diff --git a/lib/freebl/fipsfreebl.c b/lib/freebl/fipsfreebl.c

--- a/lib/freebl/fipsfreebl.c

+++ b/lib/freebl/fipsfreebl.c

@@ -17,6 +17,7 @@

 #include "prtypes.h"

 #include "secitem.h"

 #include "pkcs11t.h"

+#include "cmac.h"

 #include "ec.h" /* Required for EC */

@@ -99,6 +100,7 @@

 #define FIPS_AES_BLOCK_SIZE 16     /* 128-bits */

 #define FIPS_AES_ENCRYPT_LENGTH 16 /* 128-bits */

 #define FIPS_AES_DECRYPT_LENGTH 16 /* 128-bits */

+#define FIPS_AES_CMAC_LENGTH 16    /* 128-bits */

 #define FIPS_AES_128_KEY_SIZE 16   /* 128-bits */

 #define FIPS_AES_192_KEY_SIZE 24   /* 192-bits */

 #define FIPS_AES_256_KEY_SIZE 32   /* 256-bits */

@@ -310,6 +312,11 @@

         0x8b, 0xde, 0xbf, 0x16, 0x5e, 0x57, 0x6b, 0x4f

     };

+    static const PRUint8 aes_cmac128_known_ciphertext[] = {

+        0x54, 0x11, 0xe2, 0x57, 0xbd, 0x2a, 0xdf, 0x9d,

+        0x1a, 0x89, 0x72, 0x80, 0x84, 0x4c, 0x7e, 0x93

+    };

+

     /* AES Known Ciphertext (192-bit key). */

     static const PRUint8 aes_ecb192_known_ciphertext[] = {

         0xa0, 0x18, 0x62, 0xed, 0x88, 0x19, 0xcb, 0x62,

@@ -328,6 +335,11 @@

         0x90, 0x2e, 0x44, 0xbb, 0x52, 0x03, 0xe9, 0x07

     };

+    static const PRUint8 aes_cmac192_known_ciphertext[] = {

+        0x0e, 0x07, 0x99, 0x1e, 0xf6, 0xee, 0xfa, 0x2c,

+        0x1b, 0xfc, 0xce, 0x94, 0x92, 0x2d, 0xf1, 0xab

+    };

+

     /* AES Known Ciphertext (256-bit key). */

     static const PRUint8 aes_ecb256_known_ciphertext[] = {

         0xdb, 0xa6, 0x52, 0x01, 0x8a, 0x70, 0xae, 0x66,

@@ -346,6 +358,12 @@

         0xf4, 0xb0, 0xc1, 0x8c, 0x86, 0x51, 0xf5, 0xa1

     };

+    static const PRUint8 aes_cmac256_known_ciphertext[] = {

+        0xc1, 0x26, 0x69, 0x32, 0x51, 0x13, 0x65, 0xac,

+        0x71, 0x23, 0xe4, 0xe7, 0xb9, 0x0c, 0x88, 0x9f

+

+    };

+

     const PRUint8 *aes_ecb_known_ciphertext =

         (aes_key_size == FIPS_AES_128_KEY_SIZE) ? aes_ecb128_known_ciphertext : (aes_key_size == FIPS_AES_192_KEY_SIZE) ? aes_ecb192_known_ciphertext : aes_ecb256_known_ciphertext;

@@ -355,10 +373,14 @@

     const PRUint8 *aes_gcm_known_ciphertext =

         (aes_key_size == FIPS_AES_128_KEY_SIZE) ? aes_gcm128_known_ciphertext : (aes_key_size == FIPS_AES_192_KEY_SIZE) ? aes_gcm192_known_ciphertext : aes_gcm256_known_ciphertext;

+    const PRUint8 *aes_cmac_known_ciphertext =

+        (aes_key_size == FIPS_AES_128_KEY_SIZE) ? aes_cmac128_known_ciphertext : (aes_key_size == FIPS_AES_192_KEY_SIZE) ? aes_cmac192_known_ciphertext : aes_cmac256_known_ciphertext;

+

     /* AES variables. */

     PRUint8 aes_computed_ciphertext[FIPS_AES_ENCRYPT_LENGTH * 2];

     PRUint8 aes_computed_plaintext[FIPS_AES_DECRYPT_LENGTH * 2];

     AESContext *aes_context;

+    CMACContext *cmac_context;

     unsigned int aes_bytes_encrypted;

     unsigned int aes_bytes_decrypted;

     CK_NSS_GCM_PARAMS gcmParams;

@@ -547,6 +569,44 @@

         return (SECFailure);

     }

+    /******************************************************/

+    /* AES-CMAC Known Answer Encryption Test.             */

+    /******************************************************/

+    cmac_context = CMAC_Create(CMAC_AES, aes_known_key, aes_key_size);

+

+    if (cmac_context == NULL) {

+        PORT_SetError(SEC_ERROR_NO_MEMORY);

+        return (SECFailure);

+    }

+

+    aes_status = CMAC_Begin(cmac_context);

+    if (aes_status != SECSuccess) {

+        CMAC_Destroy(cmac_context, PR_TRUE);

+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

+        return (SECFailure);

+    }

+

+    aes_status = CMAC_Update(cmac_context, aes_known_plaintext,

+                             FIPS_AES_DECRYPT_LENGTH);

+    if (aes_status != SECSuccess) {

+        CMAC_Destroy(cmac_context, PR_TRUE);

+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

+        return (SECFailure);

+    }

+

+    aes_status = CMAC_Finish(cmac_context, aes_computed_ciphertext,

+                             &aes_bytes_encrypted, FIPS_AES_CMAC_LENGTH);

+

+    CMAC_Destroy(cmac_context, PR_TRUE);

+

+    if ((aes_status != SECSuccess) ||

+        (aes_bytes_encrypted != FIPS_AES_CMAC_LENGTH) ||

+        (PORT_Memcmp(aes_computed_ciphertext, aes_cmac_known_ciphertext,

+                     FIPS_AES_CMAC_LENGTH) != 0)) {

+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

+        return (SECFailure);

+    }

+

     return (SECSuccess);

 }

@@ -743,6 +803,170 @@

     return (SECSuccess);

 }

+SECStatus

+freebl_fips_TLS_PowerUpSelfTest(void)

+{

+    static const PRUint8 TLS_known_secret_key[] = {

+        "Firefox and ThunderBird are awesome!"

+    };

+

+    static const PRUint8 TLS_known_secret_key_length = sizeof TLS_known_secret_key;

+

+    /* known tls prf with sha1/md5 */

+    static const PRUint8 known_TLS_PRF[] = {

+        0x87, 0x4c, 0xc0, 0xc5, 0x15, 0x14, 0x2b, 0xdc,

+        0x73, 0x48, 0x9e, 0x88, 0x9d, 0xf5, 0x83, 0x2f,

+        0x2d, 0x66, 0x1e, 0x78, 0x6c, 0x54, 0x78, 0x29,

+        0xb9, 0xa4, 0x4c, 0x90, 0x5e, 0xa2, 0xe6, 0x5c,

+        0xf1, 0x4f, 0xb5, 0x95, 0xa5, 0x54, 0xc0, 0x9f,

+        0x84, 0x47, 0xb4, 0x4c, 0xda, 0xae, 0x19, 0x29,

+        0x2b, 0x91, 0x2a, 0x81, 0x9d, 0x3a, 0x30, 0x40,

+        0xc5, 0xdf, 0xbb, 0xfa, 0xd8, 0x4c, 0xbc, 0x18

+    };

+

+    /* known SHA256 tls mac */

+    static const PRUint8 known_TLS_SHA256[] = {

+        0x66, 0xd6, 0x94, 0xd4, 0x0d, 0x32, 0x61, 0x38,

+        0x26, 0xf6, 0x8b, 0xfe, 0x9e, 0xac, 0xa2, 0xf5,

+        0x40, 0x52, 0x74, 0x3f, 0xbe, 0xb8, 0xca, 0x94,

+        0xc3, 0x64, 0xd6, 0x02, 0xf5, 0x88, 0x98, 0x35,

+        0x73, 0x9f, 0xce, 0xaa, 0x68, 0xe3, 0x7c, 0x93,

+        0x30, 0x21, 0x45, 0xec, 0xe9, 0x8f, 0x1c, 0x7e,

+        0xd1, 0x54, 0xf5, 0xbe, 0xff, 0xc8, 0xd7, 0x72,

+        0x7f, 0x9c, 0x0c, 0x7f, 0xa9, 0xd3, 0x4a, 0xd2

+    };

+

+#ifdef NSS_FULL_POST

+    /* known SHA224 tls mac */

+    static const PRUint8 known_TLS_SHA224[] = {

+        0xd8, 0x68, 0x15, 0xff, 0xa1, 0xa2, 0x5e, 0x16,

+        0xce, 0xb1, 0xfd, 0xbd, 0xda, 0x39, 0xbc, 0xa7,

+        0x27, 0x32, 0x78, 0x94, 0x66, 0xf0, 0x84, 0xcf,

+        0x46, 0xc0, 0x22, 0x76, 0xdc, 0x6b, 0x2e, 0xed,

+        0x1d, 0x2d, 0xd2, 0x93, 0xfd, 0xae, 0xca, 0xf9,

+        0xe0, 0x4c, 0x17, 0x23, 0x22, 0x5a, 0x73, 0x93,

+        0x20, 0x0a, 0xbd, 0xa0, 0x72, 0xf8, 0x8b, 0x74,

+        0xfb, 0xf1, 0xab, 0xb7, 0xe0, 0xec, 0x34, 0xc9

+    };

+

+    /* known SHA384 tls mac */

+    static const PRUint8 known_TLS_SHA384[] = {

+        0xb2, 0xac, 0x06, 0x10, 0xad, 0x50, 0xd5, 0xdc,

+        0xdb, 0x01, 0xea, 0xa6, 0x2d, 0x8a, 0x34, 0xb6,

+        0xeb, 0x84, 0xbc, 0x37, 0xc9, 0x9f, 0xa1, 0x9c,

+        0xd5, 0xbd, 0x4e, 0x66, 0x16, 0x24, 0xe5, 0x3d,

+        0xce, 0x74, 0xe0, 0x30, 0x41, 0x5c, 0xdb, 0xb7,

+        0x52, 0x1d, 0x2d, 0x4d, 0x9b, 0xbe, 0x6b, 0x86,

+        0xda, 0x8a, 0xca, 0x73, 0x39, 0xb4, 0xc7, 0x8f,

+        0x03, 0xb1, 0xf9, 0x7e, 0x65, 0xae, 0x17, 0x10

+    };

+

+    /* known SHA512 tls mac */

+    static const PRUint8 known_TLS_SHA512[] = {

+        0x73, 0x21, 0x4f, 0x40, 0x81, 0x1e, 0x90, 0xa1,

+        0x16, 0x40, 0x1e, 0x33, 0x69, 0xc5, 0x00, 0xc7,

+        0xc4, 0x81, 0xa3, 0x4f, 0xa7, 0xcc, 0x4a, 0xeb,

+        0x1a, 0x66, 0x00, 0x82, 0x52, 0xe2, 0x2f, 0x69,

+        0x14, 0x59, 0x05, 0x7c, 0xb0, 0x32, 0xce, 0xcc,

+        0xb7, 0xc9, 0xab, 0x0f, 0x73, 0x00, 0xe5, 0x52,

+        0x9d, 0x6b, 0x0e, 0x66, 0x4b, 0xb3, 0x0b, 0x0d,

+        0x34, 0x53, 0x97, 0x13, 0x84, 0x18, 0x31, 0x7a

+    };

+#endif

+

+    SECStatus status;

+    PRUint8 tls_computed[HASH_LENGTH_MAX];

+    SECItem secret;

+    SECItem seed;

+    SECItem result;

+    const char *tls_label = "fips test label";

+

+    secret.data = (unsigned char *)TLS_known_secret_key;

+    secret.len = TLS_known_secret_key_length;

+    seed.data = (unsigned char *)known_hash_message;

+    seed.len = FIPS_KNOWN_HASH_MESSAGE_LENGTH;

+    result.data = tls_computed;

+    result.len = sizeof(tls_computed);

+

+    /***************************************************/

+    /* TLS 1.0 PRF Known Answer Test                   */

+    /***************************************************/

+

+    status = TLS_PRF(&secret, tls_label, &seed, &result, PR_TRUE);

+

+    if ((status != SECSuccess) ||

+        (result.len != HASH_LENGTH_MAX) ||

+        (PORT_Memcmp(tls_computed, known_TLS_PRF,

+                     HASH_LENGTH_MAX) != 0)) {

+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

+        return (SECFailure);

+    }

+

+    /***************************************************/

+    /* TLS 1.2 SHA-256 Known Answer Test.              */

+    /***************************************************/

+

+    status = TLS_P_hash(HASH_AlgSHA256, &secret, tls_label,

+                        &seed, &result, PR_TRUE);

+

+    if ((status != SECSuccess) ||

+        (result.len != HASH_LENGTH_MAX) ||

+        (PORT_Memcmp(tls_computed, known_TLS_SHA256,

+                     HASH_LENGTH_MAX) != 0)) {

+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

+        return (SECFailure);

+    }

+

+#ifdef NSS_FULL_POST

+    /***************************************************/

+    /* TLS 1.2 SHA-224 Known Answer Test.              */

+    /***************************************************/

+

+    status = TLS_P_hash(HASH_AlgSHA224, &secret, tls_label,

+                        &seed, &result, PR_TRUE);

+

+    if ((status != SECSuccess) ||

+        (result.len != HASH_LENGTH_MAX) ||

+        (PORT_Memcmp(tls_computed, known_TLS_SHA224,

+                     HASH_LENGTH_MAX) != 0)) {

+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

+        return (SECFailure);

+    }

+

+    /***************************************************/

+    /* TLS 1.2 SHA-384 Known Answer Test.              */

+    /***************************************************/

+

+    status = TLS_P_hash(HASH_AlgSHA384, &secret, tls_label,

+                        &seed, &result, PR_TRUE);

+

+    if ((status != SECSuccess) ||

+        (result.len != HASH_LENGTH_MAX) ||

+        (PORT_Memcmp(tls_computed, known_TLS_SHA384,

+                     HASH_LENGTH_MAX) != 0)) {

+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

+        return (SECFailure);

+    }

+

+    /***************************************************/

+    /* TLS 1.2 SHA-512 Known Answer Test.              */

+    /***************************************************/

+

+    status = TLS_P_hash(HASH_AlgSHA512, &secret, tls_label,

+                        &seed, &result, PR_TRUE);

+

+    if ((status != SECSuccess) ||

+        (result.len != HASH_LENGTH_MAX) ||

+        (PORT_Memcmp(tls_computed, known_TLS_SHA512,

+                     HASH_LENGTH_MAX) != 0)) {

+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

+        return (SECFailure);

+    }

+#endif

+

+    return (SECSuccess);

+}

+

 static SECStatus

 freebl_fips_SHA_PowerUpSelfTest(void)

 {

@@ -1842,6 +2066,12 @@

         if (rv != SECSuccess)

             return rv;

+        /* TLS PRF Power-Up SelfTest(s). */

+        rv = freebl_fips_TLS_PowerUpSelfTest();

+

+        if (rv != SECSuccess)

+            return rv;

+

         /* NOTE: RSA can only be tested in full freebl. It requires access to

          * the locking primitives */

         /* RSA Power-Up SelfTest(s). */

diff --git a/lib/softoken/fipstest.c b/lib/softoken/fipstest.c

--- a/lib/softoken/fipstest.c

+++ b/lib/softoken/fipstest.c

@@ -13,6 +13,7 @@

 #include "secoid.h"

 #include "secerr.h"

 #include "pkcs11i.h"

+#include "lowpbe.h"

 /*

  * different platforms have different ways of calling and initial entry point

@@ -581,6 +582,106 @@

     return (SECFailure);

 }

+static SECStatus

+sftk_fips_HKDF_PowerUpSelfTest(void)

+{

+    SECStatus status;

+    static const unsigned char base_key[] = {

+        0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,

+        0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,

+        0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,

+        0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,

+        0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,

+        0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,

+        0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,

+        0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f

+    };

+    static const unsigned char known_hkdf_sha256_key[] = {

+        0xdd, 0xdb, 0xeb, 0xe5, 0x6d, 0xd2, 0x96, 0xa4,

+        0x07, 0xc5, 0x7d, 0xda, 0x31, 0x56, 0x8d, 0xa5,

+        0x41, 0x3e, 0x90, 0xd4, 0xe6, 0x98, 0xeb, 0xf8,

+        0x5a, 0x49, 0x7f, 0x38, 0xef, 0x01, 0x8a, 0xe5,

+        0xda, 0x36, 0xe5, 0xcf, 0x21, 0xe3, 0x9f, 0xc3,

+        0x32, 0xb3, 0x1e, 0xf6, 0xc5, 0x10, 0x4c, 0x86,

+        0x53, 0x5e, 0x6f, 0xe0, 0x63, 0x6e, 0x43, 0x33,

+        0x61, 0x35, 0xf4, 0x17, 0x10, 0x77, 0x75, 0x2a

+    };

+/* current NIST IG's say we only need to test one instance

+ * of kdfs, keep these others around in case the guidance

+ * changes */

+#ifdef NSS_FULL_POST

+    static const unsigned char known_hkdf_sha384_key[] = {

+        0x35, 0x64, 0xc4, 0xa1, 0xcc, 0xc1, 0xdc, 0xe4,

+        0xe2, 0xca, 0x51, 0xae, 0xe8, 0x92, 0x88, 0x30,

+        0x8b, 0xb0, 0x2b, 0xac, 0x00, 0x15, 0xac, 0x15,

+        0x97, 0xc9, 0xf4, 0x6b, 0xf6, 0x3f, 0x97, 0xea,

+        0x48, 0x55, 0x38, 0x25, 0x06, 0x5d, 0x91, 0x64,

+        0xbd, 0x09, 0xf3, 0x44, 0xbc, 0x82, 0xbe, 0xdb,

+        0x5c, 0xd7, 0xf2, 0x24, 0xa5, 0x55, 0x8d, 0xa9,

+        0xa8, 0x85, 0xde, 0x8c, 0x33, 0xe0, 0x4d, 0xc3

+    };

+    static const unsigned char known_hkdf_sha512_key[] = {

+        0x63, 0x4e, 0xbc, 0x42, 0xb3, 0x56, 0x74, 0x7d,

+        0x1b, 0x55, 0xf0, 0x34, 0x54, 0xcb, 0x6d, 0x58,

+        0x39, 0x96, 0x10, 0xda, 0x03, 0x20, 0x8f, 0x77,

+        0x0d, 0xb4, 0xf7, 0xf6, 0x67, 0x0d, 0x5b, 0x6b,

+        0xd0, 0x30, 0xc4, 0xdd, 0x67, 0x61, 0x5d, 0x9a,

+        0xf5, 0x18, 0x6e, 0x1b, 0x60, 0x97, 0xc2, 0x4d,

+        0x23, 0x43, 0x69, 0xe6, 0x3b, 0xa5, 0xdf, 0xe9,

+        0x7c, 0xf1, 0x87, 0x48, 0x6f, 0xb9, 0xd3, 0x02

+    };

+#endif

+    unsigned char outBytes[64] = { 0 };

+

+    CK_HKDF_PARAMS hkdf_params;

+

+    hkdf_params.bExpand = CK_TRUE;

+    hkdf_params.bExtract = CK_TRUE;

+    hkdf_params.ulSaltType = CKF_HKDF_SALT_DATA;

+    hkdf_params.pSalt = (CK_BYTE_PTR)base_key;

+    hkdf_params.ulSaltLen = sizeof(base_key);

+    hkdf_params.pInfo = (CK_BYTE_PTR)base_key;

+    hkdf_params.ulInfoLen = sizeof(base_key);

+

+    /**************************************************/

+    /* HKDF tests                                     */

+    /**************************************************/

+

+    hkdf_params.prfHashMechanism = CKM_SHA256_HMAC;

+    status = sftk_HKDF(&hkdf_params, CK_INVALID_HANDLE, NULL,

+                       base_key, 32, NULL, outBytes, sizeof(outBytes),

+                       PR_TRUE, PR_TRUE);

+    if ((status != SECSuccess) ||

+        PORT_Memcmp(outBytes, known_hkdf_sha256_key, sizeof(outBytes)) != 0) {

+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

+        return (SECFailure);

+    }

+

+#ifdef NSS_FULL_POST

+    hkdf_params.prfHashMechanism = CKM_SHA384_HMAC;

+    status = sftk_HKDF(&hkdf_params, CK_INVALID_HANDLE, NULL,

+                       base_key, 48, NULL, outBytes, sizeof(outBytes),

+                       PR_TRUE, PR_TRUE);

+    if ((status != SECSuccess) ||

+        PORT_Memcmp(outBytes, known_hkdf_sha384_key, sizeof(outBytes)) != 0) {

+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

+        return (SECFailure);

+    }

+

+    hkdf_params.prfHashMechanism = CKM_SHA512_HMAC;

+    status = sftk_HKDF(&hkdf_params, CK_INVALID_HANDLE, NULL,

+                       base_key, 64, NULL, outBytes, sizeof(outBytes),

+                       PR_TRUE, PR_TRUE);

+    if ((status != SECSuccess) ||

+        PORT_Memcmp(outBytes, known_hkdf_sha512_key, sizeof(outBytes)) != 0) {

+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

+        return (SECFailure);

+    }

+#endif

+

+    return (SECSuccess);

+}

+

 static PRBool sftk_self_tests_ran = PR_FALSE;

 static PRBool sftk_self_tests_success = PR_FALSE;

@@ -631,6 +732,22 @@

     if (rv != SECSuccess) {

         return;

     }

+

+    rv = sftk_fips_SP800_108_PowerUpSelfTests();

+    if (rv != SECSuccess) {

+        return;

+    }

+

+    rv = sftk_fips_HKDF_PowerUpSelfTest();

+    if (rv != SECSuccess) {

+        return;

+    }

+

+    rv = sftk_fips_pbkdf_PowerUpSelfTests();

+    if (rv != SECSuccess) {

+        return;

+    }

+

     sftk_self_tests_success = PR_TRUE;

 }

diff --git a/lib/softoken/kbkdf.c b/lib/softoken/kbkdf.c

--- a/lib/softoken/kbkdf.c

+++ b/lib/softoken/kbkdf.c

@@ -90,7 +90,7 @@

 }

 static CK_RV

-kbkdf_ValidateParameter(CK_MECHANISM_TYPE mech, CK_PRF_DATA_PARAM_PTR data)

+kbkdf_ValidateParameter(CK_MECHANISM_TYPE mech, const CK_PRF_DATA_PARAM *data)

 {

     /* This function validates that the passed data parameter (data) conforms

      * to PKCS#11 v3.0's expectations for KDF parameters. This depends both on

@@ -265,7 +265,7 @@

 }

 static CK_RV

-kbkdf_ValidateParameters(CK_MECHANISM_TYPE mech, CK_SP800_108_KDF_PARAMS_PTR params, CK_ULONG keySize)

+kbkdf_ValidateParameters(CK_MECHANISM_TYPE mech, const CK_SP800_108_KDF_PARAMS *params, CK_ULONG keySize)

 {

     CK_RV ret = CKR_MECHANISM_PARAM_INVALID;

     int param_type_count[5] = { 0, 0, 0, 0, 0 };

@@ -344,7 +344,7 @@

 /* [ section: parameter helpers ] */

 static CK_VOID_PTR

-kbkdf_FindParameter(CK_SP800_108_KDF_PARAMS_PTR params, CK_PRF_DATA_TYPE type)

+kbkdf_FindParameter(const CK_SP800_108_KDF_PARAMS *params, CK_PRF_DATA_TYPE type)

 {

     for (size_t offset = 0; offset < params->ulNumberOfDataParams; offset++) {

         if (params->pDataParams[offset].type == type) {

@@ -392,7 +392,7 @@

 }

 static CK_RV

-kbkdf_CalculateLength(CK_SP800_108_KDF_PARAMS_PTR params, sftk_MACCtx *ctx, CK_ULONG ret_key_size, PRUint64 *output_bitlen, size_t *buffer_length)

+kbkdf_CalculateLength(const CK_SP800_108_KDF_PARAMS *params, sftk_MACCtx *ctx, CK_ULONG ret_key_size, PRUint64 *output_bitlen, size_t *buffer_length)

 {

     /* Two cases: either we have additional derived keys or we don't. In the

      * case that we don't, the length of the derivation is the size of the

@@ -465,7 +465,7 @@

 }

 static CK_RV

-kbkdf_CalculateIterations(CK_MECHANISM_TYPE mech, CK_SP800_108_KDF_PARAMS_PTR params, sftk_MACCtx *ctx, size_t buffer_length, PRUint32 *num_iterations)

+kbkdf_CalculateIterations(CK_MECHANISM_TYPE mech, const CK_SP800_108_KDF_PARAMS *params, sftk_MACCtx *ctx, size_t buffer_length, PRUint32 *num_iterations)

 {

     CK_SP800_108_COUNTER_FORMAT_PTR param_ptr = NULL;

     PRUint64 iteration_count;

@@ -519,7 +519,7 @@

 }

 static CK_RV

-kbkdf_AddParameters(CK_MECHANISM_TYPE mech, sftk_MACCtx *ctx, CK_SP800_108_KDF_PARAMS *params, PRUint32 counter, PRUint64 length, unsigned char *chaining_prf, size_t chaining_prf_len, CK_PRF_DATA_TYPE exclude)

+kbkdf_AddParameters(CK_MECHANISM_TYPE mech, sftk_MACCtx *ctx, const CK_SP800_108_KDF_PARAMS *params, PRUint32 counter, PRUint64 length, const unsigned char *chaining_prf, size_t chaining_prf_len, CK_PRF_DATA_TYPE exclude)

 {

     size_t offset = 0;

     CK_RV ret = CKR_OK;

@@ -749,7 +749,7 @@

 /* [ section: KDFs ] */

 static CK_RV

-kbkdf_CounterRaw(CK_SP800_108_KDF_PARAMS_PTR params, sftk_MACCtx *ctx, unsigned char *ret_buffer, size_t buffer_length, PRUint64 output_bitlen)

+kbkdf_CounterRaw(const CK_SP800_108_KDF_PARAMS *params, sftk_MACCtx *ctx, unsigned char *ret_buffer, size_t buffer_length, PRUint64 output_bitlen)

 {

     CK_RV ret = CKR_OK;

@@ -837,7 +837,7 @@

 }

 static CK_RV

-kbkdf_FeedbackRaw(CK_SP800_108_KDF_PARAMS_PTR params, unsigned char *initial_value, CK_ULONG initial_value_length, sftk_MACCtx *ctx, unsigned char *ret_buffer, size_t buffer_length, PRUint64 output_bitlen)

+kbkdf_FeedbackRaw(const CK_SP800_108_KDF_PARAMS *params, const unsigned char *initial_value, CK_ULONG initial_value_length, sftk_MACCtx *ctx, unsigned char *ret_buffer, size_t buffer_length, PRUint64 output_bitlen)

 {

     CK_RV ret = CKR_OK;

@@ -859,7 +859,7 @@

      * chaining in this KDF. Note that we have to make it large enough to

      * fit the output of the PRF, but we can delay its actual creation until

      * the first PRF invocation. Until then, point to the IV value. */

-    unsigned char *chaining_value = initial_value;

+    unsigned char *chaining_value = (unsigned char *)initial_value;

     /* Size of the chaining value discussed above. Defaults to the size of

      * the IV value. */

@@ -962,7 +962,7 @@

 }

 static CK_RV

-kbkdf_PipelineRaw(CK_SP800_108_KDF_PARAMS_PTR params, sftk_MACCtx *ctx, unsigned char *ret_buffer, size_t buffer_length, PRUint64 output_bitlen)

+kbkdf_PipelineRaw(const CK_SP800_108_KDF_PARAMS *params, sftk_MACCtx *ctx, unsigned char *ret_buffer, size_t buffer_length, PRUint64 output_bitlen)

 {

     CK_RV ret = CKR_OK;

@@ -1109,31 +1109,17 @@

     return ret;

 }

-/* [ section: PKCS#11 entry ] */

-

-CK_RV

-kbkdf_Dispatch(CK_MECHANISM_TYPE mech, CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, SFTKObject *prf_key, SFTKObject *ret_key, CK_ULONG ret_key_size)

+static CK_RV

+kbkdf_RawDispatch(CK_MECHANISM_TYPE mech,

+                  const CK_SP800_108_KDF_PARAMS *kdf_params,

+                  const CK_BYTE *initial_value,

+                  CK_ULONG initial_value_length,

+                  SFTKObject *prf_key, const unsigned char *prf_key_bytes,

+                  unsigned int prf_key_length, unsigned char **out_key_bytes,

+                  size_t *out_key_length, unsigned int *mac_size,

+                  CK_ULONG ret_key_size)

 {

-    /* This handles boilerplate common to all KBKDF types. Instead of placing

-     * this in pkcs11c.c, place it here to reduce clutter. */

-

     CK_RV ret;

-

-    /* Assumptions about our calling environment. */

-    PR_ASSERT(pMechanism != NULL && prf_key != NULL && ret_key != NULL);

-

-    /* Validate that the caller passed parameters. */

-    if (pMechanism->pParameter == NULL) {

-        return CKR_MECHANISM_PARAM_INVALID;

-    }

-

-    /* Create a common set of parameters to use for all KDF types. This

-     * separates out the KDF parameters from the Feedback-specific IV,

-     * allowing us to use a common type for all calls. */

-    CK_SP800_108_KDF_PARAMS kdf_params = { 0 };

-    CK_BYTE_PTR initial_value = NULL;

-    CK_ULONG initial_value_length = 0;

-

     /* Context for our underlying PRF function.

      *

      * Zeroing context required unconditional call of sftk_MAC_Destroy.

@@ -1168,28 +1154,27 @@

      */

     PRUint64 output_bitlen = 0;

-    /* Split Feedback-specific IV from remaining KDF parameters. */

-    ret = kbkdf_LoadParameters(mech, pMechanism, &kdf_params, &initial_value, &initial_value_length);

-    if (ret != CKR_OK) {

-        goto finish;

-    }

-

     /* First validate our passed input parameters against PKCS#11 v3.0

      * and NIST SP800-108 requirements. */

-    ret = kbkdf_ValidateParameters(mech, &kdf_params, ret_key_size);

+    ret = kbkdf_ValidateParameters(mech, kdf_params, ret_key_size);

     if (ret != CKR_OK) {

         goto finish;

     }

     /* Initialize the underlying PRF state. */

-    ret = sftk_MAC_Init(&ctx, kdf_params.prfType, prf_key);

+    if (prf_key) {

+        ret = sftk_MAC_Init(&ctx, kdf_params->prfType, prf_key);

+    } else {

+        ret = sftk_MAC_InitRaw(&ctx, kdf_params->prfType, prf_key_bytes,

+                               prf_key_length, PR_TRUE);

+    }

     if (ret != CKR_OK) {

         goto finish;

     }

     /* Compute the size of our output buffer based on passed parameters and

      * the output size of the underlying PRF. */

-    ret = kbkdf_CalculateLength(&kdf_params, &ctx, ret_key_size, &output_bitlen, &buffer_length);

+    ret = kbkdf_CalculateLength(kdf_params, &ctx, ret_key_size, &output_bitlen, &buffer_length);

     if (ret != CKR_OK) {

         goto finish;

     }

@@ -1205,15 +1190,15 @@

     switch (mech) {

         case CKM_NSS_SP800_108_COUNTER_KDF_DERIVE_DATA: /* fall through */

         case CKM_SP800_108_COUNTER_KDF:

-            ret = kbkdf_CounterRaw(&kdf_params, &ctx, output_buffer, buffer_length, output_bitlen);

+            ret = kbkdf_CounterRaw(kdf_params, &ctx, output_buffer, buffer_length, output_bitlen);

             break;

         case CKM_NSS_SP800_108_FEEDBACK_KDF_DERIVE_DATA: /* fall through */

         case CKM_SP800_108_FEEDBACK_KDF:

-            ret = kbkdf_FeedbackRaw(&kdf_params, initial_value, initial_value_length, &ctx, output_buffer, buffer_length, output_bitlen);

+            ret = kbkdf_FeedbackRaw(kdf_params, initial_value, initial_value_length, &ctx, output_buffer, buffer_length, output_bitlen);

             break;

         case CKM_NSS_SP800_108_DOUBLE_PIPELINE_KDF_DERIVE_DATA: /* fall through */

         case CKM_SP800_108_DOUBLE_PIPELINE_KDF:

-            ret = kbkdf_PipelineRaw(&kdf_params, &ctx, output_buffer, buffer_length, output_bitlen);

+            ret = kbkdf_PipelineRaw(kdf_params, &ctx, output_buffer, buffer_length, output_bitlen);

             break;

         default:

             /* Shouldn't happen unless NIST introduces a new KBKDF type. */

@@ -1226,8 +1211,65 @@

         goto finish;

     }

+    *out_key_bytes = output_buffer;

+    *out_key_length = buffer_length;

+    *mac_size = ctx.mac_size;

+

+    output_buffer = NULL; /* returning the buffer, don't zero and free it */

+

+finish:

+    PORT_ZFree(output_buffer, buffer_length);

+

+    /* Free the PRF. This should handle clearing all sensitive information. */

+    sftk_MAC_Destroy(&ctx, PR_FALSE);

+    return ret;

+}

+

+/* [ section: PKCS#11 entry ] */

+

+CK_RV

+kbkdf_Dispatch(CK_MECHANISM_TYPE mech, CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, SFTKObject *prf_key, SFTKObject *ret_key, CK_ULONG ret_key_size)

+{

+    /* This handles boilerplate common to all KBKDF types. Instead of placing

+     * this in pkcs11c.c, place it here to reduce clutter. */

+

+    CK_RV ret;

+

+    /* Assumptions about our calling environment. */

+    PR_ASSERT(pMechanism != NULL && prf_key != NULL && ret_key != NULL);

+

+    /* Validate that the caller passed parameters. */

+    if (pMechanism->pParameter == NULL) {

+        return CKR_MECHANISM_PARAM_INVALID;

+    }

+

+    /* Create a common set of parameters to use for all KDF types. This

+     * separates out the KDF parameters from the Feedback-specific IV,

+     * allowing us to use a common type for all calls. */

+    CK_SP800_108_KDF_PARAMS kdf_params = { 0 };

+    CK_BYTE_PTR initial_value = NULL;

+    CK_ULONG initial_value_length = 0;

+    unsigned char *output_buffer = NULL;

+    size_t buffer_length = 0;

+    unsigned int mac_size = 0;

+

+    /* Split Feedback-specific IV from remaining KDF parameters. */

+    ret = kbkdf_LoadParameters(mech, pMechanism, &kdf_params, &initial_value, &initial_value_length);

+    if (ret != CKR_OK) {

+        goto finish;

+    }

+    /* let rawDispatch handle the rest. We split this out so we could

+     * handle the POST test without accessing pkcs #11 objects. */

+    ret = kbkdf_RawDispatch(mech, &kdf_params, initial_value,

+                            initial_value_length, prf_key, NULL, 0,

+                            &output_buffer, &buffer_length, &mac_size,

+                            ret_key_size);

+    if (ret != CKR_OK) {

+        goto finish;

+    }

+

     /* Write the output of the PRF into the appropriate keys. */

-    ret = kbkdf_SaveKeys(mech, hSession, &kdf_params, output_buffer, buffer_length, ctx.mac_size, ret_key, ret_key_size);

+    ret = kbkdf_SaveKeys(mech, hSession, &kdf_params, output_buffer, buffer_length, mac_size, ret_key, ret_key_size);

     if (ret != CKR_OK) {

         goto finish;

     }

@@ -1235,8 +1277,242 @@

 finish:

     PORT_ZFree(output_buffer, buffer_length);

-    /* Free the PRF. This should handle clearing all sensitive information. */

-    sftk_MAC_Destroy(&ctx, PR_FALSE);

-

     return ret;

 }

+

+struct sftk_SP800_Test_struct {

+    CK_MECHANISM_TYPE mech;

+    CK_SP800_108_KDF_PARAMS kdf_params;

+    unsigned int expected_mac_size;

+    unsigned int ret_key_length;

+    const unsigned char expected_key_bytes[64];

+};

+

+static const CK_SP800_108_COUNTER_FORMAT counter_32 = { 0, 32 };

+static const CK_PRF_DATA_PARAM counter_32_data =

+    { CK_SP800_108_ITERATION_VARIABLE, (CK_VOID_PTR)&counter_32, sizeof(counter_32) };