH, t: TYPE_BOOL },
authPinFlags: { v: pkcs11.CKA_AUTH_PIN_FLAGS, t: TYPE_BUFFER },
alwaysAuth: pkcs11.CKA_ALWAYS_AUTHENTICATE,
wrapWithTrusted: pkcs11.CKA_WRAP_WITH_TRUSTED,
wrapTemplate: pkcs11.CKA_WRAP_TEMPLATE,
unwrapTemplate: pkcs11.CKA_UNWRAP_TEMPLATE,
otpFormat: pkcs11.CKA_OTP_FORMAT,
otpLength: pkcs11.CKA_OTP_LENGTH,
otpTimeInterval: pkcs11.CKA_OTP_TIME_INTERVAL,
otpUserFriendlyMode: pkcs11.CKA_OTP_USER_FRIENDLY_MODE,
otpChallengeReq: pkcs11.CKA_OTP_CHALLENGE_REQUIREMENT,
otpTimeReq: pkcs11.CKA_OTP_TIME_REQUIREMENT,
otpCounterReq: pkcs11.CKA_OTP_COUNTER_REQUIREMENT,
otppinReq: pkcs11.CKA_OTP_PIN_REQUIREMENT,
otpCounter: pkcs11.CKA_OTP_COUNTER,