Represents a PKCS#11 library.

Load PKCS#11 dynamically linked library from given path

lib <- loadLibrary "/path/to/dll.so"

Releases resources used by loaded library

Get general information about Cryptoki library

Represents general library information. Returned by getInfo function.

Cryptoki interface version number, for compatibility with future revisions of this interface

ID of the Cryptoki library manufacturer

bit flags reserved for future versions. Must be zero for this version

Cryptoki library version number

Return number of slots in the system.

Get a list of slot IDs in the system. Can filter for slots with attached tokens.

slotsIds <- getSlotList lib True 10

In this example retrieves list of, at most 10 (third parameter) slot identifiers with tokens present (second parameter is set to True)

Obtains information about a particular slot in the system

slotInfo <- getSlotInfo lib slotId

bit flags indicating capabilities and status of the slot as defined in https://www.cryptsoft.com/pkcs11doc/v220/pkcs11__all_8h.html#aCK_SLOT_INFO

Obtains information about a particular token in the system

tokenInfo <- getTokenInfo lib slotId

bit flags indicating capabilities and status of the device as defined in https://www.cryptsoft.com/pkcs11doc/v220/pkcs11__all_8h.html#aCK_TOKEN_INFO

Initialize a token in a given slot. All objects created by user on the token are destroyed.

Initializes normal user's PIN. Session should be logged in by SO user in other words it should be in RWSOFunctions state.

Changes PIN of a currently logged in user.

Obtains a list of mechanism types supported by a token

Obtains information about a particular mechanism possibly supported by a token

Represent information about a mechanism. Returned by getMechanismInfo function.

Minimum size of a key in bits or bytes depending on the mechanism.

Maximum size of a key in bits or bytes depending on the mechanism.

Mechanism's flags as described in https://www.cryptsoft.com/pkcs11doc/v220/pkcs11__all_8h.html#aCK_MECHANISM_INFO

Represents mechanism with parameters to be used in cryptographic operation. Parameterless mechanism can be created with simpleMech function. Few example operations using this data structure are encrypt, generateKey.

Return parameterless mechanism which can be used in cryptographic operation.

Represent session. Created by withSession function.

Opens a read-only or read-write session with a token in a given slot and then closes it after callback function is finished.

Logs a user into a token.

Logs a user out from a token.

Represent session information. Returned by getSessionInfo function.

Slot for which session is open

State of the session, e.g. ROPublicSession, RWUserFunctions.

Session flags as described in https://www.cryptsoft.com/pkcs11doc/v220/pkcs11__all_8h.html#aCK_SESSION_INFO.

Device specific error code.

Represents an attribute of an object

Deletes an object from token or session.

Creates an object from given list of attributes and returns a reference to created object.

Makes a copy of an object and changes attributes of copied object, returns a reference to new object.

Returns an approximate amount of space occupied by an object in bytes.

Searches current session for objects matching provided attributes list, returns a list of matching object handles

Modifies attributes of an object.

Generates a symmetric key using provided mechanism and applies provided attributes to resulting key object.

Examples:

Generate 128-bit AES key:

keyHandle <- generateKey sess (simpleMech AesKeyGen) [ValueLen 16]

Generate 1024-bit Diffie-Hellman domain parameters using PKCS#3 mechanism:

dhParamsHandle <- generateKey sess (simpleMech DhPkcsParameterGen) [PrimeBits 1028]

Generates an asymmetric key pair using provided mechanism.

Examples:

Generate an 2048-bit RSA key:

(pubKey, privKey) <- generateKeyPair sess (simpleMech RsaPkcsKeyPairGen) [ModulusBits 2048] []

Derives a key from a base key using provided mechanism and applies provided attributes to a resulting key. Can be used to derive symmetric key using Diffie-Hellman key exchange.

Wrap a key using provided wrapping key and return opaque byte array representing wrapped key. This byte array can be stored in user application and can be used later to recreate wrapped key using unwrapKey function.

Example wrapping AES key using RSA public key:

wrappedAesKey <- wrapKey (simpleMech RsaPkcs) sess pubRsaKeyHandle aesKeyHandle Nothing

Unwrap a key from opaque byte string and apply attributes to a resulting key object.

Example unwrapping AES key using RSA private key:

unwrappedAesKey <- unwrapKey (simpleMech RsaPkcs) sess privRsaKeyHandle wrappedAesKey [Class SecretKey, KeyType AES]

Decrypt data using provided mechanism and key handle.

Example AES ECB decryption.

decData <- decrypt (simpleMech AesEcb) sess aesKeyHandle encData Nothing

Encrypt data using provided mechanism and key handle.

Initialize a multi-part decryption operation using provided mechanism and key.

Initialize multi-part encryption operation.

Calculates digest aka hash of a data using provided mechanism.

Example calculating SHA256 hash:

>>> digest (simpleMech Sha256) sess (replicate 16 0) Nothing
"7G\b\255\247q\157\213\151\158\200u\213l\210(om<\247\236\&1z;%c*\171(\236\&7\187"

Signs data using provided mechanism and key.

Example signing with RSA PKCS#1

signature <- sign (simpleMech RsaPkcs) sess privKeyHandle signedData Nothing

Verifies signature using provided mechanism and key.

Example signature verification using RSA public key:

>>> verify (simpleMech RsaPkcs) sess pubKeyHandle signedData signature
True

Mixes provided seed data with token's seed

Generates random data using token's RNG.