|
 |
447573 |
From 51ed2d7171e5423cfec86c36ffa32e8e9e0de01c Mon Sep 17 00:00:00 2001
|
|
|
447573 |
From: Ingo Franzki <ifranzki@linux.ibm.com>
|
|
|
447573 |
Date: Tue, 1 Mar 2022 16:55:01 +0100
|
|
|
447573 |
Subject: [PATCH 27/34] EP11: Add support for encrypt/decrypt and KEM
|
|
|
447573 |
operations with Kyber
|
|
|
447573 |
|
|
|
447573 |
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
|
|
|
447573 |
---
|
|
|
447573 |
usr/lib/ep11_stdll/ep11_specific.c | 174 ++++++++++++++++++++++++++++++++++---
|
|
|
447573 |
usr/lib/ep11_stdll/new_host.c | 24 +++--
|
|
|
447573 |
2 files changed, 180 insertions(+), 18 deletions(-)
|
|
|
447573 |
|
|
|
447573 |
diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c
|
|
|
447573 |
index bc17b07a..9efce053 100644
|
|
|
447573 |
--- a/usr/lib/ep11_stdll/ep11_specific.c
|
|
|
447573 |
+++ b/usr/lib/ep11_stdll/ep11_specific.c
|
|
|
447573 |
@@ -5196,6 +5196,126 @@ CK_RV token_specific_aes_cmac(STDLL_TokData_t *tokdata,
|
|
|
447573 |
return rc;
|
|
|
447573 |
}
|
|
|
447573 |
|
|
|
447573 |
+struct EP11_KYBER_MECH {
|
|
|
447573 |
+ CK_MECHANISM mech;
|
|
|
447573 |
+ struct XCP_KYBER_KEM_PARAMS params;
|
|
|
447573 |
+};
|
|
|
447573 |
+
|
|
|
447573 |
+static CK_RV ep11tok_kyber_mech_pre_process(STDLL_TokData_t *tokdata,
|
|
|
447573 |
+ CK_MECHANISM *mech,
|
|
|
447573 |
+ struct EP11_KYBER_MECH *mech_ep11,
|
|
|
447573 |
+ OBJECT **secret_key_obj)
|
|
|
447573 |
+{
|
|
|
447573 |
+ CK_IBM_KYBER_PARAMS *kyber_params;
|
|
|
447573 |
+ CK_RV rc;
|
|
|
447573 |
+
|
|
|
447573 |
+ kyber_params = mech->pParameter;
|
|
|
447573 |
+ if (mech->ulParameterLen != sizeof(CK_IBM_KYBER_PARAMS)) {
|
|
|
447573 |
+ TRACE_ERROR("Mechanism parameter length not as expected\n");
|
|
|
447573 |
+ return CKR_MECHANISM_PARAM_INVALID;
|
|
|
447573 |
+ }
|
|
|
447573 |
+
|
|
|
447573 |
+ if (kyber_params->ulVersion != CK_IBM_KYBER_KEM_VERSION) {
|
|
|
447573 |
+ TRACE_ERROR("Unsupported version in Kyber mechanism param\n");
|
|
|
447573 |
+ return CKR_MECHANISM_PARAM_INVALID;
|
|
|
447573 |
+ }
|
|
|
447573 |
+
|
|
|
447573 |
+ mech_ep11->mech.mechanism = mech->mechanism;
|
|
|
447573 |
+ mech_ep11->mech.pParameter = &mech_ep11->params;
|
|
|
447573 |
+ mech_ep11->mech.ulParameterLen = sizeof(mech_ep11->params);
|
|
|
447573 |
+
|
|
|
447573 |
+ memset(&mech_ep11->params, 0, sizeof(mech_ep11->params));
|
|
|
447573 |
+ mech_ep11->params.version = XCP_KYBER_KEM_VERSION;
|
|
|
447573 |
+ mech_ep11->params.mode = kyber_params->mode;
|
|
|
447573 |
+ mech_ep11->params.kdf = kyber_params->kdf;
|
|
|
447573 |
+ mech_ep11->params.prepend = kyber_params->bPrepend;
|
|
|
447573 |
+ mech_ep11->params.pSharedData = kyber_params->pSharedData;
|
|
|
447573 |
+ mech_ep11->params.ulSharedDataLen = kyber_params->ulSharedDataLen;
|
|
|
447573 |
+
|
|
|
447573 |
+ switch (kyber_params->mode) {
|
|
|
447573 |
+ case CK_IBM_KYBER_KEM_ENCAPSULATE:
|
|
|
447573 |
+ if (kyber_params->ulCipherLen > 0 && kyber_params->pCipher == NULL) {
|
|
|
447573 |
+ TRACE_ERROR("Unsupported cipher buffer in Kyber mechnism param "
|
|
|
447573 |
+ "cannot be NULL\n");
|
|
|
447573 |
+ return CKR_MECHANISM_PARAM_INVALID;
|
|
|
447573 |
+ }
|
|
|
447573 |
+
|
|
|
447573 |
+ mech_ep11->params.pCipher = NULL;
|
|
|
447573 |
+ mech_ep11->params.ulCipherLen = 0;
|
|
|
447573 |
+ /* Cipher is returned in 2nd output param of m_DeriveKey */
|
|
|
447573 |
+ break;
|
|
|
447573 |
+
|
|
|
447573 |
+ case CK_IBM_KEM_DECAPSULATE:
|
|
|
447573 |
+ mech_ep11->params.pCipher = kyber_params->pCipher;
|
|
|
447573 |
+ mech_ep11->params.ulCipherLen = kyber_params->ulCipherLen;
|
|
|
447573 |
+ break;
|
|
|
447573 |
+
|
|
|
447573 |
+ default:
|
|
|
447573 |
+ TRACE_ERROR("Unsupported mode in Kyber mechanism param\n");
|
|
|
447573 |
+ return CKR_MECHANISM_PARAM_INVALID;
|
|
|
447573 |
+ }
|
|
|
447573 |
+
|
|
|
447573 |
+ if (kyber_params->bPrepend) {
|
|
|
447573 |
+ rc = h_opaque_2_blob(tokdata, kyber_params->hSecret,
|
|
|
447573 |
+ &mech_ep11->params.pBlob,
|
|
|
447573 |
+ &mech_ep11->params.ulBlobLen,
|
|
|
447573 |
+ secret_key_obj, READ_LOCK);
|
|
|
447573 |
+ if (rc != CKR_OK) {
|
|
|
447573 |
+ TRACE_ERROR("%s failed hSecret=0x%lx\n", __func__,
|
|
|
447573 |
+ kyber_params->hSecret);
|
|
|
447573 |
+ return rc;
|
|
|
447573 |
+ }
|
|
|
447573 |
+ }
|
|
|
447573 |
+
|
|
|
447573 |
+ return CKR_OK;
|
|
|
447573 |
+}
|
|
|
447573 |
+
|
|
|
447573 |
+static CK_RV ep11tok_kyber_mech_post_process(STDLL_TokData_t *tokdata,
|
|
|
447573 |
+ CK_MECHANISM *mech,
|
|
|
447573 |
+ CK_BYTE *csum, CK_ULONG cslen)
|
|
|
447573 |
+{
|
|
|
447573 |
+ CK_IBM_KYBER_PARAMS *kyber_params;
|
|
|
447573 |
+ CK_ULONG cipher_len;
|
|
|
447573 |
+
|
|
|
447573 |
+ UNUSED(tokdata);
|
|
|
447573 |
+
|
|
|
447573 |
+ kyber_params = mech->pParameter;
|
|
|
447573 |
+ if (mech->ulParameterLen != sizeof(CK_IBM_KYBER_PARAMS)) {
|
|
|
447573 |
+ TRACE_ERROR("Mechanism parameter length not as expected\n");
|
|
|
447573 |
+ return CKR_MECHANISM_PARAM_INVALID;
|
|
|
447573 |
+ }
|
|
|
447573 |
+
|
|
|
447573 |
+ if (kyber_params->mode != CK_IBM_KYBER_KEM_ENCAPSULATE)
|
|
|
447573 |
+ return CKR_OK;
|
|
|
447573 |
+
|
|
|
447573 |
+ /*
|
|
|
447573 |
+ * For encapsulate:
|
|
|
447573 |
+ * Generated cipher is returned in csum prepended with the checksum of
|
|
|
447573 |
+ * the generated symmetric key and its bit count (in total 7 bytes).
|
|
|
447573 |
+ */
|
|
|
447573 |
+ if (cslen < EP11_CSUMSIZE + 4) {
|
|
|
447573 |
+ TRACE_ERROR("%s returned cipher size is invalid: %lu\n",
|
|
|
447573 |
+ __func__, cslen);
|
|
|
447573 |
+ return CKR_FUNCTION_FAILED;
|
|
|
447573 |
+ }
|
|
|
447573 |
+
|
|
|
447573 |
+ cipher_len = cslen - (EP11_CSUMSIZE + 4);
|
|
|
447573 |
+
|
|
|
447573 |
+ if (kyber_params->ulCipherLen < cipher_len) {
|
|
|
447573 |
+ TRACE_ERROR("%s Cipher buffer in kyber mechanism param too small, required: %lu\n",
|
|
|
447573 |
+ __func__, cipher_len);
|
|
|
447573 |
+ kyber_params->ulCipherLen = cipher_len;
|
|
|
447573 |
+ OPENSSL_cleanse(&csum[EP11_CSUMSIZE + 4], cipher_len);
|
|
|
447573 |
+ return CKR_BUFFER_TOO_SMALL;
|
|
|
447573 |
+ }
|
|
|
447573 |
+
|
|
|
447573 |
+ memcpy(kyber_params->pCipher, &csum[EP11_CSUMSIZE + 4], cipher_len);
|
|
|
447573 |
+ kyber_params->ulCipherLen = cipher_len;
|
|
|
447573 |
+
|
|
|
447573 |
+ OPENSSL_cleanse(&csum[EP11_CSUMSIZE + 4], cipher_len);
|
|
|
447573 |
+ return CKR_OK;
|
|
|
447573 |
+}
|
|
|
447573 |
+
|
|
|
447573 |
CK_RV ep11tok_derive_key(STDLL_TokData_t * tokdata, SESSION * session,
|
|
|
447573 |
CK_MECHANISM_PTR mech, CK_OBJECT_HANDLE hBaseKey,
|
|
|
447573 |
CK_OBJECT_HANDLE_PTR handle, CK_ATTRIBUTE_PTR attrs,
|
|
|
447573 |
@@ -5236,6 +5356,8 @@ CK_RV ep11tok_derive_key(STDLL_TokData_t * tokdata, SESSION * session,
|
|
|
447573 |
CK_BYTE *spki = NULL;
|
|
|
447573 |
CK_ULONG spki_length = 0;
|
|
|
447573 |
CK_ATTRIBUTE *spki_attr = NULL;
|
|
|
447573 |
+ struct EP11_KYBER_MECH mech_ep11;
|
|
|
447573 |
+ OBJECT *kyber_secret_obj = NULL;
|
|
|
447573 |
|
|
|
447573 |
memset(newblob, 0, sizeof(newblob));
|
|
|
447573 |
|
|
|
447573 |
@@ -5517,16 +5639,29 @@ CK_RV ep11tok_derive_key(STDLL_TokData_t * tokdata, SESSION * session,
|
|
|
447573 |
}
|
|
|
447573 |
}
|
|
|
447573 |
|
|
|
447573 |
+ if (mech->mechanism == CKM_IBM_KYBER) {
|
|
|
447573 |
+ rc = ep11tok_kyber_mech_pre_process(tokdata, mech, &mech_ep11,
|
|
|
447573 |
+ &kyber_secret_obj);
|
|
|
447573 |
+ if (rc != CKR_OK)
|
|
|
447573 |
+ goto error;
|
|
|
447573 |
+ mech = &mech_ep11.mech;
|
|
|
447573 |
+ }
|
|
|
447573 |
+
|
|
|
447573 |
trace_attributes(__func__, "Derive:", new_attrs2, new_attrs2_len);
|
|
|
447573 |
|
|
|
447573 |
ep11_get_pin_blob(ep11_session, ep11_is_session_object(attrs, attrs_len),
|
|
|
447573 |
&ep11_pin_blob, &ep11_pin_blob_len);
|
|
|
447573 |
|
|
|
447573 |
RETRY_START(rc, tokdata)
|
|
|
447573 |
- rc =
|
|
|
447573 |
- dll_m_DeriveKey(mech, new_attrs2, new_attrs2_len, keyblob, keyblobsize,
|
|
|
447573 |
- NULL, 0, ep11_pin_blob, ep11_pin_blob_len, newblob,
|
|
|
447573 |
- &newblobsize, csum, &cslen, target_info->target);
|
|
|
447573 |
+ if (ep11_pqc_obj_strength_supported(target_info, mech->mechanism,
|
|
|
447573 |
+ base_key_obj))
|
|
|
447573 |
+ rc = dll_m_DeriveKey(mech, new_attrs2, new_attrs2_len,
|
|
|
447573 |
+ keyblob, keyblobsize, NULL, 0,
|
|
|
447573 |
+ ep11_pin_blob, ep11_pin_blob_len, newblob,
|
|
|
447573 |
+ &newblobsize, csum, &cslen,
|
|
|
447573 |
+ target_info->target);
|
|
|
447573 |
+ else
|
|
|
447573 |
+ rc = CKR_KEY_SIZE_RANGE;
|
|
|
447573 |
RETRY_END(rc, tokdata, session)
|
|
|
447573 |
|
|
|
447573 |
if (rc != CKR_OK) {
|
|
|
447573 |
@@ -5610,6 +5745,12 @@ CK_RV ep11tok_derive_key(STDLL_TokData_t * tokdata, SESSION * session,
|
|
|
447573 |
}
|
|
|
447573 |
}
|
|
|
447573 |
|
|
|
447573 |
+ if (mech->mechanism == CKM_IBM_KYBER) {
|
|
|
447573 |
+ rc = ep11tok_kyber_mech_post_process(tokdata, mech_orig, csum, cslen);
|
|
|
447573 |
+ if (rc != CKR_OK)
|
|
|
447573 |
+ goto error;
|
|
|
447573 |
+ }
|
|
|
447573 |
+
|
|
|
447573 |
if (class == CKO_SECRET_KEY && cslen >= EP11_CSUMSIZE) {
|
|
|
447573 |
/* First 3 bytes of csum is the check value */
|
|
|
447573 |
rc = build_attribute(CKA_CHECK_VALUE, csum, EP11_CSUMSIZE, &chk_attr);
|
|
|
447573 |
@@ -5666,6 +5807,8 @@ error:
|
|
|
447573 |
|
|
|
447573 |
object_put(tokdata, base_key_obj, TRUE);
|
|
|
447573 |
base_key_obj = NULL;
|
|
|
447573 |
+ object_put(tokdata, kyber_secret_obj, TRUE);
|
|
|
447573 |
+ kyber_secret_obj = NULL;
|
|
|
447573 |
|
|
|
447573 |
return rc;
|
|
|
447573 |
}
|
|
|
447573 |
@@ -7399,6 +7542,7 @@ CK_BOOL ep11tok_mech_single_only(CK_MECHANISM *mech)
|
|
|
447573 |
{
|
|
|
447573 |
switch (mech->mechanism) {
|
|
|
447573 |
case CKM_IBM_ECDSA_OTHER:
|
|
|
447573 |
+ case CKM_IBM_KYBER:
|
|
|
447573 |
return CK_TRUE;
|
|
|
447573 |
default:
|
|
|
447573 |
return CK_FALSE;
|
|
|
447573 |
@@ -8301,9 +8445,14 @@ CK_RV ep11tok_decrypt_single(STDLL_TokData_t *tokdata, SESSION *session,
|
|
|
447573 |
}
|
|
|
447573 |
|
|
|
447573 |
RETRY_START(rc, tokdata)
|
|
|
447573 |
- rc = dll_m_DecryptSingle(keyblob, keyblobsize, mech, input_data,
|
|
|
447573 |
- input_data_len, output_data, p_output_data_len,
|
|
|
447573 |
- target_info->target);
|
|
|
447573 |
+ if (ep11_pqc_obj_strength_supported(target_info, mech->mechanism,
|
|
|
447573 |
+ key_obj))
|
|
|
447573 |
+ rc = dll_m_DecryptSingle(keyblob, keyblobsize, mech, input_data,
|
|
|
447573 |
+ input_data_len, output_data,
|
|
|
447573 |
+ p_output_data_len,
|
|
|
447573 |
+ target_info->target);
|
|
|
447573 |
+ else
|
|
|
447573 |
+ rc = CKR_KEY_SIZE_RANGE;
|
|
|
447573 |
RETRY_END(rc, tokdata, session)
|
|
|
447573 |
if (rc != CKR_OK) {
|
|
|
447573 |
rc = ep11_error_to_pkcs11_error(rc, session);
|
|
|
447573 |
@@ -8511,9 +8660,14 @@ CK_RV ep11tok_encrypt_single(STDLL_TokData_t *tokdata, SESSION *session,
|
|
|
447573 |
}
|
|
|
447573 |
|
|
|
447573 |
RETRY_START(rc, tokdata)
|
|
|
447573 |
- rc = dll_m_EncryptSingle(keyblob, keyblobsize, mech, input_data,
|
|
|
447573 |
- input_data_len, output_data, p_output_data_len,
|
|
|
447573 |
- target_info->target);
|
|
|
447573 |
+ if (ep11_pqc_obj_strength_supported(target_info, mech->mechanism,
|
|
|
447573 |
+ key_obj))
|
|
|
447573 |
+ rc = dll_m_EncryptSingle(keyblob, keyblobsize, mech, input_data,
|
|
|
447573 |
+ input_data_len, output_data,
|
|
|
447573 |
+ p_output_data_len,
|
|
|
447573 |
+ target_info->target);
|
|
|
447573 |
+ else
|
|
|
447573 |
+ rc = CKR_KEY_SIZE_RANGE;
|
|
|
447573 |
RETRY_END(rc, tokdata, session)
|
|
|
447573 |
if (rc != CKR_OK) {
|
|
|
447573 |
rc = ep11_error_to_pkcs11_error(rc, session);
|
|
|
447573 |
diff --git a/usr/lib/ep11_stdll/new_host.c b/usr/lib/ep11_stdll/new_host.c
|
|
|
447573 |
index dccdfe96..60027c85 100644
|
|
|
447573 |
--- a/usr/lib/ep11_stdll/new_host.c
|
|
|
447573 |
+++ b/usr/lib/ep11_stdll/new_host.c
|
|
|
447573 |
@@ -2061,7 +2061,8 @@ CK_RV SC_EncryptInit(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
|
|
|
447573 |
sess->encr_ctx.multi_init = FALSE;
|
|
|
447573 |
sess->encr_ctx.multi = FALSE;
|
|
|
447573 |
|
|
|
447573 |
- if (ep11tok_optimize_single_ops(tokdata) &&
|
|
|
447573 |
+ if ((ep11tok_optimize_single_ops(tokdata) ||
|
|
|
447573 |
+ ep11tok_mech_single_only(pMechanism)) &&
|
|
|
447573 |
!ep11tok_pkey_usage_ok(tokdata, sess, hKey, pMechanism)) {
|
|
|
447573 |
/* In case of a single part encrypt operation we don't need the
|
|
|
447573 |
* EncryptInit, instead we can use the EncryptSingle which is much
|
|
|
447573 |
@@ -2159,7 +2160,8 @@ CK_RV SC_Encrypt(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
|
|
|
447573 |
goto done;
|
|
|
447573 |
}
|
|
|
447573 |
|
|
|
447573 |
- if (ep11tok_optimize_single_ops(tokdata) &&
|
|
|
447573 |
+ if ((ep11tok_optimize_single_ops(tokdata) ||
|
|
|
447573 |
+ ep11tok_mech_single_only(&sess->encr_ctx.mech)) &&
|
|
|
447573 |
!ep11tok_pkey_usage_ok(tokdata, sess, sess->encr_ctx.key, &sess->encr_ctx.mech)) {
|
|
|
447573 |
rc = ep11tok_encrypt_single(tokdata, sess, &sess->encr_ctx.mech,
|
|
|
447573 |
length_only, sess->encr_ctx.key,
|
|
|
447573 |
@@ -2217,7 +2219,8 @@ CK_RV SC_EncryptUpdate(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
|
|
|
447573 |
goto done;
|
|
|
447573 |
}
|
|
|
447573 |
|
|
|
447573 |
- if (sess->encr_ctx.active == FALSE) {
|
|
|
447573 |
+ if (sess->encr_ctx.active == FALSE ||
|
|
|
447573 |
+ ep11tok_mech_single_only(&sess->encr_ctx.mech)) {
|
|
|
447573 |
TRACE_ERROR("%s\n", ock_err(ERR_OPERATION_NOT_INITIALIZED));
|
|
|
447573 |
rc = CKR_OPERATION_NOT_INITIALIZED;
|
|
|
447573 |
goto done;
|
|
|
447573 |
@@ -2293,7 +2296,8 @@ CK_RV SC_EncryptFinal(STDLL_TokData_t * tokdata, ST_SESSION_HANDLE * sSession,
|
|
|
447573 |
goto done;
|
|
|
447573 |
}
|
|
|
447573 |
|
|
|
447573 |
- if (sess->encr_ctx.active == FALSE) {
|
|
|
447573 |
+ if (sess->encr_ctx.active == FALSE ||
|
|
|
447573 |
+ ep11tok_mech_single_only(&sess->encr_ctx.mech)) {
|
|
|
447573 |
TRACE_ERROR("%s\n", ock_err(ERR_OPERATION_NOT_INITIALIZED));
|
|
|
447573 |
rc = CKR_OPERATION_NOT_INITIALIZED;
|
|
|
447573 |
goto done;
|
|
|
447573 |
@@ -2385,7 +2389,8 @@ CK_RV SC_DecryptInit(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
|
|
|
447573 |
sess->decr_ctx.multi_init = FALSE;
|
|
|
447573 |
sess->decr_ctx.multi = FALSE;
|
|
|
447573 |
|
|
|
447573 |
- if (ep11tok_optimize_single_ops(tokdata) &&
|
|
|
447573 |
+ if ((ep11tok_optimize_single_ops(tokdata) ||
|
|
|
447573 |
+ ep11tok_mech_single_only(pMechanism)) &&
|
|
|
447573 |
!ep11tok_pkey_usage_ok(tokdata, sess, hKey, pMechanism)) {
|
|
|
447573 |
/* In case of a single part decrypt operation we don't need the
|
|
|
447573 |
* DecryptInit, instead we can use the EncryptSingle which is much
|
|
|
447573 |
@@ -2483,7 +2488,8 @@ CK_RV SC_Decrypt(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
|
|
|
447573 |
goto done;
|
|
|
447573 |
}
|
|
|
447573 |
|
|
|
447573 |
- if (ep11tok_optimize_single_ops(tokdata) &&
|
|
|
447573 |
+ if ((ep11tok_optimize_single_ops(tokdata) ||
|
|
|
447573 |
+ ep11tok_mech_single_only(&sess->decr_ctx.mech)) &&
|
|
|
447573 |
!ep11tok_pkey_usage_ok(tokdata, sess, sess->decr_ctx.key, &sess->decr_ctx.mech)) {
|
|
|
447573 |
rc = ep11tok_decrypt_single(tokdata, sess, &sess->decr_ctx.mech,
|
|
|
447573 |
length_only, sess->decr_ctx.key,
|
|
|
447573 |
@@ -2541,7 +2547,8 @@ CK_RV SC_DecryptUpdate(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
|
|
|
447573 |
goto done;
|
|
|
447573 |
}
|
|
|
447573 |
|
|
|
447573 |
- if (sess->decr_ctx.active == FALSE) {
|
|
|
447573 |
+ if (sess->decr_ctx.active == FALSE ||
|
|
|
447573 |
+ ep11tok_mech_single_only(&sess->decr_ctx.mech)) {
|
|
|
447573 |
TRACE_ERROR("%s\n", ock_err(ERR_OPERATION_NOT_INITIALIZED));
|
|
|
447573 |
rc = CKR_OPERATION_NOT_INITIALIZED;
|
|
|
447573 |
goto done;
|
|
|
447573 |
@@ -2617,7 +2624,8 @@ CK_RV SC_DecryptFinal(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
|
|
|
447573 |
goto done;
|
|
|
447573 |
}
|
|
|
447573 |
|
|
|
447573 |
- if (sess->decr_ctx.active == FALSE) {
|
|
|
447573 |
+ if (sess->decr_ctx.active == FALSE ||
|
|
|
447573 |
+ ep11tok_mech_single_only(&sess->decr_ctx.mech)) {
|
|
|
447573 |
TRACE_ERROR("%s\n", ock_err(ERR_OPERATION_NOT_INITIALIZED));
|
|
|
447573 |
rc = CKR_OPERATION_NOT_INITIALIZED;
|
|
|
447573 |
goto done;
|
|
|
447573 |
--
|
|
|
447573 |
2.16.2.windows.1
|
|
|
447573 |
|