/*************************************************************** * Copyright (C) Aktiv Co. 2003-2026 * * rtpkcs11t.h * * This file contains all symbols for PKCS#11 library, and * * extensions for Rutoken * ***************************************************************/ #ifndef __RTPKCS11T_H__ #define __RTPKCS11T_H__ #include "pkcs11tc26_12.h" #include "pkcs11tc26_18.h" #define CK_VENDOR_PKCS11_RU_TEAM_TK26 NSSCK_VENDOR_PKCS11_RU_TEAM #define CKA_VENDOR_ARRAY_ATTRIBUTE (CKA_VENDOR_DEFINED|CKF_ARRAY_ATTRIBUTE) // Container ID for objects which were created via Aktiv CSP/Rutoken Minidriver #define CKA_VENDOR_AKTIV_CSP_CONTAINER_ID (CKA_VENDOR_DEFINED+9UL) // Crypto API container name for objects which were created via pkcs11 #define CKA_VENDOR_CRYPTOAPI_CONTAINER_NAME (CKA_VENDOR_DEFINED+10UL) /* Extended attributes for GOST private keys */ /* Key only for journal operations - CK_BOOL type */ #define CKA_VENDOR_KEY_JOURNAL (CKA_VENDOR_DEFINED|0x2002UL) /* DEPRECATED */ #define CKA_VENDOR_KEY_PIN_ENTER (CKA_VENDOR_DEFINED|0x2000UL) #define CKA_VENDOR_KEY_CONFIRM_OP (CKA_VENDOR_DEFINED|0x2001UL) /* Extended attributes for private keys for Rutoken Touch */ /* Signing should be confirmed by button press - CK_BBOOL type */ #define CKA_VENDOR_CONFIRM_BY_TOUCH (CKA_VENDOR_DEFINED|0x2003UL) #define CKA_VENDOR_SECURE_MESSAGING_AVAILABLE (CKA_VENDOR_DEFINED|0x3000UL) #define CKA_VENDOR_CURRENT_SECURE_MESSAGING_MODE (CKA_VENDOR_DEFINED|0x3001UL) #define CKA_VENDOR_SUPPORTED_SECURE_MESSAGING_MODES (CKA_VENDOR_DEFINED|0x3002UL) #define CKA_VENDOR_CURRENT_TOKEN_INTERFACE (CKA_VENDOR_DEFINED|0x3003UL) #define CKA_VENDOR_SUPPORTED_TOKEN_INTERFACE (CKA_VENDOR_DEFINED|0x3004UL) #define CKA_VENDOR_EXTERNAL_AUTHENTICATION (CKA_VENDOR_DEFINED|0x3005UL) #define CKA_VENDOR_BIOMETRIC_AUTHENTICATION (CKA_VENDOR_DEFINED|0x3006UL) #define CKA_VENDOR_SUPPORT_CUSTOM_PIN (CKA_VENDOR_DEFINED|0x3007UL) #define CKA_VENDOR_CUSTOM_ADMIN_PIN (CKA_VENDOR_DEFINED|0x3008UL) #define CKA_VENDOR_CUSTOM_USER_PIN (CKA_VENDOR_DEFINED|0x3009UL) #define CKA_VENDOR_SUPPORT_INTERNAL_TRUSTED_CERTS (CKA_VENDOR_DEFINED|0x300AUL) #define CKA_VENDOR_SUPPORT_FKC2 (CKA_VENDOR_DEFINED|0x300BUL) #define CKA_VENDOR_SUPPORT_HW_RESULT_FOR_GOST28147_KEY_UNWRAP (CKA_VENDOR_DEFINED|0x300CUL) #define CKA_VENDOR_SUPPORT_HW_KDF_TREE (CKA_VENDOR_DEFINED|0x300DUL) #define CKA_VENDOR_SUPPORT_KIMP15 (CKA_VENDOR_DEFINED|0x300EUL) #define CKA_VENDOR_FLASH_DRIVE_AVAILABLE (CKA_VENDOR_DEFINED|0x300FUL) /* An UTF8-8 array, that contains symbolic token model name */ #define CKA_VENDOR_MODEL_NAME (CKA_VENDOR_DEFINED|0x3010UL) #define CKA_VENDOR_SUPPORT_HW_AES_WRAP (CKA_VENDOR_DEFINED|0x3011UL) #define CKA_VENDOR_SUPPORT_REPAIR_FORMAT (CKA_VENDOR_DEFINED|0x3012UL) /* Array of CK_ULONG's with device protection mechanisms */ #define CKA_VENDOR_PROTECTION_FEATURES (CKA_VENDOR_ARRAY_ATTRIBUTE|0x3013UL) /* Array of CK_KEY_TYPE's with supported key algorithms for emitent key */ #define CKA_VENDOR_SUPPORTED_EMITENT_KEY_ALGS (CKA_VENDOR_ARRAY_ATTRIBUTE|0x3015UL) /* Trusted import attributes */ /* A byte array, that contains checksum of an object */ #define CKA_VENDOR_CHECKSUM (CKA_VENDOR_DEFINED|0x3100UL) /* A byte array, that contains HMAC of transferring data */ #define CKA_VENDOR_HMAC_VALUE (CKA_VENDOR_DEFINED|0x3101UL) /* Certificate attribute - trusted certificate, imported via emitent key */ #define CKA_VENDOR_INTERNAL_TRUSTED_CERT (CKA_VENDOR_DEFINED|0x3102UL) /* IV attribute, which is used for data entry via emitent key */ #define CKA_VENDOR_IV (CKA_VENDOR_DEFINED|0x3103UL) /* PIN state */ #define CKA_VENDOR_PIN_POLICY_STATE (CKA_VENDOR_DEFINED|0x3200UL) /* Pin policies will be removed during format */ #define CKA_VENDOR_PIN_POLICIES_DELETABLE (CKA_VENDOR_DEFINED|0x3201UL) /* Get array of CK_ATTRIBUTE_TYPE of supported policies */ #define CKA_VENDOR_SUPPORTED_PIN_POLICIES (CKA_VENDOR_ARRAY_ATTRIBUTE|0x3202UL) /* Minimal PIN length */ #define CKA_VENDOR_PIN_POLICY_MIN_LENGTH (CKA_VENDOR_DEFINED|0x3203UL) /* Number of previous PINs remembered. New PINs cannot be set to those values */ #define CKA_VENDOR_PIN_POLICY_HISTORY_DEPTH (CKA_VENDOR_DEFINED|0x3204UL) /* Permits operations with default PIN */ #define CKA_VENDOR_PIN_POLICY_ALLOW_DEFAULT_PIN_USAGE (CKA_VENDOR_DEFINED|0x3205UL) /* PIN contains at least one digit */ #define CKA_VENDOR_PIN_POLICY_DIGIT_REQUIRED (CKA_VENDOR_DEFINED|0x3206UL) /* PIN contains at least one upper case letter */ #define CKA_VENDOR_PIN_POLICY_UPPERCASE_REQUIRED (CKA_VENDOR_DEFINED|0x3207UL) /* PIN contains at least one lower case letter */ #define CKA_VENDOR_PIN_POLICY_LOWERCASE_REQUIRED (CKA_VENDOR_DEFINED|0x3208UL) /* PIN contains at least one special character */ #define CKA_VENDOR_PIN_POLICY_SPEC_CHAR_REQUIRED (CKA_VENDOR_DEFINED|0x3209UL) /* PIN doesn't consist of one repeated character */ #define CKA_VENDOR_PIN_POLICY_DIFF_CHARS_REQUIRED (CKA_VENDOR_DEFINED|0x320AUL) #define CKA_VENDOR_USER_TYPE (CKA_VENDOR_DEFINED|0x320BUL) #define CKA_VENDOR_AUTHENTICATION_FACTOR_TYPE (CKA_VENDOR_DEFINED|0x3300UL) #define CKA_VENDOR_FP_CONVOLUTIONS_COUNT (CKA_VENDOR_DEFINED|0x3301UL) #define CKA_VENDOR_FP_CONVOLUTIONS (CKA_VENDOR_ARRAY_ATTRIBUTE|0x3302UL) #define CKA_VENDOR_FINGERPRINT_CONVOLUTIONS_ID (CKA_VENDOR_DEFINED|0x3304UL) #define CKA_VENDOR_MAX_RETRY_COUNT (CKA_VENDOR_DEFINED|0x3305UL) #define CKA_VENDOR_RETRY_COUNT_LEFT (CKA_VENDOR_DEFINED|0x3306UL) #define CKA_VENDOR_BIO_DATA_ID (CKA_VENDOR_DEFINED|0x3307UL) /* Touch attributes */ #define CKA_VENDOR_TOUCH_MODE (CKA_VENDOR_DEFINED|0x3400UL) #define CKA_VENDOR_USER_PRESENT_TIME_LIMIT (CKA_VENDOR_DEFINED|0x3401UL) #define CKA_VENDOR_USER_ACTION_TIMEOUT (CKA_VENDOR_DEFINED|0x3402UL) /* CRISP attributes */ #define CKA_VENDOR_SECRET_KEY_ID (CKA_VENDOR_DEFINED|0x3104UL) #define CKA_VENDOR_CRISP_CIPHERSUITES (CKA_VENDOR_ARRAY_ATTRIBUTE|0x3011UL) #define CKA_VENDOR_PROTOCOL_TYPE (CKA_VENDOR_DEFINED|0x3500UL) #define CKA_VENDOR_CRISP_EXTERNAL_KEY_ID_FLAG (CKA_VENDOR_DEFINED|0x3501UL) #define CKA_VENDOR_CRISP_VERSION (CKA_VENDOR_DEFINED|0x3502UL) #define CKA_VENDOR_CRISP_KEY_ID (CKA_VENDOR_DEFINED|0x3503UL) #define CKA_VENDOR_CRISP_SOURCE_ID (CKA_VENDOR_DEFINED|0x3504UL) /* GOST DIVERSIFICATION TYPES */ #define CKD_KDF_4357 CKM_KDF_4357 #define CKD_KDF_GOSTR3411_2012_256 CKM_KDF_GOSTR3411_2012_256 /* Do not attach signed data to PKCS#7 signature */ #define PKCS7_DETACHED_SIGNATURE 0x01UL /* Use hardware hash in operation, can be passed only to PKCS#7 signature operation */ #define USE_HARDWARE_HASH 0x02UL /* CK_FUNCTION_LIST_EXTENDED is a structure holding a Cryptoki spec * version and pointers of appropriate types to all the Cryptoki extended functions */ typedef struct CK_FUNCTION_LIST_EXTENDED CK_FUNCTION_LIST_EXTENDED; typedef CK_FUNCTION_LIST_EXTENDED CK_PTR CK_FUNCTION_LIST_EXTENDED_PTR; typedef CK_FUNCTION_LIST_EXTENDED_PTR CK_PTR CK_FUNCTION_LIST_EXTENDED_PTR_PTR; /* Data structure use in C_EX_InitToken - extended function */ /* for all token reformat (C_InitToken will format only PKCS#11) */ typedef struct CK_RUTOKEN_INIT_PARAM { CK_ULONG ulSizeofThisStructure; /* [in] size of this structure. For example - st.ulSizeofThisStructure = sizeof(CK_RUTOKEN_INIT_PARAM) */ CK_ULONG UseRepairMode; /* [in] == 0: format procedure requires authentication as administrator != 0: format procedure executes without authentication as administrator */ CK_BYTE_PTR pNewAdminPin; /* [in] pointer to byte array with new administrator PIN */ CK_ULONG ulNewAdminPinLen; /* [in] length of new administrator PIN in bytes: minimum bMinAdminPinLength, maximum 32 */ CK_BYTE_PTR pNewUserPin; /* [in] pointer to byte array with new user PIN */ CK_ULONG ulNewUserPinLen; /* [in] length of new user PIN in bytes: minimum bMinUserPinLength, maximum 32 */ CK_FLAGS ChangeUserPINPolicy; /* [in] (flags) policy of change user PIN. see below for additional info about values possible values */ CK_ULONG ulMinAdminPinLen; /* [in] minimal size of administrator PIN in bytes: minimum 1, maximum 31 */ CK_ULONG ulMinUserPinLen; /* [in] minimal size of user PIN in bytes: minimum 1, maximum 31 */ CK_ULONG ulMaxAdminRetryCount; /* [in] minimum 3, maximum 10 */ CK_ULONG ulMaxUserRetryCount; /* [in] minimum 1, maximum 10 */ CK_BYTE_PTR pTokenLabel; /* [in] pointer to byte array with new token symbol name, if pTokenLabel == NULL - token symbol name will not set */ CK_ULONG ulLabelLen; /* [in] length of new token symbol name */ CK_ULONG ulSmMode; } CK_RUTOKEN_INIT_PARAM; typedef CK_RUTOKEN_INIT_PARAM CK_PTR CK_RUTOKEN_INIT_PARAM_PTR; /* C_EX_SlotManage mode */ #define MODE_RESTORE_FACTORY_DEFAULTS 0x06UL #define MODE_GET_PIN_SET_TO_BE_CHANGED 0x07UL /* Data structure to be used in C_EX_SlotManage - extended function with * MODE_RESTORE_FACTORY_DEFAULTS for token supporting trusted import */ typedef struct CK_VENDOR_RESTORE_FACTORY_DEFAULTS_PARAMS { CK_ULONG ulSizeofThisStructure; /* [in] init this field by size of this structure. For example - st.ulSizeofThisStructure = sizeof(CK_VENDOR_RESTORE_FACTORY_DEFAULTS_PARAMS) */ CK_BYTE_PTR pAdminPin; /* [in] pointer to byte array with current admin PIN */ CK_ULONG ulAdminPinLen; /* [in] length of current admin PIN */ CK_RUTOKEN_INIT_PARAM_PTR pInitParam; /* [in] pointer to structure with initialization params*/ CK_BYTE_PTR pNewEmitentKey; /* [in] pointer to byte array with new emitent key (32 bytes) */ CK_ULONG ulNewEmitentKeyLen; /* [in] length of new emitent key (32) */ CK_ULONG ulNewEmitentKeyRetryCount; /* [in] emitent key retry count */ CK_KEY_TYPE newEmitentKeyType; /* [in] emitent key algorithm type */ } CK_VENDOR_RESTORE_FACTORY_DEFAULTS_PARAMS; typedef CK_VENDOR_RESTORE_FACTORY_DEFAULTS_PARAMS CK_PTR CK_VENDOR_RESTORE_FACTORY_DEFAULTS_PARAMS_PTR; /* CK_TOKEN_INFO_EXTENDED provides extended information about a token */ typedef struct CK_TOKEN_INFO_EXTENDED { CK_ULONG ulSizeofThisStructure; /* init this field by size of this structure, [in] - size of input structure [out] - return size of filled structure */ CK_ULONG ulTokenType; /* DEPRECATED: type of token; HW feature with the type CKH_VENDOR_TOKEN_INFO should be used to get current connection interface see below for additional info about values possible values */ CK_ULONG ulProtocolNumber; /* exchange protocol number */ CK_ULONG ulMicrocodeNumber; /* microcode number */ CK_ULONG ulOrderNumber; /* order number */ CK_FLAGS flags; /* information flags see below for additional info about values possible values */ CK_ULONG ulMaxAdminPinLen; /* maximum administrator PIN length */ CK_ULONG ulMinAdminPinLen; /* minimum administrator PIN length */ CK_ULONG ulMaxUserPinLen; /* maximum user PIN length */ CK_ULONG ulMinUserPinLen; /* minimum user PIN length */ CK_ULONG ulMaxAdminRetryCount; /* max count of unsuccessful login attempts */ CK_ULONG ulAdminRetryCountLeft; /* count of unsuccessful attempts left (for administrator PIN), if field equal 0 - that means that PIN is blocked */ CK_ULONG ulMaxUserRetryCount; /* min counts of unsuccessful login attempts */ CK_ULONG ulUserRetryCountLeft; /* count of unsuccessful attempts left (for user PIN), if field equal 0 - that means that PIN is blocked */ CK_BYTE serialNumber[8]; /* token serial number in Big Endian format */ CK_ULONG ulTotalMemory; /* size of all memory in bytes */ CK_ULONG ulFreeMemory; /* size of free memory in bytes */ CK_BYTE ATR[64]; /* atr of the token */ CK_ULONG ulATRLen; /* size of atr */ CK_ULONG ulTokenClass; /* class of token see below for additional info about values possible values */ CK_ULONG ulBatteryVoltage; /* battery voltage in millivolts */ CK_ULONG ulBodyColor; /* body color of the token see below for additional info about values possible values */ CK_ULONG ulFirmwareChecksum; /* checksum of token firmware */ CK_ULONG ulBatteryPercentage; /* token current battery charge percentage */ CK_ULONG ulBatteryFlags; /* token battery flags */ } CK_TOKEN_INFO_EXTENDED; typedef CK_TOKEN_INFO_EXTENDED CK_PTR CK_TOKEN_INFO_EXTENDED_PTR; /* DEPRECATED: Token types (field "ulTokenType") */ #define TOKEN_TYPE_UNKNOWN 0xFFUL #define TOKEN_TYPE_RUTOKEN_ECP 0x01UL #define TOKEN_TYPE_RUTOKEN_LITE 0x02UL #define TOKEN_TYPE_RUTOKEN 0x03UL #define TOKEN_TYPE_RUTOKEN_ECPDUAL_USB 0x09UL #define TOKEN_TYPE_RUTOKEN_ECPDUAL_BT 0x69UL #define TOKEN_TYPE_RUTOKEN_ECPDUAL_UART 0xA9UL #define TOKEN_TYPE_RUTOKEN_ECP_SC TOKEN_TYPE_RUTOKEN_SC_JC #define TOKEN_TYPE_RUTOKEN_SCDUAL 0x49UL #define TOKEN_TYPE_RUTOKEN_SCDUAL_NFC 0xC9UL #define TOKEN_TYPE_RUTOKEN_LITE_SC_JC 0x42UL #define TOKEN_TYPE_RUTOKEN_MIKRON 0x05UL #define TOKEN_TYPE_RUTOKEN_MIKRON_SC 0x45UL #define TOKEN_TYPE_RUTOKEN_MIKRON_SCDUAL 0x4DUL #define TOKEN_TYPE_RUTOKEN_MIKRON_SCDUAL_NFC 0xCDUL #define TOKEN_TYPE_RUTOKEN_ECP_NFC 0xC1UL #define TOKEN_TYPE_RUTOKEN_SC_JC 0x41UL #define TOKEN_TYPE_RUTOKEN_PINPAD_FAMILY 0x04UL #define TOKEN_TYPE_RUTOKEN_WEB 0x23UL #define TOKEN_TYPE_RUTOKEN_ECP_SD 0x81UL #define TOKEN_TYPE_RUTOKEN_LITE_SD 0x82UL /* Token flags (field "flags" from CK_TOKEN_INFO_EXTENDED + * field "ChangeUserPINPolicy" from CK_RUTOKEN_INIT_PARAM) */ /* TOKEN_FLAGS_ADMIN_CHANGE_USER_PIN - if it is set, that * means that administrator (SO) can change user PIN */ #define TOKEN_FLAGS_ADMIN_CHANGE_USER_PIN 0x00000001UL /* TOKEN_FLAGS_USER_CHANGE_USER_PIN - if it is set, that * means that user can change user PIN */ #define TOKEN_FLAGS_USER_CHANGE_USER_PIN 0x00000002UL /* TOKEN_FLAGS_ADMIN_PIN_NOT_DEFAULT - if it is set, that * means that current administrator (SO) PIN is not default */ #define TOKEN_FLAGS_ADMIN_PIN_NOT_DEFAULT 0x00000004UL /* TOKEN_FLAGS_USER_PIN_NOT_DEFAULT - if it is set, that * means that current user PIN not default */ #define TOKEN_FLAGS_USER_PIN_NOT_DEFAULT 0x00000008UL /* TOKEN_FLAGS_SUPPORT_FKN - if it is set, that means that * token supports CryptoPro FKN */ #define TOKEN_FLAGS_SUPPORT_FKN 0x00000010UL #define TOKEN_FLAGS_SUPPORT_FKC TOKEN_FLAGS_SUPPORT_FKN /* TOKEN_FLAGS_SUPPORT_SM - if it is set, that means that * token supports communication using Secure Messaging. * This flag is DEPRECATED, use * TOKEN_FLAGS_SUPPORT_SECURE_MESSAGING instead. */ #define TOKEN_FLAGS_SUPPORT_SM 0x00000040UL /* TOKEN_FLAGS_HAS_FLASH_DRIVE - if it is set, that means * that token has Flash Drive */ #define TOKEN_FLAGS_HAS_FLASH_DRIVE 0x00000080UL /* TOKEN_FLAGS_CAN_CHANGE_SM_MODE - if it is set, that means * that token can be formatted to support SM. This flag * is DEPRECATED, use TOKEN_FLAGS_SUPPORT_SECURE_MESSAGING * instead. */ #define TOKEN_FLAGS_CAN_CHANGE_SM_MODE 0x00000100UL /* TOKEN_FLAGS_SUPPORT_SECURE_MESSAGING - if it is set, that * means that token supports Secure Messaging */ #define TOKEN_FLAGS_SUPPORT_SECURE_MESSAGING 0x00000100UL /* TOKEN_FLAGS_HAS_BUTTON - if it is set, that means * that token is Rutoken Touch */ #define TOKEN_FLAGS_HAS_BUTTON 0x00000200UL /* TOKEN_FLAGS_SUPPORT_JOURNAL - if it is set, that means * that token supports journal */ #define TOKEN_FLAGS_SUPPORT_JOURNAL 0x00000400UL /* TOKEN_FLAGS_USER_PIN_UTF8 - if it is set, that means * that user PIN in UTF-8 */ #define TOKEN_FLAGS_USER_PIN_UTF8 0x00000800UL /* TOKEN_FLAGS_ADMIN_PIN_UTF8 - if it is set, that means * that admin PIN in UTF-8 */ #define TOKEN_FLAGS_ADMIN_PIN_UTF8 0x00001000UL /* TOKEN_FLAGS_FW_CHECKSUM_UNAVAILIBLE - if it is set, that means Token does not support firmware * checksum request and 'ulFirmwareChecksum' can not be used */ #define TOKEN_FLAGS_FW_CHECKSUM_UNAVAILIBLE 0x40000000UL /* TOKEN_FLAGS_FW_CHECKSUM_INVALID - if it is set, that means that 'ulFirmwareChecksum' * field contains different from the reference (stored at Token) firmware checksum */ #define TOKEN_FLAGS_FW_CHECKSUM_INVALID 0x80000000UL /* Class of token */ #define TOKEN_CLASS_UNKNOWN 0xFFFFFFFFUL #define TOKEN_CLASS_S 0x00UL #define TOKEN_CLASS_ECP 0x01UL #define TOKEN_CLASS_LITE 0x02UL #define TOKEN_CLASS_ECP_BT TOKEN_CLASS_ECPDUAL /* DEPRECATED */ #define TOKEN_CLASS_WEB 0x03UL #define TOKEN_CLASS_PINPAD 0x04UL #define TOKEN_CLASS_ECPDUAL 0x09UL /* Body color of the token */ #define TOKEN_BODY_COLOR_UNKNOWN 0UL #define TOKEN_BODY_COLOR_WHITE 1UL #define TOKEN_BODY_COLOR_BLACK 2UL /* Extended error codes */ #define CKR_CORRUPTED_MAPFILE (CKR_VENDOR_DEFINED+1UL) #define CKR_WRONG_VERSION_FIELD (CKR_VENDOR_DEFINED+2UL) #define CKR_WRONG_PKCS1_ENCODING (CKR_VENDOR_DEFINED+3UL) #define CKR_RTPKCS11_DATA_CORRUPTED (CKR_VENDOR_DEFINED+4UL) #define CKR_RTPKCS11_RSF_DATA_CORRUPTED (CKR_VENDOR_DEFINED+5UL) #define CKR_SM_PASSWORD_INVALID (CKR_VENDOR_DEFINED+6UL) #define CKR_LICENSE_READ_ONLY (CKR_VENDOR_DEFINED+7UL) #define CKR_VENDOR_EMITENT_KEY_BLOCKED (CKR_VENDOR_DEFINED+8UL) #define CKR_CERT_CHAIN_NOT_VERIFIED (CKR_VENDOR_DEFINED+9UL) #define CKR_INAPPROPRIATE_PIN (CKR_VENDOR_DEFINED+10UL) #define CKR_PIN_IN_HISTORY (CKR_VENDOR_DEFINED+11UL) #define CKR_VENDOR_INTERFACE_NOT_INITIALIZED (CKR_VENDOR_DEFINED+12UL) /* Rutoken ECP Flash */ typedef CK_ULONG CK_VOLUME_ID_EXTENDED; typedef CK_ULONG CK_ACCESS_MODE_EXTENDED; typedef CK_ULONG CK_OWNER_EXTENDED; #define CKF_ENCRYPTION 0x01000000UL /* DEPRECATED */ #define ACCESS_MODE_HIDDEN 0x00UL #define ACCESS_MODE_RO 0x01UL #define ACCESS_MODE_RW 0x03UL #define ACCESS_MODE_CD 0x05UL /* Data structure to be used in C_EX_SlotManage - extended function with MODE_GET_IMIT argument for st23 2.0 only */ typedef struct CK_TOKEN_IMIT_DATA { CK_BYTE bMode; /* [in] 1 - mask, 2 - mask and patch */ CK_BYTE pbGostSymmetricKey[32]; /* [in] byte array with symmetric gost key */ CK_BYTE pbImit[8]; /* [out] byte array, will contain computed MAC*/ } CK_TOKEN_IMIT_DATA; typedef CK_TOKEN_IMIT_DATA CK_PTR CK_TOKEN_IMIT_DATA_PTR; /* C_EX_SlotManage mode */ #define MODE_GET_IMIT 0x04UL /* Modes of computing of MAC */ #define IMIT_MODE_MASK 0x01U #define IMIT_MODE_MASK_PATCH 0x02U /* Data structure to be used in C_EX_SlotManage - extended function with MODE_GET_LOCAL_PIN_INFO argument */ typedef struct CK_LOCAL_PIN_INFO { CK_ULONG ulPinID; /* [in] ID of local PIN */ CK_ULONG ulMinSize; /* [out] minimum PIN length */ CK_ULONG ulMaxSize; /* [out] maximum PIN length */ CK_ULONG ulMaxRetryCount; /* [out] max count of unsuccessful login attempts */ CK_ULONG ulCurrentRetryCount; /* [out] count of unsuccessful attempts left, if field equals 0 - that means that PIN is blocked */ CK_FLAGS flags; /* [out] information flags */ } CK_LOCAL_PIN_INFO; typedef CK_LOCAL_PIN_INFO CK_PTR CK_LOCAL_PIN_INFO_PTR; /* C_EX_SlotManage mode */ #define MODE_GET_LOCAL_PIN_INFO 0x05UL /* Local PIN flags (field "flags" from CK_LOCAL_PIN_INFO) LOCAL_PIN_FLAGS_NOT_DEFAULT - * if it is set, that means that local PIN is not default */ #define LOCAL_PIN_FLAGS_NOT_DEFAULT 0x00000001UL /* LOCAL_PIN_FLAGS_FROM_SCREEN - if it is set, that means that PIN can be entered only from screen */ #define LOCAL_PIN_FLAGS_FROM_SCREEN 0x00000002UL /* LOCAL_PIN_FLAGS_IS_UTF8 - if it is set, that means that PIN is in UTF-8 */ #define LOCAL_PIN_FLAGS_IS_UTF8 0x00000004UL typedef struct CK_VOLUME_INFO_EXTENDED { CK_VOLUME_ID_EXTENDED idVolume; /* volume identifier, from 1 up to 9 */ CK_ULONG ulVolumeSize; /* size of the volume (MB), not more than flash-storage capacity */ CK_ACCESS_MODE_EXTENDED accessMode; /* access flags */ CK_OWNER_EXTENDED volumeOwner; /* person, who can change access flags */ CK_FLAGS flags; /* other flags (encryption only, for now) */ } CK_VOLUME_INFO_EXTENDED; typedef struct CK_VOLUME_FORMAT_INFO_EXTENDED { CK_ULONG ulVolumeSize; CK_ACCESS_MODE_EXTENDED accessMode; CK_OWNER_EXTENDED volumeOwner; CK_FLAGS flags; } CK_VOLUME_FORMAT_INFO_EXTENDED; typedef CK_VOLUME_INFO_EXTENDED CK_PTR CK_VOLUME_INFO_EXTENDED_PTR; typedef CK_VOLUME_FORMAT_INFO_EXTENDED CK_PTR CK_VOLUME_FORMAT_INFO_EXTENDED_PTR; /* Rutoken ECP Bluetooth */ /* C_EX_TokenManage mode */ /* CK_VENDOR_PIN_PARAMS is a structure to be used in C_EX_TokenManage extended function to change default PIN */ typedef struct CK_VENDOR_PIN_PARAMS { CK_USER_TYPE userType; /* [in] user type */ CK_UTF8CHAR_PTR pPinValue; /* [in] new default PIN*/ CK_ULONG ulPinLength; /* [in] length of the new default PIN (in range from 6 to 32) */ } CK_VENDOR_PIN_PARAMS; typedef CK_VENDOR_PIN_PARAMS CK_PTR CK_VENDOR_PIN_PARAMS_PTR; #define MODE_SET_BLUETOOTH_POWEROFF_TIMEOUT 0x01UL #define MODE_SET_CHANNEL_TYPE 0x02UL #define MODE_RESET_CUSTOM_PIN_TO_STANDARD 0x03UL #define MODE_RESET_PIN_TO_DEFAULT 0x04UL #define MODE_CHANGE_DEFAULT_PIN 0x05UL #define MODE_FORCE_USER_TO_CHANGE_PIN 0x06UL #define BLUETOOTH_POWEROFF_TIMEOUT_DEFAULT 0x00 #define BLUETOOTH_POWEROFF_TIMEOUT_MAX 0x46 #define CHANNEL_TYPE_USB 0x00UL #define CHANNEL_TYPE_BLUETOOTH 0x01UL /* DEPRECATED function C_EX_GenerateActivationPassword */ #define GENERATE_NEXT_PASSWORD 0x00UL /* generate password with "next serial number" */ /* DEPRECATED function C_EX_GenerateActivationPassword character sets */ #define CAPS_AND_DIGITS 0x00UL /* capital letters of latin alphabet excluding O and digits excluding 0 */ #define CAPS_ONLY 0x01UL /* capital letters of latin alphabet */ /* Rutoken S vendor defined constants */ /* Key generation mechanism GOST */ #define CKM_GOST_KEY_GEN (CKM_VENDOR_DEFINED+1UL) /* DEPRECATED */ /* Encryption mechanism GOST */ #define CKM_GOST (CKM_VENDOR_DEFINED+2UL) /* DEPRECATED */ /* Trusted key material import mechanism */ #define CKM_VENDOR_SECURE_IMPORT (CKM_VENDOR_DEFINED+3UL) #define CKM_VENDOR_KDF_CRISP_CMAC (CKM_VENDOR_DEFINED+4UL) /* DEPRECATED */ #define CKM_VENDOR_CRISP_AEAD (CKM_VENDOR_DEFINED+5UL) /* DEPRECATED */ /* CRISP mechanizm */ #define CKM_VENDOR_CRISP_PROTOCOL (CKM_VENDOR_DEFINED + 10UL) /* GOST 28147 CBC mechsnism */ #define CKM_VENDOR_GOST28147_CBC_FSS (CKM_VENDOR_DEFINED + 11UL) /* CK_KEY_TYPE of CKO_SECRET_KEY object*/ #define CKK_GOST (CKK_VENDOR_DEFINED + 1UL) /* DEPRECATED */ /* Attributes of a GOST key */ #define CKA_GOST_KEY_OPTIONS (CKA_VENDOR_DEFINED+1UL) /* DEPRECATED */ #define CKA_GOST_KEY_FLAGS (CKA_VENDOR_DEFINED+2UL) /* DEPRECATED */ /* Possible options for a GOST key */ #define CKO_GOST_KEY_PZ 0x00UL /* simple replacement */ /* DEPRECATED */ #define CKO_GOST_KEY_GAMM 0x01UL /* gamming up (default) */ /* DEPRECATED */ #define CKO_GOST_KEY_GAMMOS 0x02UL /* gamming with reverse connection */ /* DEPRECATED */ /* Possible GOST key flags */ #define CKF_GOST_KEY_CLOSED 0x00UL /* private key (default) */ #define CKF_GOST_KEY_OPENLEN 0x02UL /* key with open length */ /* Data structures needed for CMS verification functions */ typedef struct CK_VENDOR_BUFFER { CK_BYTE_PTR pData; CK_ULONG ulSize; } CK_VENDOR_BUFFER; typedef CK_VENDOR_BUFFER CK_PTR CK_VENDOR_BUFFER_PTR; typedef CK_VENDOR_BUFFER_PTR CK_PTR CK_VENDOR_BUFFER_PTR_PTR; typedef CK_ULONG CK_VENDOR_CRL_MODE; typedef struct CK_VENDOR_X509_STORE { CK_VENDOR_BUFFER_PTR pTrustedCertificates; CK_ULONG ulTrustedCertificateCount; CK_VENDOR_BUFFER_PTR pCertificates; CK_ULONG ulCertificateCount; CK_VENDOR_BUFFER_PTR pCrls; CK_ULONG ulCrlCount; } CK_VENDOR_X509_STORE; typedef CK_VENDOR_X509_STORE CK_PTR CK_VENDOR_X509_STORE_PTR; typedef CK_BYTE_PTR CK_PTR CK_BYTE_PTR_PTR; #define CRISP_CS_1 1U #define CRISP_CS_2 2U #define CRISP_CS_3 3U #define CRISP_CS_4 4U // DEPRECATED typedef struct CK_VENDOR_KDF_CRISP_CMAC_PARAMS { CK_ULONG ulSeqNumLen; CK_BYTE_PTR pSeqNum; CK_ULONG ulSourceIdentifierLen; CK_BYTE_PTR pSourceIdentifier; CK_BYTE cs; } CK_VENDOR_KDF_CRISP_CMAC_PARAMS; typedef CK_VENDOR_KDF_CRISP_CMAC_PARAMS CK_PTR CK_VENDOR_KDF_CRISP_CMAC_PARAMS_PTR; // DEPRECATED typedef struct CK_VENDOR_CRISP_AEAD_PARAMS{ CK_MECHANISM_PTR pEncryptMechanism; CK_BYTE_PTR pAAD; CK_ULONG ulAADLen; CK_ULONG ulMACLen; } CK_VENDOR_CRISP_AEAD_PARAMS; typedef CK_VENDOR_CRISP_AEAD_PARAMS CK_PTR CK_VENDOR_CRISP_AEAD_PARAMS_PTR; /* Flags for customizing certificate verification process, should be passed * in flags argument to C_EX_PKCS7VerifyInit */ /* Do not search signer certificates in certificates attached to CMS */ #define CKF_VENDOR_DO_NOT_USE_INTERNAL_CMS_CERTS 0x01UL /* If this flag is set - chain verification will be successful * if at least one CA certificate from chain is in trusted certificates list */ #define CKF_VENDOR_ALLOW_PARTIAL_CHAINS 0x02UL /* If this flag is set - certificate verification is not made * this flag is not compatible with CKF_VENDOR_DO_NOT_USE_INTERNAL_CMS_CERTS, * CKF_VENDOR_ALLOW_PARTIAL_CHAINS and CKF_VENDOR_USE_TRUSTED_CERTS_FROM_TOKEN * ckMode should be set to OPTIONAL_CRL_CHECK */ #define CKF_VENDOR_CHECK_SIGNATURE_ONLY 0x04UL /* If this flag is set - trusted certificate store will be used to build a certificate chain. * ulTrustedCertificateCount in certificate store should be set to 0 */ #define CKF_VENDOR_USE_TRUSTED_CERTS_FROM_TOKEN 0x08UL /* CRL checking modes, should be passed in ckMode to C_EX_PKCS7VerifyInit */ /* If we have no suitable CRL - it won't be an error */ #define OPTIONAL_CRL_CHECK 0UL /* Signer's CA CRL should be passed */ #define LEAF_CRL_CHECK 1UL /* CRLs of all CA from the chain should be passed */ #define ALL_CRL_CHECK 2UL /* Biometry extension */ typedef CK_ULONG CK_VENDOR_AUTHENTICATION_FACTOR_TYPE; #define CKVAF_BIO_FP_CONVOLUTION 1UL #define CKO_VENDOR_AUTHENTICATION_FACTOR (CKO_VENDOR_DEFINED + 0x01UL) /* CRISP protocol context object */ #define CKO_VENDOR_PROTOCOL_CONTEXT (CKO_VENDOR_DEFINED + 0x02UL) /* Interfaces */ #define INTERFACE_TYPE_USB 0x00000001UL #define INTERFACE_TYPE_BT 0x00000002UL #define INTERFACE_TYPE_UART 0x00000004UL #define INTERFACE_TYPE_ISO 0x00000008UL #define INTERFACE_TYPE_NFC_TYPE_B 0x00000020UL #define INTERFACE_TYPE_SPI 0x00000040UL #define INTERFACE_TYPE_NFC_TYPE_A 0x00000080UL #define INTERFACE_TYPE_UNKNOWN CK_UNAVAILABLE_INFORMATION /* DEPRECATED */ #define INTERFACE_TYPE_SD 0x00000010UL #define INTERFACE_TYPE_NFC INTERFACE_TYPE_NFC_TYPE_B /* Secure messaging types */ #define SECURE_MESSAGING_DEFAULT 0x00UL #define SECURE_MESSAGING_BUILT_IN 0x01UL #define SECURE_MESSAGING_GOST 0x02UL #define SECURE_MESSAGING_ENHANCED_GOST 0x03UL #define SECURE_MESSAGING_UNSUPPORTED 0xffUL /* Values for CKA_VENDOR_PIN_POLICY_STATE */ #define PIN_POLICY_STATE_WELL_DEFINED 0x00UL #define PIN_POLICY_STATE_HAS_UNKNOWN_ATTRIBUTES 0x01UL #define PIN_POLICY_STATE_HAS_UNKNOWN_NONDEFAULT_ATTRIBUTES 0x02UL /* Values for CKA_VENDOR_TOUCH_MODE */ #define TOUCH_MODE_DISCRETE 0UL #define TOUCH_MODE_CONTINUOUS 1UL /* Biometric types */ /* Values for CKA_VENDOR_BIOMETRIC_AUTHENTICATION attribute, must be a bit mask */ #define BIOMETRIC_AUTHENTICATION_NOT_SUPPORTED 0x00000000UL #define BIOMETRIC_AUTHENTICATION_FINGERPRINT_CONVOLUTION 0x00000001UL /* Protection types for CKA_VENDOR_PROTECTION_FEATURES */ #define VENDOR_PROTECTION_STANDARD 0x00UL /* standard protection mechanisms for Rutoken series */ #define VENDOR_PROTECTION_IMPROVED_3127 0x01UL /* additional protection mechanisms introduced in Rutoken ECP 3.0 3127 */ /* Hardware feature types */ #define CKH_VENDOR_TOKEN_INFO (CKH_VENDOR_DEFINED + 0x01UL) #define CKH_VENDOR_EMITENT_KEY (CKH_VENDOR_DEFINED + 0x02UL) #define CKH_VENDOR_SECURE_COUNTER (CKH_VENDOR_DEFINED + 0x03UL) #define CKH_VENDOR_NDEF_TAG (CKH_VENDOR_DEFINED + 0x04UL) #define CKH_VENDOR_RNG (CKH_VENDOR_DEFINED + 0x05UL) #define CKH_VENDOR_PIN_POLICY (CKH_VENDOR_DEFINED + 0x06UL) #define CKH_VENDOR_TOUCH_INTERFACE (CKH_VENDOR_DEFINED + 0x07UL) /* backported defines from pkcs3.0 header required for eddsa support */ #define CKM_EC_EDWARDS_KEY_PAIR_GEN 0x00001055UL #define CKF_EC_OID 0x00800000UL #define CKK_EC_EDWARDS 0x00000040UL #define CKM_EDDSA 0x00001057UL /* Data structures required for CRISP */ typedef CK_ULONG CKV_PROTOCOL_TYPE; #define CKVP_CRISP_SENDER 1UL #define CKVP_CRISP_RECEIVER 2UL typedef struct CK_VENDOR_CRISP_PROTOCOL_PARAMS { CK_OBJECT_HANDLE hProtocolContext; CK_BYTE ciphersuite; } CK_VENDOR_CRISP_PROTOCOL_PARAMS; typedef CK_VENDOR_CRISP_PROTOCOL_PARAMS CK_PTR CK_VENDOR_CRISP_PROTOCOL_PARAMS_PTR; #define CKM_SP800_108_COUNTER_KDF 0x000003acUL /* Typedefs for Flexible KDF */ typedef CK_ULONG CK_PRF_DATA_TYPE; typedef CK_MECHANISM_TYPE CK_SP800_108_PRF_TYPE; #define CK_SP800_108_ITERATION_VARIABLE 0x00000001UL #define CK_SP800_108_OPTIONAL_COUNTER 0x00000002UL #define CK_SP800_108_DKM_LENGTH 0x00000003UL #define CK_SP800_108_BYTE_ARRAY 0x00000004UL typedef struct CK_PRF_DATA_PARAM { CK_PRF_DATA_TYPE type; CK_VOID_PTR pValue; CK_ULONG ulValueLen; } CK_PRF_DATA_PARAM; typedef CK_PRF_DATA_PARAM CK_PTR CK_PRF_DATA_PARAM_PTR; typedef struct CK_SP800_108_COUNTER_FORMAT { CK_BBOOL bLittleEndian; CK_ULONG ulWidthInBits; } CK_SP800_108_COUNTER_FORMAT; typedef CK_SP800_108_COUNTER_FORMAT CK_PTR CK_SP800_108_COUNTER_FORMAT_PTR; typedef CK_ULONG CK_SP800_108_DKM_LENGTH_METHOD; #define CK_SP800_108_DKM_LENGTH_SUM_OF_KEYS 0x00000001UL #define CK_SP800_108_DKM_LENGTH_SUM_OF_SEGMENTS 0x00000002UL typedef struct CK_SP800_108_DKM_LENGTH_FORMAT { CK_SP800_108_DKM_LENGTH_METHOD dkmLengthMethod; CK_BBOOL bLittleEndian; CK_ULONG ulWidthInBits; } CK_SP800_108_DKM_LENGTH_FORMAT; typedef CK_SP800_108_DKM_LENGTH_FORMAT \ CK_PTR CK_SP800_108_DKM_LENGTH_FORMAT_PTR; typedef struct CK_DERIVED_KEY { CK_ATTRIBUTE_PTR pTemplate; CK_ULONG ulAttributeCount; CK_OBJECT_HANDLE_PTR phKey; } CK_DERIVED_KEY; typedef CK_DERIVED_KEY CK_PTR CK_DERIVED_KEY_PTR; typedef struct CK_SP800_108_KDF_PARAMS { CK_SP800_108_PRF_TYPE prfType; CK_ULONG ulNumberOfDataParams; CK_PRF_DATA_PARAM_PTR pDataParams; CK_ULONG ulAdditionalDerivedKeys; CK_DERIVED_KEY_PTR pAdditionalDerivedKeys; } CK_SP800_108_KDF_PARAMS; typedef CK_SP800_108_KDF_PARAMS CK_PTR CK_SP800_108_KDF_PARAMS_PTR; typedef struct CK_SP800_108_FEEDBACK_KDF_PARAMS { CK_SP800_108_PRF_TYPE prfType; CK_ULONG ulNumberOfDataParams; CK_PRF_DATA_PARAM_PTR pDataParams; CK_ULONG ulIVLen; CK_BYTE_PTR pIV; CK_ULONG ulAdditionalDerivedKeys; CK_DERIVED_KEY_PTR pAdditionalDerivedKeys; } CK_SP800_108_FEEDBACK_KDF_PARAMS; typedef CK_SP800_108_FEEDBACK_KDF_PARAMS \ CK_PTR CK_SP800_108_FEEDBACK_KDF_PARAMS_PTR; #endif /* __RTPKCS11T_H__ */