corePKCS11 对象演示

/* The PKCS11_CertificateTemplate_t is a custom struct defined in "iot_pkcs11.h"


 * in order to make it easier to import a certificate. This struct will be


 * populated with the parameters necessary to import the certificate into the


 * Cryptoki library.


 */

PKCS11_CertificateTemplate_t xCertificateTemplate;



/* The object class is specified as a certificate to help the Cryptoki library


 * parse the arguments.


 */

CK_OBJECT_CLASS xCertificateClass = CKO_CERTIFICATE;



/* The certificate type is x509, which is the only type


 * supported by this stack. To read more about x509 certificates, use


 * the following links:


 *


 * https://en.wikipedia.org/wiki/X.509


 * https://www.ssl.com/faqs/what-is-an-x-509-certificate/


 *


 */

CK_CERTIFICATE_TYPE xCertificateType = CKC_X_509;



/* The label will help the application identify which object it wants


 * to access.


 */

CK_BYTE pucLabel[] = pkcs11configLABEL_DEVICE_CERTIFICATE_FOR_TLS;



/* Specify certificate class. */

xCertificateTemplate.xObjectClass.type = CKA_CLASS;

xCertificateTemplate.xObjectClass.pValue = &xCertificateClass;

xCertificateTemplate.xObjectClass.ulValueLen = sizeof( xCertificateClass );



/* Specify certificate subject. */

xCertificateTemplate.xSubject.type = CKA_SUBJECT;

xCertificateTemplate.xSubject.pValue = xSubject;

xCertificateTemplate.xSubject.ulValueLen = strlen( ( const char * ) xSubject );



/* Point to contents of certificate. */

xCertificateTemplate.xValue.type = CKA_VALUE;

xCertificateTemplate.xValue.pValue = ( CK_VOID_PTR ) pkcs11demo_RSA_CERTIFICATE;

xCertificateTemplate.xValue.ulValueLen = ( CK_ULONG ) sizeof( pkcs11demo_RSA_CERTIFICATE );



/* Specify certificate label. */

xCertificateTemplate.xLabel.type = CKA_LABEL;

xCertificateTemplate.xLabel.pValue = ( CK_VOID_PTR ) pucLabel;

xCertificateTemplate.xLabel.ulValueLen = strlen( ( const char * ) pucLabel );



/* Specify certificate type as x509. */

xCertificateTemplate.xCertificateType.type = CKA_CERTIFICATE_TYPE;

xCertificateTemplate.xCertificateType.pValue = &xCertificateType;

xCertificateTemplate.xCertificateType.ulValueLen = sizeof( CK_CERTIFICATE_TYPE );



/* Specify that the certificate should be on a token. */

xCertificateTemplate.xTokenObject.type = CKA_TOKEN;

xCertificateTemplate.xTokenObject.pValue = &xTokenStorage;

xCertificateTemplate.xTokenObject.ulValueLen = sizeof( xTokenStorage );

/* Once the Cryptoki library has finished importing the new certificate


 * a CK_OBJECT_HANDLE is associated with it. The application can now use this


 * to refer to the object in following operations.


 *


 * xCertHandle in the below example will have it's value modified to


 * be the CK_OBJECT_HANDLE.


 *


 * To compare the hard coded x509, in PEM format, with the DER formatted


 * x509 certificate that is created by the Cryptoki library, use the following


 * OpenSSL command:


 * "$ openssl x509 -in FreeRTOS_P11_Certificate.dat -inform der -text"


 *


 * See this explanation for the difference between the PEM format and the


 * DER format:


 * https://stackoverflow.com/questions/22743415/what-are-the-differences-between-pem-cer-and-der/22743616


 *


 */

xResult = pxFunctionList->C_CreateObject( hSession,

                                          ( CK_ATTRIBUTE_PTR ) &xCertificateTemplate,

                                          sizeof( xCertificateTemplate ) / sizeof( CK_ATTRIBUTE ),

                                          &xCertHandle );



configASSERT( xResult == CKR_OK );

configASSERT( xCertHandle != CK_INVALID_HANDLE );

/* CK_ATTTRIBUTE's contain an attribute type, a value, and the length of


 * the value. An array of CK_ATTRIBUTEs is called a template. They are used


 * to create, search for, and manipulate objects. The order of the


 * template does not matter.


 *


 * In the below template we create a public key:


 * Specify the key type as EC.


 * The key will be able to verify a message.


 * Specify the EC Curve.


 * Assign a label to the object that will be created.


 */

CK_ATTRIBUTE xPublicKeyTemplate[] =

{

    { CKA_KEY_TYPE, &xKeyType, sizeof( xKeyType ) },

    { CKA_VERIFY, &xTrue, sizeof( xTrue ) },

    { CKA_EC_PARAMS, xEcParams, sizeof( xEcParams ) },

    { CKA_LABEL, pucPublicKeyLabel, sizeof( pucPublicKeyLabel ) - 1 }

};



/* In the below template we create a private key:


 * The key type is EC.


 * The key is a token object.


 * The key will be a private key.


 * The key will be able to sign messages.


 * Assign a label to the object that will be created.


 */

CK_ATTRIBUTE xPrivateKeyTemplate[] =

{

    { CKA_KEY_TYPE, &xKeyType, sizeof( xKeyType ) },

    { CKA_TOKEN, &xTrue, sizeof( xTrue ) },

    { CKA_PRIVATE, &xTrue, sizeof( xTrue ) },

    { CKA_SIGN, &xTrue, sizeof( xTrue ) },

    { CKA_LABEL, pucPrivateKeyLabel, sizeof( pucPrivateKeyLabel ) - 1 }

};

/* This function will generate a new EC private and public key pair. You can


 * use " $openssl ec -inform der -in FreeRTOS_P11_Key.dat -text " to see


 * the structure of the keys that were generated.


 */

xResult = pxFunctionList->C_GenerateKeyPair( hSession,

                                             &xMechanism,

                                             xPublicKeyTemplate,

                                             sizeof( xPublicKeyTemplate ) / sizeof( CK_ATTRIBUTE ),

                                             xPrivateKeyTemplate,

                                             sizeof( xPrivateKeyTemplate ) / sizeof( CK_ATTRIBUTE ),

                                             &xPublicKeyHandle,

                                             &xPrivateKeyHandle );

configASSERT( xResult == CKR_OK );