Singular KeyDerivationStringDataParams

params.go

@@ -27,10 +27,17 @@ static inline void putECDH1PublicParams(CK_ECDH1_DERIVE_PARAMS_PTR params, CK_VO
 	params->ulPublicDataLen = ulPublicDataLen;
 }
 
+static inline void putKeyDerivationStringDataParams(CK_KEY_DERIVATION_STRING_DATA_PTR params, CK_BYTE_PTR pData, CK_ULONG ulLen)
+{
+	params->pData = pData;
+	params->ulLen = ulLen;
+}
+
 static inline void putRSAAESKeyWrapParams(CK_RSA_AES_KEY_WRAP_PARAMS_PTR params, CK_VOID_PTR pOAEPParams)
 {
 	params->pOAEPParams = pOAEPParams;
 }
+
 */
 import "C"
 import "unsafe"
@@ -55,13 +62,12 @@ type GCMParams struct {
 //
 // Encrypt/Decrypt. As an example:
 //
-//    gcmParams := pkcs11.NewGCMParams(make([]byte, 12), nil, 128)
-//    p.ctx.EncryptInit(session, []*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_AES_GCM, gcmParams)},
-//			aesObjHandle)
-//    ct, _ := p.ctx.Encrypt(session, pt)
-//    iv := gcmParams.IV()
-//    gcmParams.Free()
-//
+//	   gcmParams := pkcs11.NewGCMParams(make([]byte, 12), nil, 128)
+//	   p.ctx.EncryptInit(session, []*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_AES_GCM, gcmParams)},
+//				aesObjHandle)
+//	   ct, _ := p.ctx.Encrypt(session, pt)
+//	   iv := gcmParams.IV()
+//	   gcmParams.Free()
 func NewGCMParams(iv, aad []byte, tagSize int) *GCMParams {
 	return &GCMParams{
 		iv:      iv,
@@ -194,14 +200,33 @@ func cECDH1DeriveParams(p *ECDH1DeriveParams, arena arena) ([]byte, arena) {
 	return memBytes(unsafe.Pointer(&params), unsafe.Sizeof(params)), arena
 }
 
+type KeyDerivationStringDataParams struct {
+	pData []byte
+}
+
+func NewKeyDerivationStringDataParams(data []byte) *KeyDerivationStringDataParams {
+	return &KeyDerivationStringDataParams{
+		pData: data,
+	}
+}
+
+func cKeyDerivationStringDataParams(p *KeyDerivationStringDataParams, arena arena) ([]byte, arena) {
+	params := C.CK_KEY_DERIVATION_STRING_DATA{}
+
+	pData, ulLen := arena.Allocate(p.pData)
+	C.putKeyDerivationStringDataParams(&params, C.CK_BYTE_PTR(pData), ulLen)
+
+	return memBytes(unsafe.Pointer(&params), unsafe.Sizeof(params)), arena
+}
+
 type RSAAESKeyWrapParams struct {
 	AESKeyBits uint
 	OAEPParams OAEPParams
 }
 
 func cRSAAESKeyWrapParams(p *RSAAESKeyWrapParams, arena arena) ([]byte, arena) {
 	var param []byte
-	params := C.CK_RSA_AES_KEY_WRAP_PARAMS {
+	params := C.CK_RSA_AES_KEY_WRAP_PARAMS{
 		ulAESKeyBits: C.CK_MECHANISM_TYPE(p.AESKeyBits),
 	}
 
@@ -212,4 +237,3 @@ func cRSAAESKeyWrapParams(p *RSAAESKeyWrapParams, arena arena) ([]byte, arena) {
 	}
 	return memBytes(unsafe.Pointer(&params), unsafe.Sizeof(params)), arena
 }
-

params_test.go

@@ -156,3 +156,79 @@ func TestGCMParams(t *testing.T) {
 	}
 	params.Free()
 }
+
+func TestKeyDerivationStringDataParams(t *testing.T) {
+	p := setenv(t)
+	sh := getSession(p, t)
+	defer finishSession(p, sh)
+	needMech(t, p, sh, CKM_AES_ECB_ENCRYPT_DATA)
+
+	if info, err := p.GetInfo(); err != nil {
+		t.Errorf("GetInfo: %v", err)
+		return
+	} else if info.ManufacturerID == "SoftHSM" && info.LibraryVersion.Major < 2 {
+		t.Skipf("AES not implemented on SoftHSM")
+	}
+	tokenLabel := "TestGenerateKey"
+	keyTemplate := []*Attribute{
+		NewAttribute(CKA_KEY_TYPE, CKK_AES),
+		NewAttribute(CKA_CLASS, CKO_SECRET_KEY),
+		NewAttribute(CKA_TOKEN, true),
+		NewAttribute(CKA_ENCRYPT, true),
+		NewAttribute(CKA_DECRYPT, true),
+		NewAttribute(CKA_LABEL, tokenLabel),
+		NewAttribute(CKA_SENSITIVE, true),
+		NewAttribute(CKA_EXTRACTABLE, false),
+		NewAttribute(CKA_DERIVE, true),
+		NewAttribute(CKA_VALUE_LEN, 32),
+	}
+	key, err := p.GenerateKey(sh,
+		[]*Mechanism{NewMechanism(CKM_AES_KEY_GEN, nil)},
+		keyTemplate)
+	if err != nil {
+		t.Fatalf("failed to generate key: %s\n", err)
+	}
+
+	data := []byte("1234567890abcdef1234567890abcdef")
+	mech := []*Mechanism{
+		NewMechanism(CKM_AES_ECB_ENCRYPT_DATA, NewKeyDerivationStringDataParams(data)),
+	}
+
+	derivTokenLabel := "TestDerivedKey"
+	derivKeyTemplate := []*Attribute{
+		NewAttribute(CKA_KEY_TYPE, CKK_AES),
+		NewAttribute(CKA_CLASS, CKO_SECRET_KEY),
+		NewAttribute(CKA_TOKEN, true),
+		NewAttribute(CKA_ENCRYPT, true),
+		NewAttribute(CKA_DECRYPT, true),
+		NewAttribute(CKA_LABEL, derivTokenLabel),
+		NewAttribute(CKA_SENSITIVE, true),
+		NewAttribute(CKA_EXTRACTABLE, false),
+		NewAttribute(CKA_DERIVE, true),
+		NewAttribute(CKA_VALUE_LEN, 32),
+	}
+	derivKey, err := p.DeriveKey(sh, mech, key, derivKeyTemplate)
+	if err != nil {
+		t.Fatalf("failed to derive key: %s\n", err)
+	}
+
+	var mv uint = CKM_AES_ECB
+	plaintext := make([]byte, 32)
+	if err = p.EncryptInit(sh, []*Mechanism{NewMechanism(mv, nil)}, derivKey); err != nil {
+		t.Fatalf("EncryptInit: %s\n", err)
+	}
+	var ciphertext []byte
+	if ciphertext, err = p.Encrypt(sh, plaintext); err != nil {
+		t.Fatalf("Encrypt: %s\n", err)
+	}
+	if err = p.DecryptInit(sh, []*Mechanism{NewMechanism(mv, nil)}, derivKey); err != nil {
+		t.Fatalf("DecryptInit: %s\n", err)
+	}
+	var decrypted []byte
+	if decrypted, err = p.Decrypt(sh, ciphertext); err != nil {
+		t.Fatalf("Decrypt: %s\n", err)
+	}
+	if !bytes.Equal(plaintext, decrypted) {
+		t.Fatalf("Plaintext mismatch")
+	}
+}

types.go

@@ -261,14 +261,14 @@ func NewMechanism(mech uint, x interface{}) *Mechanism {
 	}
 
 	switch p := x.(type) {
-	case *GCMParams, *OAEPParams, *ECDH1DeriveParams, *RSAAESKeyWrapParams:
+	case *GCMParams, *OAEPParams, *ECDH1DeriveParams, *KeyDerivationStringDataParams, *RSAAESKeyWrapParams:
 		// contains pointers; defer serialization until cMechanism
 		m.generator = p
 	case []byte:
 		m.Parameter = p
 	default:
 		panic("parameter must be one of type: []byte, *GCMParams, *OAEPParams, *ECDH1DeriveParams," +
-			  " *RSAAESKeyWrapParams")
+			" *KeyDerivationStringDataParams, *RSAAESKeyWrapParams")
 	}
 
 	return m
@@ -291,6 +291,8 @@ func cMechanism(mechList []*Mechanism) (arena, *C.CK_MECHANISM) {
 		param, arena = cOAEPParams(p, arena)
 	case *ECDH1DeriveParams:
 		param, arena = cECDH1DeriveParams(p, arena)
+	case *KeyDerivationStringDataParams:
+		param, arena = cKeyDerivationStringDataParams(p, arena)
 	case *RSAAESKeyWrapParams:
 		param, arena = cRSAAESKeyWrapParams(p, arena)
 	}