Cryptosense Compliance Tester

1
Failed
HIGH RISK
criteria
0
Failed
MEDIUM RISK
criteria
0
Failed
LOW RISK
criteria
85
PASSED
criteria

Testing: SoftHSM - Implementation of PKCS11 (V2.0), cryptoki (V2.30), slot index: 0
Expand all
Collapse all
Number Criterion Risk level Failed tests Total tests
38 CKA_NEVER_EXTRACTABLE must be set to CK_FALSE on object created with C_CreateObject. High 56967 82479

Reference: v2.20 s11.7 p128

If the key material has come from outside the device, it cannot possibly be considered CKA_NEVER_EXTRACTABLE. A non-compliant implementation would give a false measure of security.

C_CreateObject: (82479 tests, 56967 failed)

  • 30%: CKA_NEVER_EXTRACTABLE must be set to CK_FALSE in created object when creating secret or private key. (82479 tests, 56967 failed)

1 CKA_CLASS must be specified when object is created with C_CreateObject. Pass 0 154

Reference: v2.20 s10.2 p66

A non-compliant implementation may misinterpret given key material.

C_CreateObject: (154 tests, 0 failed)

  • 100%: Call must fail if CKA_CLASS is not specified in input template. (154 tests, 0 failed)

2 CKA_CLASS cannot be changed. Pass 0 13656

Reference: v2.20 s10.2 p66

A non-compliant implementation may misinterpret given key material.

C_CopyObject: (7324 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_CLASS is specified in input template. (7324 tests, 0 failed)

C_SetAttributeValue: (6332 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_CLASS is specified in input template. (6332 tests, 0 failed)

3 CKA_TOKEN default value is CK_FALSE. Pass 0 399606

Reference: v2.20 s10.4 p71

If default is CK_TRUE an application may inadvertently create persistant keys that could be exposed in a future session.

C_GenerateKey: (268252 tests, 0 failed)

  • 100%: CKA_TOKEN must be set to CK_FALSE in generated object when not specified in input template. (268252 tests, 0 failed)

C_GenerateKeyPair: (81043 tests, 0 failed)

  • 100%: CKA_TOKEN must be set to CK_FALSE in generated public object when not specified in public template. (41004 tests, 0 failed)
  • 100%: CKA_TOKEN must be set to CK_FALSE in generated private object when not specified in private template. (40039 tests, 0 failed)

C_CreateObject: (50311 tests, 0 failed)

  • 100%: CKA_TOKEN must be set to CK_FALSE in created object when not specified in input template. (50311 tests, 0 failed)

C_CopyObject: (untested after 194855 tests)

  • -- : CKA_TOKEN must be set to CK_FALSE in result object when not specified in input template. (untested after 194855 tests)

C_DeriveKey: (untested after 32518 tests)

  • -- : CKA_TOKEN must be set to CK_FALSE in derived key when not specified in input template. (untested after 32518 tests)

C_UnwrapKey: (untested after 2582 tests)

  • -- : CKA_TOKEN must be set to CK_FALSE in unwrapped object when not specified in input template. (untested after 2582 tests)

4 CKA_TOKEN cannot be changed with C_SetAttributeValue. Pass 0 3166

Reference: v2.20 s10.4 p71

If non-compliant, the device may allow a session key to be preserved and exposed in a future session, or a token key to be inadvertently removed.

C_SetAttributeValue: (3166 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_TOKEN is specified in input template. (3166 tests, 0 failed)

5 CKA_PRIVATE cannot be changed with C_SetAttributeValue. Pass 0 3166

Reference: v2.20 s10.4 p71

If non-compliant, the device may allow a key which has been marked as CKA_PRIVATE in one session to be compromised in a future session.

C_SetAttributeValue: (3166 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_PRIVATE is specified in input template. (3166 tests, 0 failed)

6 CKA_MODIFIABLE default value is CK_TRUE. Pass 0 504203

Reference: v2.20 s10.4 p71

If not compliant, the application could generate a key that it cannot later protect (e.g. by marking as unextractable).

C_GenerateKey: (339968 tests, 0 failed)

  • 100%: CKA_MODIFIABLE must be set to CK_TRUE in generated object when not specified in input template. (339968 tests, 0 failed)

C_GenerateKeyPair: (82391 tests, 0 failed)

  • 100%: CKA_MODIFIABLE must be set to CK_TRUE in generated public object when not specified in public template. (41004 tests, 0 failed)
  • 100%: CKA_MODIFIABLE must be set to CK_TRUE in generated private object when not specified in private template. (41387 tests, 0 failed)

C_CreateObject: (81844 tests, 0 failed)

  • 100%: CKA_MODIFIABLE must be set to CK_TRUE in created object when not specified in input template. (81844 tests, 0 failed)

C_CopyObject: (untested after 194855 tests)

  • -- : CKA_MODIFIABLE must be set to CK_TRUE in result object when not specified in input template. (untested after 194855 tests)

C_DeriveKey: (untested after 32518 tests)

  • -- : CKA_MODIFIABLE must be set to CK_TRUE in derived key when not specified in input template. (untested after 32518 tests)

C_UnwrapKey: (untested after 2582 tests)

  • -- : CKA_MODIFIABLE must be set to CK_TRUE in unwrapped object when not specified in input template. (untested after 2582 tests)

7 CKA_MODIFIABLE cannot be changed with C_SetAttributeValue. Pass 0 3166

Reference: v2.20 s10.4 p71

If non-compliant, the device may allow a key whose attributes have been set and protected in one session to be compromised in a future session.

C_SetAttributeValue: (3166 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_MODIFIABLE is specified in input template. (3166 tests, 0 failed)

8 CKA_KEY_TYPE must be specified when object is created with C_CreateObject. Pass 0 154

Reference: v2.20 s10.7 p79

A non-compliant implementation may misinterpret given key material.

C_CreateObject: (154 tests, 0 failed)

  • 100%: Call must fail if CKA_KEY_TYPE is not specified in input template. (154 tests, 0 failed)

9 CKA_KEY_TYPE must be specified when object is unwrapped with C_UnwrapKey. Pass 0 50

Reference: v2.20 s10.7 p79

A non-compliant implementation may misinterpret given key material.

C_UnwrapKey: (50 tests, 0 failed)

  • 100%: Call must fail if CKA_KEY_TYPE is not specified in input template. (50 tests, 0 failed)

10 CKA_KEY_TYPE cannot be changed. Pass 0 27312

Reference: v2.20 s10.7.2 p79

Changing key type could lead to an insecure use of key material.

C_CopyObject: (14648 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_KEY_TYPE is specified in input template. (14648 tests, 0 failed)

C_SetAttributeValue: (12664 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_KEY_TYPE is specified in input template. (12664 tests, 0 failed)

11 CKA_DERIVE default value is CK_FALSE. Pass 0 489087

Reference: v2.20 s10.7.2 p79

Inadvertently adding derive permission to an object can lead to deriviation of insecure keys.

C_GenerateKey: (331426 tests, 0 failed)

  • 100%: CKA_DERIVE must be set to CK_FALSE in generated object when not specified in input template. (331426 tests, 0 failed)

C_GenerateKeyPair: (81901 tests, 0 failed)

  • 100%: CKA_DERIVE must be set to CK_FALSE in generated public object when not specified in public template. (41004 tests, 0 failed)
  • 100%: CKA_DERIVE must be set to CK_FALSE in generated private object when not specified in private template. (40897 tests, 0 failed)

C_CreateObject: (75760 tests, 0 failed)

  • 100%: CKA_DERIVE must be set to CK_FALSE in created object when not specified in input template. (75760 tests, 0 failed)

C_CopyObject: (untested after 194855 tests)

  • -- : CKA_DERIVE must be set to CK_FALSE in result object when not specified in input template. (untested after 194855 tests)

C_DeriveKey: (untested after 32518 tests)

  • -- : CKA_DERIVE must be set to CK_FALSE in derived key when not specified in input template. (untested after 32518 tests)

C_UnwrapKey: (untested after 2582 tests)

  • -- : CKA_DERIVE must be set to CK_FALSE in unwrapped object when not specified in input template. (untested after 2582 tests)

12 CKA_LOCAL must not be specified when object is created with C_CreateObject. Pass 0 308

Reference: v2.20 s10.7 p79

If not compliant, device may create keys marked as CKA_LOCAL using key material generated outside the device.

C_CreateObject: (308 tests, 0 failed)

  • 100%: Call must fail if CKA_LOCAL is specified in input template. (308 tests, 0 failed)

13 CKA_LOCAL must not be specified when object is generated with C_GenerateKey or C_GenerateKeyPair. Pass 0 1318

Reference: v2.20 s10.7 p79

If not compliant, device may create keys marked as CKA_LOCAL using key material generated outside the device.

C_GenerateKeyPair: (1018 tests, 0 failed)

  • 100%: Call must fail if CKA_LOCAL is specified in public template. (74 tests, 0 failed)
  • 100%: Call must fail if CKA_LOCAL is specified in private template. (944 tests, 0 failed)

C_GenerateKey: (300 tests, 0 failed)

  • 100%: Call must fail if CKA_LOCAL is specified in input template. (300 tests, 0 failed)

14 CKA_LOCAL must not be specified when object is unwrapped with C_UnwrapKey. Pass 0 100

Reference: v2.20 s10.7 p79

If not compliant, device may create keys marked as CKA_LOCAL using key material generated outside the device.

C_UnwrapKey: (100 tests, 0 failed)

  • 100%: Call must fail if CKA_LOCAL is specified in input template. (100 tests, 0 failed)

15 CKA_LOCAL is CK_TRUE only if key was generated locally or is a copy of a key which had its CKA_LOCAL attribute set to CK_TRUE. Pass 0 575112

Reference: v2.20 s10.7 p79, s11.14 p174

If not compliant, device may contain keys marked as CKA_LOCAL using key material generated outside the device.

C_GenerateKey: (349358 tests, 0 failed)

  • 100%: CKA_LOCAL must be set to CK_TRUE in generated object. (349358 tests, 0 failed)

C_GenerateKeyPair: (87254 tests, 0 failed)

  • 100%: CKA_LOCAL must be set to CK_TRUE in generated public object. (43627 tests, 0 failed)
  • 100%: CKA_LOCAL must be set to CK_TRUE in generated private object. (43627 tests, 0 failed)

C_CreateObject: (84153 tests, 0 failed)

  • 100%: CKA_LOCAL must be set to CK_FALSE in created object. (84153 tests, 0 failed)

C_CopyObject: (52219 tests, 0 failed)

  • 100%: CKA_LOCAL must have the same value in copied object and result object. (52219 tests, 0 failed)

C_DeriveKey: (2128 tests, 0 failed)

  • 100%: CKA_LOCAL must be set to CK_FALSE in derived key. (2128 tests, 0 failed)

C_UnwrapKey: (untested after 2582 tests)

  • -- : CKA_LOCAL must be set to CK_FALSE in unwrapped object. (untested after 2582 tests)

16 CKA_LOCAL cannot be modified. Pass 0 6828

Reference: v2.20 s10.7 p79, s11.7 p128

If not compliant, device may contain keys marked as CKA_LOCAL using key material generated outside the device.

C_CopyObject: (3662 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_LOCAL is specified in input template. (3662 tests, 0 failed)

C_SetAttributeValue: (3166 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_LOCAL is specified in input template. (3166 tests, 0 failed)

17 CKA_KEY_GEN_MECHANISM must not be specified when object is created with C_CreateObject. Pass 0 924

Reference: v2.20 s10.7 p79

The mechanism cannot be known for externally generated key material.

C_CreateObject: (924 tests, 0 failed)

  • 100%: Call must fail if CKA_KEY_GEN_MECHANISM is specified in input template. (924 tests, 0 failed)

18 CKA_KEY_GEN_MECHANISM must not be specified when object is generated with C_GenerateKey or C_GenerateKeyPair. Pass 0 3954

Reference: v2.20 s10.7 p79

The mechanism cannot be known for externally generated key material.

C_GenerateKeyPair: (3054 tests, 0 failed)

  • 100%: Call must fail if CKA_KEY_GEN_MECHANISM is specified in public template. (222 tests, 0 failed)
  • 100%: Call must fail if CKA_KEY_GEN_MECHANISM is specified in private template. (2832 tests, 0 failed)

C_GenerateKey: (900 tests, 0 failed)

  • 100%: Call must fail if CKA_KEY_GEN_MECHANISM is specified in input template. (900 tests, 0 failed)

19 CKA_KEY_GEN_MECHANISM must not be specified when object is unwrapped with C_UnwrapKey. Pass 0 300

Reference: v2.20 s10.7 p79

The mechanism cannot be known for externally generated key material.

C_UnwrapKey: (300 tests, 0 failed)

  • 100%: Call must fail if CKA_KEY_GEN_MECHANISM is specified in input template. (300 tests, 0 failed)

20 CKA_KEY_GEN_MECHANISM has a value only if CKA_LOCAL is CK_TRUE. Pass 0 470955

Reference: v2.20 s10.7 p79

The mechanism cannot be known for externally generated key material.

C_GenerateKey: (349358 tests, 0 failed)

  • 100%: CKA_KEY_GEN_MECHANISM have a value in generated object and CKA_KEY_GEN_MECHANISM isn't CK_UNAVAILABLE_INFORMATION in generated object implies CKA_LOCAL is CK_TRUE in generated object. (349358 tests, 0 failed)

C_GenerateKeyPair: (87254 tests, 0 failed)

  • 100%: CKA_KEY_GEN_MECHANISM have a value in generated public object and CKA_KEY_GEN_MECHANISM isn't CK_UNAVAILABLE_INFORMATION in generated public object implies CKA_LOCAL is CK_TRUE in generated public object. (43627 tests, 0 failed)
  • 100%: CKA_KEY_GEN_MECHANISM have a value in generated private object and CKA_KEY_GEN_MECHANISM isn't CK_UNAVAILABLE_INFORMATION in generated private object implies CKA_LOCAL is CK_TRUE in generated private object. (43627 tests, 0 failed)

C_CopyObject: (34343 tests, 0 failed)

  • 100%: CKA_KEY_GEN_MECHANISM have a value in result object and CKA_KEY_GEN_MECHANISM isn't CK_UNAVAILABLE_INFORMATION in result object implies CKA_LOCAL is CK_TRUE in result object. (34343 tests, 0 failed)

C_CreateObject: (untested after 86829 tests)

  • -- : CKA_KEY_GEN_MECHANISM have a value in created object and CKA_KEY_GEN_MECHANISM isn't CK_UNAVAILABLE_INFORMATION in created object implies CKA_LOCAL is CK_TRUE in created object. (untested after 86829 tests)

C_DeriveKey: (untested after 32518 tests)

  • -- : CKA_KEY_GEN_MECHANISM have a value in derived key and CKA_KEY_GEN_MECHANISM isn't CK_UNAVAILABLE_INFORMATION in derived key implies CKA_LOCAL is CK_TRUE in derived key. (untested after 32518 tests)

C_UnwrapKey: (untested after 2582 tests)

  • -- : CKA_KEY_GEN_MECHANISM have a value in unwrapped object and CKA_KEY_GEN_MECHANISM isn't CK_UNAVAILABLE_INFORMATION in unwrapped object implies CKA_LOCAL is CK_TRUE in unwrapped object. (untested after 2582 tests)

22 CKA_TRUSTED can only be set to CK_TRUE by the SO user. Pass 0 4508

Reference: v2.20 s10.2 p66, s10.6.2 p73, s10.8 p81, s10.10 p84

If not compliant, a compromised session could set the CKA_TRUSTED attribute, causing untrusted certificates to be treated as trusted, and CKA_WRAP_WITH_TRUSTED keys could be wrapped under untrusted ones.

C_CopyObject: (1891 tests, 0 failed)

  • 100%: Call must fail if CKA_TRUSTED is specified as CK_TRUE in input template and is not CK_TRUE in copied object when copying secret or public key. (1891 tests, 0 failed)

C_SetAttributeValue: (1884 tests, 0 failed)

  • 100%: Call must fail if CKA_TRUSTED is specified as CK_TRUE in input template and is not CK_TRUE in initial object when modifying secret or public key. (1884 tests, 0 failed)

C_DeriveKey: (461 tests, 0 failed)

  • 100%: Call must fail if CKA_TRUSTED is specified as CK_TRUE in input template and is not CK_TRUE in base key. (461 tests, 0 failed)

C_GenerateKey: (145 tests, 0 failed)

  • 100%: Call must fail if CKA_TRUSTED is specified as CK_TRUE in input template. (145 tests, 0 failed)

C_CreateObject: (91 tests, 0 failed)

  • 100%: Call must fail if CKA_TRUSTED is specified as CK_TRUE in input template when creating secret or public key. (91 tests, 0 failed)

C_GenerateKeyPair: (36 tests, 0 failed)

  • 100%: Call must fail if CKA_TRUSTED is specified as CK_TRUE in public template. (36 tests, 0 failed)

C_UnwrapKey: (untested after 2582 tests)

  • -- : Call must fail if CKA_TRUSTED is specified as CK_TRUE in input template when unwrapping secret key. (untested after 2582 tests)

23 CKA_SENSITIVE cannot be changed once set to CK_TRUE. Pass 0 601

Reference: v2.20 s10.9 p82, s10.10 p84

If CKA_SENSITIVE can be changed to CK_FALSE, a previously protected key can be read by the GetAttribute command, directly breaking the security properties described in section 7 of the standard.

C_CopyObject: (331 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_SENSITIVE is specified in input template when CKA_SENSITIVE is CK_TRUE in initial object when copying secret or private key. (331 tests, 0 failed)

C_SetAttributeValue: (270 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_SENSITIVE is specified in input template when CKA_SENSITIVE is CK_TRUE in initial object when modifying secret or private key. (270 tests, 0 failed)

24 CKA_ALWAYS_SENSITIVE must not be specified when object is created with C_CreateObject. Pass 0 242

Reference: v2.20 s10.9 p82, s10.10 p84

If not compliant, CKA_ALWAYS_SENSITIVE may be set with a misleading value giving a false assessment of security of a key.

C_CreateObject: (242 tests, 0 failed)

  • 100%: Call must fail if CKA_ALWAYS_SENSITIVE is specified in input template when creating secret or private key. (242 tests, 0 failed)

25 CKA_ALWAYS_SENSITIVE must not be specified when object is generated with C_GenerateKey or C_GenerateKeyPair. Pass 0 1244

Reference: v2.20 s10.9 p82, s10.10 p84

If not compliant, CKA_ALWAYS_SENSITIVE may be set with a misleading value giving a false assessment of security of a key.

C_GenerateKeyPair: (944 tests, 0 failed)

  • 100%: Call must fail if CKA_ALWAYS_SENSITIVE is specified in private template. (944 tests, 0 failed)

C_GenerateKey: (300 tests, 0 failed)

  • 100%: Call must fail if CKA_ALWAYS_SENSITIVE is specified in input template. (300 tests, 0 failed)

26 CKA_ALWAYS_SENSITIVE must not be specified when object is unwrapped with C_UnwrapKey. Pass 0 100

Reference: v2.20 s10.9 p82, s10.10 p84

If not compliant, CKA_ALWAYS_SENSITIVE may be set with a misleading value giving a false assessment of security of a key.

C_UnwrapKey: (100 tests, 0 failed)

  • 100%: Call must fail if CKA_ALWAYS_SENSITIVE is specified in input template. (100 tests, 0 failed)

27 CKA_ALWAYS_SENSITIVE cannot be changed. Pass 0 6466

Reference: v2.20 s10.9 p82

If not compliant, CKA_ALWAYS_SENSITIVE may be set with a misleading value giving a false assessment of security of a key.

C_CopyObject: (3481 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_ALWAYS_SENSITIVE is specified in input template when copying secret or private key. (3481 tests, 0 failed)

C_SetAttributeValue: (2985 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_ALWAYS_SENSITIVE is specified in input template when modifying secret or private key. (2985 tests, 0 failed)

28 CKA_EXTRACTABLE cannot be changed once set to CK_FALSE. Pass 0 5172

Reference: v2.20 s10.9 p82, s10.10 p84

If CKA_EXTRACTABLE can be changed to CK_TRUE, a previously protected key can be exported, directly breaking the security properties described in section 7 of the standard.

C_CopyObject: (2756 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_EXTRACTABLE is specified in input template when CKA_EXTRACTABLE is CK_FALSE in initial object when copying secret or private key. (2756 tests, 0 failed)

C_SetAttributeValue: (2416 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_EXTRACTABLE is specified in input template when CKA_EXTRACTABLE is CK_FALSE in initial object when modifying secret or private key. (2416 tests, 0 failed)

29 CKA_ALWAYS_SENSITIVE must be CK_TRUE if key has always had the CKA_SENSITIVE attribute set to CK_TRUE. Pass 0 545984

Reference: v2.20 s10.9 p82, s10.10 p84

If not compliant, CKA_ALWAYS_SENSITIVE may have a misleading value giving a false assessment of the security of a key.

C_GenerateKey: (349358 tests, 0 failed)

  • 100%: CKA_SENSITIVE is CK_FALSE in generated object implies CKA_ALWAYS_SENSITIVE is CK_FALSE in generated object. (299393 tests, 0 failed)
  • 100%: CKA_SENSITIVE is CK_TRUE in generated object implies CKA_ALWAYS_SENSITIVE is CK_TRUE in generated object. (49965 tests, 0 failed)

C_CreateObject: (71458 tests, 0 failed)

  • 100%: CKA_SENSITIVE is CK_FALSE in created object implies CKA_ALWAYS_SENSITIVE is CK_FALSE in created object when creating secret or private key. (71458 tests, 0 failed)

C_CopyObject: (48272 tests, 0 failed)

  • 100%: CKA_SENSITIVE is CK_FALSE in result object implies CKA_ALWAYS_SENSITIVE is CK_FALSE in result object when copying secret or private key. (43074 tests, 0 failed)
  • 100%: CKA_ALWAYS_SENSITIVE is CK_TRUE in result object implies CKA_ALWAYS_SENSITIVE is CK_TRUE in copied object when copying secret or private key. (2599 tests, 0 failed)
  • 100%: CKA_SENSITIVE is CK_TRUE in result object and CKA_ALWAYS_SENSITIVE is CK_TRUE in copied object implies CKA_ALWAYS_SENSITIVE is CK_TRUE in result object when copying secret or private key. (2599 tests, 0 failed)

C_GenerateKeyPair: (43627 tests, 0 failed)

  • 100%: CKA_SENSITIVE is CK_FALSE in generated private object implies CKA_ALWAYS_SENSITIVE is CK_FALSE in generated private object. (40600 tests, 0 failed)
  • 100%: CKA_SENSITIVE is CK_TRUE in generated private object implies CKA_ALWAYS_SENSITIVE is CK_TRUE in generated private object. (3027 tests, 0 failed)

C_SetAttributeValue: (33269 tests, 0 failed)

  • 100%: CKA_SENSITIVE is CK_FALSE in result object implies CKA_ALWAYS_SENSITIVE is CK_FALSE in result object when modifying secret or private key. (29479 tests, 0 failed)
  • 100%: CKA_ALWAYS_SENSITIVE is CK_TRUE in result object implies CKA_ALWAYS_SENSITIVE is CK_TRUE in initial object when modifying secret or private key. (1895 tests, 0 failed)
  • 100%: CKA_SENSITIVE is CK_TRUE in result object and CKA_ALWAYS_SENSITIVE is CK_TRUE in initial object implies CKA_ALWAYS_SENSITIVE is CK_TRUE in result object when modifying secret or private key. (1895 tests, 0 failed)

C_UnwrapKey: (untested after 2582 tests)

  • -- : CKA_SENSITIVE is CK_FALSE in unwrapped object implies CKA_ALWAYS_SENSITIVE is CK_FALSE in unwrapped object. (untested after 2582 tests)

30 CKA_ALWAYS_SENSITIVE must be set to CK_FALSE on object created with C_CreateObject. Pass 0 82479

Reference: v2.20 s11.7 p128

If the key material has come from outside the device, it cannot possibly be considered CKA_ALWAYS_SENSITIVE. A non compliant implementation would give a false measure of security.

C_CreateObject: (82479 tests, 0 failed)

  • 100%: CKA_ALWAYS_SENSITIVE must be set to CK_FALSE in created object when creating secret or private key. (82479 tests, 0 failed)

33 CKA_NEVER_EXTRACTABLE must not be specified when object is created with C_CreateObject. Pass 0 242

Reference: v2.20 s10.9 p82, s10.10 p84

If not compliant, CKA_NEVER_EXTRACTABLE may be set with a misleading value giving a false assessment of security of a key.

C_CreateObject: (242 tests, 0 failed)

  • 100%: Call must fail if CKA_NEVER_EXTRACTABLE is specified in input template when creating secret or private key. (242 tests, 0 failed)

34 CKA_NEVER_EXTRACTABLE must not be specified when object is generated with C_GenerateKey or C_GenerateKeyPair. Pass 0 1244

Reference: v2.20 s10.9 p82, s10.10 p84

If not compliant, CKA_NEVER_EXTRACTABLE may be set with a misleading value giving a false assessment of security of a key.

C_GenerateKeyPair: (944 tests, 0 failed)

  • 100%: Call must fail if CKA_NEVER_EXTRACTABLE is specified in private template. (944 tests, 0 failed)

C_GenerateKey: (300 tests, 0 failed)

  • 100%: Call must fail if CKA_NEVER_EXTRACTABLE is specified in input template. (300 tests, 0 failed)

35 CKA_NEVER_EXTRACTABLE must not be specified when object is unwrapped with C_UnwrapKey. Pass 0 100

Reference: v2.20 s10.9 p82, s10.10 p84

If not compliant, CKA_NEVER_EXTRACTABLE may be set with a misleading value giving a false assessment of security of a key.

C_UnwrapKey: (100 tests, 0 failed)

  • 100%: Call must fail if CKA_NEVER_EXTRACTABLE is specified in input template. (100 tests, 0 failed)

36 CKA_NEVER_EXTRACTABLE cannot be changed. Pass 0 6466

Reference: v2.20 s10.9 p82, s10.10 p84

If not compliant, CKA_NEVER_EXTRACTABLE may be set with a misleading value giving a false assessment of security of a key.

C_CopyObject: (3481 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_NEVER_EXTRACTABLE is specified in input template when copying secret or private key. (3481 tests, 0 failed)

C_SetAttributeValue: (2985 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_NEVER_EXTRACTABLE is specified in input template when modifying secret or private key. (2985 tests, 0 failed)

37 CKA_NEVER_EXTRACTABLE must be CK_TRUE if key has never had the CKA_EXTRACTABLE attribute set to CK_TRUE. Pass 0 572631

Reference: v2.20 s10.7 p79

If not compliant, CKA_NEVER_EXTRACTABLE may have a misleading value giving a false assessment of the security of a key.

C_GenerateKey: (349358 tests, 0 failed)

  • 100%: CKA_EXTRACTABLE is CK_TRUE in generated object implies CKA_NEVER_EXTRACTABLE is CK_FALSE in generated object. (49874 tests, 0 failed)
  • 100%: CKA_EXTRACTABLE is CK_FALSE in generated object implies CKA_NEVER_EXTRACTABLE is CK_TRUE in generated object. (299484 tests, 0 failed)

C_CopyObject: (90868 tests, 0 failed)

  • 100%: CKA_EXTRACTABLE is CK_TRUE in result object implies CKA_NEVER_EXTRACTABLE is CK_FALSE in result object when copying secret or private key. (7864 tests, 0 failed)
  • 100%: CKA_NEVER_EXTRACTABLE is CK_TRUE in result object implies CKA_NEVER_EXTRACTABLE is CK_TRUE in copied object when copying secret or private key. (41502 tests, 0 failed)
  • 100%: CKA_EXTRACTABLE is CK_FALSE in result object and CKA_NEVER_EXTRACTABLE is CK_TRUE in copied object implies CKA_NEVER_EXTRACTABLE is CK_TRUE in result object when copying secret or private key. (41502 tests, 0 failed)

C_SetAttributeValue: (63266 tests, 0 failed)

  • 100%: CKA_EXTRACTABLE is CK_TRUE in result object implies CKA_NEVER_EXTRACTABLE is CK_FALSE in result object when modifying secret or private key. (4846 tests, 0 failed)
  • 100%: CKA_NEVER_EXTRACTABLE is CK_TRUE in result object implies CKA_NEVER_EXTRACTABLE is CK_TRUE in initial object when modifying secret or private key. (29210 tests, 0 failed)
  • 100%: CKA_EXTRACTABLE is CK_FALSE in result object and CKA_NEVER_EXTRACTABLE is CK_TRUE in initial object implies CKA_NEVER_EXTRACTABLE is CK_TRUE in result object when modifying secret or private key. (29210 tests, 0 failed)

C_GenerateKeyPair: (43627 tests, 0 failed)

  • 100%: CKA_EXTRACTABLE is CK_TRUE in generated private object implies CKA_NEVER_EXTRACTABLE is CK_FALSE in generated private object. (3203 tests, 0 failed)
  • 100%: CKA_EXTRACTABLE is CK_FALSE in generated private object implies CKA_NEVER_EXTRACTABLE is CK_TRUE in generated private object. (40424 tests, 0 failed)

C_CreateObject: (25512 tests, 0 failed)

  • 100%: CKA_EXTRACTABLE is CK_TRUE in created object implies CKA_NEVER_EXTRACTABLE is CK_FALSE in created object when creating secret or private key. (25512 tests, 0 failed)

C_UnwrapKey: (untested after 2582 tests)

  • -- : CKA_EXTRACTABLE is CK_TRUE in unwrapped object implies CKA_NEVER_EXTRACTABLE is CK_FALSE in unwrapped object when unwrapping secret or private key. (untested after 2582 tests)

40 CKA_WRAP_WITH_TRUSTED cannot be changed once set to CK_TRUE. Pass 0 646

Reference: v2.20 s10.9 p82, s10.10 p84

If not compliant, a key which has previously been marked as CKA_WRAP_WITH_TRUSTED may later be wrapped under an untrusted key-encryption key.

C_CopyObject: (358 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_WRAP_WITH_TRUSTED is specified in input template when CKA_WRAP_WITH_TRUSTED is CK_TRUE in initial object when copying secret or private key. (358 tests, 0 failed)

C_SetAttributeValue: (288 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_WRAP_WITH_TRUSTED is specified in input template when CKA_WRAP_WITH_TRUSTED is CK_TRUE in initial object when modifying secret or private key. (288 tests, 0 failed)

41 CKA_MODULUS must be specified when RSA keys are created with C_CreateObject. Pass 0 90

Reference: v2.20 s12.1.2 p193, s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a weak key.

C_CreateObject: (90 tests, 0 failed)

  • 100%: Call must fail if CKA_MODULUS is not specified in input template when creating RSA key. (90 tests, 0 failed)

42 CKA_MODULUS must not be specified when RSA keys are generated with C_GenerateKeyPair. Pass 0 184

Reference: v2.20 s12.1.2 p193, s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_GenerateKeyPair: (184 tests, 0 failed)

  • 100%: Call must fail if CKA_MODULUS is specified in public template when generating RSA keys . (19 tests, 0 failed)
  • 100%: Call must fail if CKA_MODULUS is specified in private template when generating RSA keys . (165 tests, 0 failed)

44 CKA_MODULUS cannot be changed. Pass 0 3058

Reference: v2.20 s12.1.2 p193

Alteration of key material may lead to loss of security.

C_CopyObject: (1799 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_MODULUS is specified in input template when copying RSA key. (1799 tests, 0 failed)

C_SetAttributeValue: (1259 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_MODULUS is specified in input template when modifying RSA key. (1259 tests, 0 failed)

45 CKA_MODULUS_BITS must be specified on public part when RSA keys are generated with C_GenerateKeyPair. Pass 0 19

Reference: v2.20 s12.1.2 p193

A non-compliant device would have ill-defined behavior.

C_GenerateKeyPair: (19 tests, 0 failed)

  • 100%: Call must fail if CKA_MODULUS_BITS is not specified in public template when generating RSA keys . (19 tests, 0 failed)

46 CKA_MODULUS_BITS must not be specified when RSA public key are created with C_CreateObject. Pass 0 32

Reference: v2.20 s12.1.2 p193

A non-compliant device would have ill-defined behavior.

C_CreateObject: (32 tests, 0 failed)

  • 100%: Call must fail if CKA_MODULUS_BITS is specified in input template when creating RSA public key. (32 tests, 0 failed)

47 CKA_MODULUS_BITS cannot be changed. Pass 0 148

Reference: v2.20 s12.1.2 p193

Alteration of key material may lead to loss of security.

C_SetAttributeValue: (74 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_MODULUS_BITS is specified in input template when modifying RSA public key. (74 tests, 0 failed)

C_CopyObject: (74 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_MODULUS_BITS is specified in input template when copying RSA public key. (74 tests, 0 failed)

48 CKA_PUBLIC_EXPONENT must be specified when RSA public keys are created with C_CreateObject. Pass 0 32

Reference: v2.20 s12.1.2 p193

A non-compliant device would have ill-defined behavior and may create a weak key.

C_CreateObject: (32 tests, 0 failed)

  • 100%: Call must fail if CKA_PUBLIC_EXPONENT is not specified in input template when creating RSA public key. (32 tests, 0 failed)

49 CKA_PUBLIC_EXPONENT default value is 65537 for RSA keys generated with C_GenerateKeyPair. Pass 0 414

Reference: v2.20 s12.1.2 p193

A default value of 3 leaves certain padding modes available in PKCS#11 open to attack.

C_GenerateKeyPair: (414 tests, 0 failed)

  • 100%: CKA_PUBLIC_EXPONENT must be set to 65537 in generated public object when not specified in public template when generating RSA keys . (414 tests, 0 failed)

50 CKA_PUBLIC_EXPONENT must not be specified on private part when generating RSA keys with C_GenerateKeyPair. Pass 0 165

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_GenerateKeyPair: (165 tests, 0 failed)

  • 100%: Call must fail if CKA_PUBLIC_EXPONENT is specified in private template when generating RSA keys . (165 tests, 0 failed)

52 CKA_PRIVATE_EXPONENT must be specified when RSA private keys are created with C_CreateObject. Pass 0 58

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a weak key.

C_CreateObject: (58 tests, 0 failed)

  • 100%: Call must fail if CKA_PRIVATE_EXPONENT is not specified in input template when creating RSA private key. (58 tests, 0 failed)

53 CKA_PRIVATE_EXPONENT must not be specified on private part when RSA private keys are generated with C_GenerateKeyPair. Pass 0 165

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_GenerateKeyPair: (165 tests, 0 failed)

  • 100%: Call must fail if CKA_PRIVATE_EXPONENT is specified in private template when generating RSA keys . (165 tests, 0 failed)

55 CKA_PRIVATE_EXPONENT cannot be revealed if RSA private key has its CKA_SENSITIVE attribute set to CK_TRUE or its CKA_EXTRACTABLE attribute set to CK_FALSE. Pass 0 4

Reference: v2.20 s7 p30, s12.1.3 p194

If not compliant, device leaks the value of keys marked as CKA_SENSITIVE or un-EXTRACTABLE, breaking the security properties described in section 7 of the standard (see CVE-2010-3321)

C_GetAttributeValue: (4 tests, 0 failed)

  • 100%: Call must fail when requesting for CKA_PRIVATE_EXPONENT and attribute CKA_EXTRACTABLE is CK_FALSE when inspecting RSA private key. (2 tests, 0 failed)
  • 100%: Call must fail when requesting for CKA_PRIVATE_EXPONENT and attribute CKA_SENSITIVE is CK_TRUE when inspecting RSA private key. (2 tests, 0 failed)

56 CKA_PRIME_1 must not be specified on private part when RSA private keys are generated with C_GenerateKeyPair. Pass 0 165

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_GenerateKeyPair: (165 tests, 0 failed)

  • 100%: Call must fail if CKA_PRIME_1 is specified in private template when generating RSA keys . (165 tests, 0 failed)

58 CKA_PRIME_1 cannot be revealed if RSA private key has its CKA_SENSITIVE attribute set to CK_TRUE or its CKA_EXTRACTABLE attribute set to CK_FALSE. Pass 0 4

Reference: v2.20 s7 p30, s12.1.3 p194

If not compliant, device leaks the value of keys marked as CKA_SENSITIVE or un-EXTRACTABLE, breaking the security properties described in section 7 of the standard (see CVE-2010-3321)

C_GetAttributeValue: (4 tests, 0 failed)

  • 100%: Call must fail when requesting for CKA_PRIME_1 and attribute CKA_EXTRACTABLE is CK_FALSE when inspecting RSA private key. (2 tests, 0 failed)
  • 100%: Call must fail when requesting for CKA_PRIME_1 and attribute CKA_SENSITIVE is CK_TRUE when inspecting RSA private key. (2 tests, 0 failed)

59 CKA_PRIME_2 must not be specified on private part when RSA private keys are generated with C_GenerateKeyPair. Pass 0 165

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_GenerateKeyPair: (165 tests, 0 failed)

  • 100%: Call must fail if CKA_PRIME_2 is specified in private template when generating RSA keys . (165 tests, 0 failed)

61 CKA_PRIME_2 cannot be revealed if RSA private key has its CKA_SENSITIVE attribute set to CK_TRUE or its CKA_EXTRACTABLE attribute set to CK_FALSE. Pass 0 4

Reference: v2.20 s7 p30, s12.1.3 p194

If not compliant, device leaks the value of keys marked as CKA_SENSITIVE or un-EXTRACTABLE, breaking the security properties described in section 7 of the standard (see CVE-2010-3321)

C_GetAttributeValue: (4 tests, 0 failed)

  • 100%: Call must fail when requesting for CKA_PRIME_2 and attribute CKA_EXTRACTABLE is CK_FALSE when inspecting RSA private key. (2 tests, 0 failed)
  • 100%: Call must fail when requesting for CKA_PRIME_2 and attribute CKA_SENSITIVE is CK_TRUE when inspecting RSA private key. (2 tests, 0 failed)

62 CKA_EXPONENT_1 must not be specified on private part when RSA private keys are generated with C_GenerateKeyPair. Pass 0 165

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_GenerateKeyPair: (165 tests, 0 failed)

  • 100%: Call must fail if CKA_EXPONENT_1 is specified in private template when generating RSA keys . (165 tests, 0 failed)

64 CKA_EXPONENT_1 cannot be revealed if RSA private key has its CKA_SENSITIVE attribute set to CK_TRUE or its CKA_EXTRACTABLE attribute set to CK_FALSE. Pass 0 4

Reference: v2.20 s7 p30, s12.1.3 p194

If not compliant, device leaks the value of keys marked as CKA_SENSITIVE or un-EXTRACTABLE, breaking the security properties described in section 7 of the standard (see CVE-2010-3321)

C_GetAttributeValue: (4 tests, 0 failed)

  • 100%: Call must fail when requesting for CKA_EXPONENT_1 and attribute CKA_EXTRACTABLE is CK_FALSE when inspecting RSA private key. (2 tests, 0 failed)
  • 100%: Call must fail when requesting for CKA_EXPONENT_1 and attribute CKA_SENSITIVE is CK_TRUE when inspecting RSA private key. (2 tests, 0 failed)

65 CKA_EXPONENT_2 must not be specified on private part when RSA private keys are generated with C_GenerateKeyPair. Pass 0 165

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_GenerateKeyPair: (165 tests, 0 failed)

  • 100%: Call must fail if CKA_EXPONENT_2 is specified in private template when generating RSA keys . (165 tests, 0 failed)

67 CKA_EXPONENT_2 cannot be revealed if RSA private key has its CKA_SENSITIVE attribute set to CK_TRUE or its CKA_EXTRACTABLE attribute set to CK_FALSE. Pass 0 4

Reference: v2.20 s7 p30, s12.1.3 p194

If not compliant, device leaks the value of keys marked as CKA_SENSITIVE or un-EXTRACTABLE, breaking the security properties described in section 7 of the standard (see CVE-2010-3321)

C_GetAttributeValue: (4 tests, 0 failed)

  • 100%: Call must fail when requesting for CKA_EXPONENT_2 and attribute CKA_EXTRACTABLE is CK_FALSE when inspecting RSA private key. (2 tests, 0 failed)
  • 100%: Call must fail when requesting for CKA_EXPONENT_2 and attribute CKA_SENSITIVE is CK_TRUE when inspecting RSA private key. (2 tests, 0 failed)

68 CKA_COEFFICIENT must not be specified on private part when RSA private keys are generated with C_GenerateKeyPair. Pass 0 165

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_GenerateKeyPair: (165 tests, 0 failed)

  • 100%: Call must fail if CKA_COEFFICIENT is specified in private template when generating RSA keys . (165 tests, 0 failed)

70 CKA_COEFFICIENT cannot be revealed if RSA private key has its CKA_SENSITIVE attribute set to CK_TRUE or its CKA_EXTRACTABLE attribute set to CK_FALSE. Pass 0 4

Reference: v2.20 s7 p30, s12.1.3 p194

If not compliant, device leaks the value of keys marked as CKA_SENSITIVE or un-EXTRACTABLE, breaking the security properties described in section 7 of the standard (see CVE-2010-3321)

C_GetAttributeValue: (4 tests, 0 failed)

  • 100%: Call must fail when requesting for CKA_COEFFICIENT and attribute CKA_EXTRACTABLE is CK_FALSE when inspecting RSA private key. (2 tests, 0 failed)
  • 100%: Call must fail when requesting for CKA_COEFFICIENT and attribute CKA_SENSITIVE is CK_TRUE when inspecting RSA private key. (2 tests, 0 failed)

71 CKA_VALUE must be specified when secret keys are created with C_CreateObject. Pass 0 62

Reference: v2.20 s12.12.2 p268, s12.13.2 p275, s12.13.3 p276, s12.13.4 p277, s12.13.5 p277, s12.13.6 p278, s12.13.7 p278, s12.15.2 p287, s12.15.3 p288, s12.16.2 p292, s12.17.2 p300, s12.18.2 p304

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_CreateObject: (62 tests, 0 failed)

  • 100%: Call must fail if CKA_VALUE is not specified in input template when creating secret key. (62 tests, 0 failed)

72 CKA_VALUE must not be specified when secret keys are generated with C_GenerateKey. Pass 0 210

Reference: v2.20 s12.12.2 p268, s12.13.2 p275, s12.13.3 p276, s12.13.4 p277, s12.13.5 p277, s12.13.6 p278, s12.13.7 p278, s12.15.2 p287, s12.15.3 p288, s12.16.2 p292, s12.17.2 p300, s12.18.2 p304

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_GenerateKey: (210 tests, 0 failed)

  • 100%: Call must fail if CKA_VALUE is specified in input template. (210 tests, 0 failed)

74 CKA_VALUE cannot be revealed if secret key has its CKA_SENSITIVE attribute set to CK_TRUE or its CKA_EXTRACTABLE attribute set to CK_FALSE. Pass 0 12

Reference: v2.20 s7 p30, s12.12.2 p268, s12.13.2 p275, s12.13.3 p276, s12.13.4 p277, s12.13.5 p277, s12.13.6 p278, s12.13.7 p278, s12.15.2 p287, s12.15.3 p288, s12.16.2 p292, s12.17.2 p300, s12.18.2 p304

If not compliant, device leaks the value of keys marked as CKA_SENSITIVE or un-EXTRACTABLE, breaking the security properties described in section 7 of the standard (see CVE-2010-3321).

C_GetAttributeValue: (12 tests, 0 failed)

  • 100%: Call must fail when requesting for CKA_VALUE and attribute CKA_EXTRACTABLE is CK_FALSE when inspecting secret key. (6 tests, 0 failed)
  • 100%: Call must fail when requesting for CKA_VALUE and attribute CKA_SENSITIVE is CK_TRUE when inspecting secret key. (6 tests, 0 failed)

75 CKA_VALUE_LEN must not be specified when AES secret keys are created with C_CreateObject. Pass 0 129

Reference: v2.20 s12.12.2 p268

Length of key should be obtained from key material, otherwise an insecure key may result.

C_CreateObject: (129 tests, 0 failed)

  • 100%: Call must fail if CKA_VALUE_LEN is specified in input template when creating AES key. (129 tests, 0 failed)

76 CKA_VALUE_LEN must be specified when AES secret keys are generated with C_GenerateKey. Pass 0 90

Reference: v2.20 s12.12.2 p268

Insecure key material may result if length is not specified.

C_GenerateKey: (90 tests, 0 failed)

  • 100%: Call must fail if CKA_VALUE_LEN is not specified in input template when generating AES key . (90 tests, 0 failed)

77 CKA_VALUE_LEN must not be specified when AES secret keys are unwrapped with C_UnwrapKey. Pass 0 1502

Reference: v2.20 s12.12.2 p268

Length of key should be obtained from key material, otherwise an insecure key may result.

C_UnwrapKey: (1502 tests, 0 failed)

  • 100%: Call must fail if CKA_VALUE_LEN is specified in input template when unwrapping AES key. (1502 tests, 0 failed)

78 CKA_EC_PARAMS must be specified when EC keys are created with C_CreateObject. Pass 0 68

Reference: v2.20 s12.3.3 p217, s12.3.4 p218

A non-compliant device would have ill-defined behavior and may create a weak key.

C_CreateObject: (68 tests, 0 failed)

  • 100%: Call must fail if CKA_EC_PARAMS is not specified in input template when creating EC key. (68 tests, 0 failed)

79 CKA_EC_PARAMS must be specified in public part when EC keys are generated with C_GenerateKeyPair. Pass 0 105

Reference: v2.20 s12.3.3 p217

A non-compliant device would have ill-defined behavior and may create a weak key.

C_GenerateKeyPair: (105 tests, 0 failed)

  • 100%: Call must fail if CKA_EC_PARAMS is not specified in public template when generating EC keys . (105 tests, 0 failed)

80 CKA_EC_POINT must be specified when public EC keys are created with C_CreateObject. Pass 0 50

Reference: v2.20 s12.3.3 p217

A non-compliant device would have ill-defined behavior and may create a weak key.

C_CreateObject: (50 tests, 0 failed)

  • 100%: Call must fail if CKA_EC_POINT is not specified in input template when creating EC public key. (50 tests, 0 failed)

81 CKA_EC_POINT must not be specified when EC keys are generated with C_GenerateKeyPair. Pass 0 18

Reference: v2.20 s12.3.3 p217

A non-compliant device would have ill-defined behavior and may create a weak key.

C_GenerateKeyPair: (18 tests, 0 failed)

  • 100%: Call must fail if CKA_EC_POINT is specified in public template when generating EC keys . (18 tests, 0 failed)
  • -- : Call must fail if CKA_EC_POINT is specified in private template when generating EC keys . (untested after 63612 tests)

82 CKA_EC_PARAMS must not be specified in private part when EC keys are generated with C_GenerateKeyPair. Pass 0 7675

Reference: v2.20 s12.3.4 p218

The value of this field is taken from the public key template. If specified twice, there is a chance of an inconsistency that could lead to an invalid and/or insecure key.

C_GenerateKeyPair: (7675 tests, 0 failed)

  • 100%: Call must fail if CKA_EC_PARAMS is specified in private template when generating EC keys . (7675 tests, 0 failed)

84 CKA_VALUE must be specified when private EC keys are created with C_CreateObject. Pass 0 59

Reference: v2.20 s12.3.4 p218

Without a value, the call is ambiguous and may result in the creation of an insecure key.

C_CreateObject: (59 tests, 0 failed)

  • 100%: Call must fail if CKA_VALUE is not specified in input template when creating EC private key. (59 tests, 0 failed)

85 CKA_VALUE must not be specified in private part when EC keys are generated with C_GenerateKeyPair. Pass 0 1842

Reference: v2.20 s12.3.4 p218

The value should be randomly generated by the device. If a value is given, an insecure key may result.

C_GenerateKeyPair: (1842 tests, 0 failed)

  • 100%: Call must fail if CKA_VALUE is specified in private template when generating EC keys . (1842 tests, 0 failed)

88 C_EncryptInit only succeeds if CKA_ENCRYPT is set to CK_TRUE. Pass 0 222

Reference: v2.20 s11.8 p139

A non-compliant device would allow encryption to be carried out by a key which does not have the correct permission to do this operation.

C_Encrypt: (222 tests, 0 failed)

  • 100%: Call must fail if CKA_ENCRYPT is not specified as CK_TRUE in encryption key. (222 tests, 0 failed)

89 C_DecryptInit only succeeds if CKA_DECRYPT is set to CK_TRUE. Pass 0 354

Reference: v2.20 s11.9 p144

A non-compliant device would allow decryption to be carried out by a key which does not have the correct permission to do this operation.

C_Decrypt: (354 tests, 0 failed)

  • 100%: Call must fail if CKA_DECRYPT is not specified as CK_TRUE in decryption key. (354 tests, 0 failed)

90 C_SignInit only succeeds if CKA_SIGN is CK_TRUE. Pass 0 177

Reference: v2.20 s11.11 p152

A non-compliant device would allow signatures to be created by a key which does not have the correct permission to do this operation.

C_Sign: (177 tests, 0 failed)

  • 100%: Call must fail if CKA_SIGN is not specified as CK_TRUE in signing key. (177 tests, 0 failed)

91 C_VerifyInit succeeds only if CKA_VERIFY is CK_TRUE. Pass 0 96

Reference: v2.20 s11.12 p157

A non-compliant device would allow signature verification to be carried out by a key which does not have the correct permission to do this operation.

C_Verify: (96 tests, 0 failed)

  • 100%: Call must fail if CKA_VERIFY is not specified as CK_TRUE in verifying key. (96 tests, 0 failed)

92 C_WrapKey succeeds only if wrapping key has CKA_WRAP set to CK_TRUE. Pass 0 37848

Reference: v2.20 s11.14 p174

A non-compliant device would allow a key to be wrapped under a key-encrypting key which does not have the correct permission.

C_WrapKey: (37848 tests, 0 failed)

  • 100%: Call must fail if CKA_WRAP is not specified as CK_TRUE in wrapping key. (37848 tests, 0 failed)

94 C_WrapKey succeeds only if wrapped key has CKA_EXTRACTABLE set to CK_TRUE. Pass 0 237328

Reference: v2.20 s11.14 p174

A non-compliant device would allow keys marked as being unextractable to be exported from the device, breaking the security properties described in section 7 of the standard.

C_WrapKey: (237328 tests, 0 failed)

  • 100%: Call must fail if CKA_EXTRACTABLE is not specified as CK_TRUE in wrapped key. (237328 tests, 0 failed)

95 If a call to C_CreateObject cannot support the precise template supplied to it, it must fail and return without creating any object. Pass 0 16701

Reference: v2.20 s10.1.1 p63, s11.7 p128

If attributes do not match, an application may inadvertently create keys without adequate protection, or with excessive permissions

C_CreateObject: (16701 tests, 0 failed)

  • 100%: Call must fail if the provided value for CKA_CLASS in input template cannot be supported in created object (2522 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TOKEN in input template cannot be supported in created object (202 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE in input template cannot be supported in created object (202 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LABEL in input template cannot be supported in created object (2676 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_VALUE in input template cannot be supported in created object (1018 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TRUSTED in input template cannot be supported in created object (151 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_TYPE in input template cannot be supported in created object (2522 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SUBJECT in input template cannot be supported in created object (untested after 86829 tests)
  • -- : Call must fail if the provided value for CKA_ID in input template cannot be supported in created object (untested after 86829 tests)
  • 100%: Call must fail if the provided value for CKA_SENSITIVE in input template cannot be supported in created object (144 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ENCRYPT in input template cannot be supported in created object (128 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_DECRYPT in input template cannot be supported in created object (144 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_WRAP in input template cannot be supported in created object (128 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_UNWRAP in input template cannot be supported in created object (144 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_SIGN in input template cannot be supported in created object (144 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SIGN_RECOVER in input template cannot be supported in created object (untested after 86829 tests)
  • 100%: Call must fail if the provided value for CKA_VERIFY in input template cannot be supported in created object (128 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_VERIFY_RECOVER in input template cannot be supported in created object (untested after 86829 tests)
  • 100%: Call must fail if the provided value for CKA_DERIVE in input template cannot be supported in created object (202 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODULUS in input template cannot be supported in created object (1392 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODULUS_BITS in input template cannot be supported in created object (172 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PUBLIC_EXPONENT in input template cannot be supported in created object (564 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE_EXPONENT in input template cannot be supported in created object (978 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIME_1 in input template cannot be supported in created object (150 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIME_2 in input template cannot be supported in created object (150 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXPONENT_1 in input template cannot be supported in created object (150 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXPONENT_2 in input template cannot be supported in created object (150 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_COEFFICIENT in input template cannot be supported in created object (150 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_PRIME in input template cannot be supported in created object (untested after 86829 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME in input template cannot be supported in created object (untested after 86829 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_BITS in input template cannot be supported in created object (untested after 86829 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME_BITS in input template cannot be supported in created object (untested after 86829 tests)
  • 100%: Call must fail if the provided value for CKA_VALUE_LEN in input template cannot be supported in created object (132 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXTRACTABLE in input template cannot be supported in created object (144 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LOCAL in input template cannot be supported in created object (308 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_NEVER_EXTRACTABLE in input template cannot be supported in created object (242 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ALWAYS_SENSITIVE in input template cannot be supported in created object (242 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_GEN_MECHANISM in input template cannot be supported in created object (924 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODIFIABLE in input template cannot be supported in created object (202 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EC_PARAMS in input template cannot be supported in created object (50 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EC_POINT in input template cannot be supported in created object (2 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_ALWAYS_AUTHENTICATE in input template cannot be supported in created object (untested after 86829 tests)
  • 100%: Call must fail if the provided value for CKA_WRAP_WITH_TRUSTED in input template cannot be supported in created object (144 tests, 0 failed)

96 If a call to C_CopyObject cannot support the precise template supplied to it, it must fail and return without creating any object. Pass 0 343105

Reference: v2.20 s10.1.1 p63, s10.1.3 p65, s11.7 p128

If attributes do not match, an application may inadvertently create keys without adequate protection, or with excessive permissions

C_CopyObject: (343105 tests, 0 failed)

  • 100%: Call must fail if the provided value for CKA_CLASS in input template cannot be supported in result object (10986 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TOKEN in input template cannot be supported in result object (7816 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE in input template cannot be supported in result object (7487 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LABEL in input template cannot be supported in result object (142636 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_VALUE in input template cannot be supported in result object (11382 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TRUSTED in input template cannot be supported in result object (3782 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_TYPE in input template cannot be supported in result object (18310 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SUBJECT in input template cannot be supported in result object (untested after 194855 tests)
  • -- : Call must fail if the provided value for CKA_ID in input template cannot be supported in result object (untested after 194855 tests)
  • 100%: Call must fail if the provided value for CKA_SENSITIVE in input template cannot be supported in result object (7414 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ENCRYPT in input template cannot be supported in result object (254 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_DECRYPT in input template cannot be supported in result object (7764 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_WRAP in input template cannot be supported in result object (254 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_UNWRAP in input template cannot be supported in result object (7764 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_SIGN in input template cannot be supported in result object (7764 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SIGN_RECOVER in input template cannot be supported in result object (untested after 194855 tests)
  • 100%: Call must fail if the provided value for CKA_VERIFY in input template cannot be supported in result object (254 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_VERIFY_RECOVER in input template cannot be supported in result object (untested after 194855 tests)
  • 100%: Call must fail if the provided value for CKA_DERIVE in input template cannot be supported in result object (7816 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODULUS in input template cannot be supported in result object (3258 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODULUS_BITS in input template cannot be supported in result object (90 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PUBLIC_EXPONENT in input template cannot be supported in result object (1629 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE_EXPONENT in input template cannot be supported in result object (3168 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIME_1 in input template cannot be supported in result object (3168 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIME_2 in input template cannot be supported in result object (3168 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXPONENT_1 in input template cannot be supported in result object (3168 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXPONENT_2 in input template cannot be supported in result object (3168 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_COEFFICIENT in input template cannot be supported in result object (3168 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_PRIME in input template cannot be supported in result object (untested after 194855 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME in input template cannot be supported in result object (untested after 194855 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_BITS in input template cannot be supported in result object (untested after 194855 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME_BITS in input template cannot be supported in result object (untested after 194855 tests)
  • 100%: Call must fail if the provided value for CKA_VALUE_LEN in input template cannot be supported in result object (3420 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXTRACTABLE in input template cannot be supported in result object (7808 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LOCAL in input template cannot be supported in result object (7324 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_NEVER_EXTRACTABLE in input template cannot be supported in result object (6962 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ALWAYS_SENSITIVE in input template cannot be supported in result object (6962 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_GEN_MECHANISM in input template cannot be supported in result object (21972 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODIFIABLE in input template cannot be supported in result object (7816 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EC_PARAMS in input template cannot be supported in result object (8075 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EC_POINT in input template cannot be supported in result object (136 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_ALWAYS_AUTHENTICATE in input template cannot be supported in result object (untested after 194855 tests)
  • 100%: Call must fail if the provided value for CKA_WRAP_WITH_TRUSTED in input template cannot be supported in result object (6962 tests, 0 failed)

97 If a specified change cannot be made with C_SetAttributeValue, the call must fail. Pass 0 182299

Reference: v2.20 s10.1.1 p63, s10.1.2 p65, s11.7 p128

If attributes do not match, an application may inadvertently create keys without adequate protection, or with excessive permissions

C_SetAttributeValue: (182299 tests, 0 failed)

  • 100%: Call must fail if the provided value for CKA_CLASS in input template cannot be supported in result object (9498 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TOKEN in input template cannot be supported in result object (6332 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE in input template cannot be supported in result object (6332 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_LABEL in input template cannot be supported in result object (untested after 174427 tests)
  • 100%: Call must fail if the provided value for CKA_VALUE in input template cannot be supported in result object (11340 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TRUSTED in input template cannot be supported in result object (3768 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_TYPE in input template cannot be supported in result object (15830 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SUBJECT in input template cannot be supported in result object (untested after 174427 tests)
  • -- : Call must fail if the provided value for CKA_ID in input template cannot be supported in result object (untested after 174427 tests)
  • 100%: Call must fail if the provided value for CKA_SENSITIVE in input template cannot be supported in result object (8148 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ENCRYPT in input template cannot be supported in result object (254 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_DECRYPT in input template cannot be supported in result object (8742 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_WRAP in input template cannot be supported in result object (254 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_UNWRAP in input template cannot be supported in result object (8742 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_SIGN in input template cannot be supported in result object (8742 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SIGN_RECOVER in input template cannot be supported in result object (untested after 174427 tests)
  • 100%: Call must fail if the provided value for CKA_VERIFY in input template cannot be supported in result object (254 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_VERIFY_RECOVER in input template cannot be supported in result object (untested after 174427 tests)
  • 100%: Call must fail if the provided value for CKA_DERIVE in input template cannot be supported in result object (8794 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODULUS in input template cannot be supported in result object (2280 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODULUS_BITS in input template cannot be supported in result object (90 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PUBLIC_EXPONENT in input template cannot be supported in result object (1140 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE_EXPONENT in input template cannot be supported in result object (2190 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIME_1 in input template cannot be supported in result object (2190 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIME_2 in input template cannot be supported in result object (2190 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXPONENT_1 in input template cannot be supported in result object (2190 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXPONENT_2 in input template cannot be supported in result object (2190 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_COEFFICIENT in input template cannot be supported in result object (2190 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_PRIME in input template cannot be supported in result object (untested after 174427 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME in input template cannot be supported in result object (untested after 174427 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_BITS in input template cannot be supported in result object (untested after 174427 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME_BITS in input template cannot be supported in result object (untested after 174427 tests)
  • 100%: Call must fail if the provided value for CKA_VALUE_LEN in input template cannot be supported in result object (3406 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXTRACTABLE in input template cannot be supported in result object (7432 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LOCAL in input template cannot be supported in result object (6332 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_NEVER_EXTRACTABLE in input template cannot be supported in result object (5970 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ALWAYS_SENSITIVE in input template cannot be supported in result object (5970 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_GEN_MECHANISM in input template cannot be supported in result object (18996 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODIFIABLE in input template cannot be supported in result object (6332 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EC_PARAMS in input template cannot be supported in result object (8075 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EC_POINT in input template cannot be supported in result object (136 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_ALWAYS_AUTHENTICATE in input template cannot be supported in result object (untested after 174427 tests)
  • 100%: Call must fail if the provided value for CKA_WRAP_WITH_TRUSTED in input template cannot be supported in result object (5970 tests, 0 failed)

98 If a call to C_GenerateKey cannot support the precise template supplied to it, it must fail and return without creating any object. Pass 0 10929

Reference: v2.20 s10.1.1 p63, s11.14 p174

If attributes do not match, an application may inadvertently create keys without adequate protection, or with excessive permissions

C_GenerateKey: (10929 tests, 0 failed)

  • 100%: Call must fail if the provided value for CKA_CLASS in input template cannot be supported in generated object (385 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TOKEN in input template cannot be supported in generated object (210 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE in input template cannot be supported in generated object (210 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LABEL in input template cannot be supported in generated object (3115 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_VALUE in input template cannot be supported in generated object (210 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TRUSTED in input template cannot be supported in generated object (245 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_TYPE in input template cannot be supported in generated object (665 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SUBJECT in input template cannot be supported in generated object (untested after 352473 tests)
  • -- : Call must fail if the provided value for CKA_ID in input template cannot be supported in generated object (untested after 352473 tests)
  • 100%: Call must fail if the provided value for CKA_SENSITIVE in input template cannot be supported in generated object (210 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ENCRYPT in input template cannot be supported in generated object (210 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_DECRYPT in input template cannot be supported in generated object (210 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_WRAP in input template cannot be supported in generated object (210 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_UNWRAP in input template cannot be supported in generated object (210 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_SIGN in input template cannot be supported in generated object (210 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SIGN_RECOVER in input template cannot be supported in generated object (untested after 352473 tests)
  • 100%: Call must fail if the provided value for CKA_VERIFY in input template cannot be supported in generated object (210 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_VERIFY_RECOVER in input template cannot be supported in generated object (untested after 352473 tests)
  • 100%: Call must fail if the provided value for CKA_DERIVE in input template cannot be supported in generated object (210 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_MODULUS in input template cannot be supported in generated object (untested after 352473 tests)
  • -- : Call must fail if the provided value for CKA_MODULUS_BITS in input template cannot be supported in generated object (untested after 352473 tests)
  • -- : Call must fail if the provided value for CKA_PUBLIC_EXPONENT in input template cannot be supported in generated object (untested after 352473 tests)
  • -- : Call must fail if the provided value for CKA_PRIVATE_EXPONENT in input template cannot be supported in generated object (untested after 352473 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_1 in input template cannot be supported in generated object (untested after 352473 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_2 in input template cannot be supported in generated object (untested after 352473 tests)
  • -- : Call must fail if the provided value for CKA_EXPONENT_1 in input template cannot be supported in generated object (untested after 352473 tests)
  • -- : Call must fail if the provided value for CKA_EXPONENT_2 in input template cannot be supported in generated object (untested after 352473 tests)
  • -- : Call must fail if the provided value for CKA_COEFFICIENT in input template cannot be supported in generated object (untested after 352473 tests)
  • -- : Call must fail if the provided value for CKA_PRIME in input template cannot be supported in generated object (untested after 352473 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME in input template cannot be supported in generated object (untested after 352473 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_BITS in input template cannot be supported in generated object (untested after 352473 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME_BITS in input template cannot be supported in generated object (untested after 352473 tests)
  • 100%: Call must fail if the provided value for CKA_VALUE_LEN in input template cannot be supported in generated object (1779 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXTRACTABLE in input template cannot be supported in generated object (210 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LOCAL in input template cannot be supported in generated object (300 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_NEVER_EXTRACTABLE in input template cannot be supported in generated object (300 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ALWAYS_SENSITIVE in input template cannot be supported in generated object (300 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_GEN_MECHANISM in input template cannot be supported in generated object (900 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODIFIABLE in input template cannot be supported in generated object (210 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_EC_PARAMS in input template cannot be supported in generated object (untested after 352473 tests)
  • -- : Call must fail if the provided value for CKA_EC_POINT in input template cannot be supported in generated object (untested after 352473 tests)
  • -- : Call must fail if the provided value for CKA_ALWAYS_AUTHENTICATE in input template cannot be supported in generated object (untested after 352473 tests)
  • 100%: Call must fail if the provided value for CKA_WRAP_WITH_TRUSTED in input template cannot be supported in generated object (210 tests, 0 failed)

99 If a call to C_GenerateKeyPair cannot support the precise template supplied to it, it must fail and return without creating any object. Pass 0 105944

Reference: v2.20 s10.1.1 p63, s11.14 p174

If attributes do not match, an application may inadvertently create keys without adequate protection, or with excessive permissions

C_GenerateKeyPair: (105944 tests, 0 failed)

  • 100%: Call must fail if the provided value for CKA_CLASS in public template cannot be supported in generated public object (1389 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TOKEN in public template cannot be supported in generated public object (2586 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE in public template cannot be supported in generated public object (2586 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LABEL in public template cannot be supported in generated public object (19985 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_VALUE in public template cannot be supported in generated public object (untested after 63612 tests)
  • 100%: Call must fail if the provided value for CKA_TRUSTED in public template cannot be supported in generated public object (1354 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_TYPE in public template cannot be supported in generated public object (1459 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SUBJECT in public template cannot be supported in generated public object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_ID in public template cannot be supported in generated public object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_SENSITIVE in public template cannot be supported in generated public object (untested after 63612 tests)
  • 100%: Call must fail if the provided value for CKA_ENCRYPT in public template cannot be supported in generated public object (2586 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_DECRYPT in public template cannot be supported in generated public object (untested after 63612 tests)
  • 100%: Call must fail if the provided value for CKA_WRAP in public template cannot be supported in generated public object (2586 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_UNWRAP in public template cannot be supported in generated public object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_SIGN in public template cannot be supported in generated public object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_SIGN_RECOVER in public template cannot be supported in generated public object (untested after 63612 tests)
  • 100%: Call must fail if the provided value for CKA_VERIFY in public template cannot be supported in generated public object (2586 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_VERIFY_RECOVER in public template cannot be supported in generated public object (untested after 63612 tests)
  • 100%: Call must fail if the provided value for CKA_DERIVE in public template cannot be supported in generated public object (2586 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODULUS in public template cannot be supported in generated public object (19 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODULUS_BITS in public template cannot be supported in generated public object (4587 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PUBLIC_EXPONENT in public template cannot be supported in generated public object (4121 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_PRIVATE_EXPONENT in public template cannot be supported in generated public object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_1 in public template cannot be supported in generated public object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_2 in public template cannot be supported in generated public object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_EXPONENT_1 in public template cannot be supported in generated public object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_EXPONENT_2 in public template cannot be supported in generated public object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_COEFFICIENT in public template cannot be supported in generated public object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_PRIME in public template cannot be supported in generated public object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME in public template cannot be supported in generated public object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_BITS in public template cannot be supported in generated public object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME_BITS in public template cannot be supported in generated public object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_VALUE_LEN in public template cannot be supported in generated public object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_EXTRACTABLE in public template cannot be supported in generated public object (untested after 63612 tests)
  • 100%: Call must fail if the provided value for CKA_LOCAL in public template cannot be supported in generated public object (74 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_NEVER_EXTRACTABLE in public template cannot be supported in generated public object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_ALWAYS_SENSITIVE in public template cannot be supported in generated public object (untested after 63612 tests)
  • 100%: Call must fail if the provided value for CKA_KEY_GEN_MECHANISM in public template cannot be supported in generated public object (222 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODIFIABLE in public template cannot be supported in generated public object (2586 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EC_PARAMS in public template cannot be supported in generated public object (15274 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EC_POINT in public template cannot be supported in generated public object (18 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_ALWAYS_AUTHENTICATE in public template cannot be supported in generated public object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_WRAP_WITH_TRUSTED in public template cannot be supported in generated public object (untested after 63612 tests)
  • 100%: Call must fail if the provided value for CKA_CLASS in private template cannot be supported in generated private object (945 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TOKEN in private template cannot be supported in generated private object (2 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE in private template cannot be supported in generated private object (2 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LABEL in private template cannot be supported in generated private object (19985 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_VALUE in private template cannot be supported in generated private object (1842 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_TRUSTED in private template cannot be supported in generated private object (untested after 63612 tests)
  • 100%: Call must fail if the provided value for CKA_KEY_TYPE in private template cannot be supported in generated private object (1889 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SUBJECT in private template cannot be supported in generated private object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_ID in private template cannot be supported in generated private object (untested after 63612 tests)
  • 100%: Call must fail if the provided value for CKA_SENSITIVE in private template cannot be supported in generated private object (2 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_ENCRYPT in private template cannot be supported in generated private object (untested after 63612 tests)
  • 100%: Call must fail if the provided value for CKA_DECRYPT in private template cannot be supported in generated private object (2 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_WRAP in private template cannot be supported in generated private object (untested after 63612 tests)
  • 100%: Call must fail if the provided value for CKA_UNWRAP in private template cannot be supported in generated private object (2 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_SIGN in private template cannot be supported in generated private object (2 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SIGN_RECOVER in private template cannot be supported in generated private object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_VERIFY in private template cannot be supported in generated private object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_VERIFY_RECOVER in private template cannot be supported in generated private object (untested after 63612 tests)
  • 100%: Call must fail if the provided value for CKA_DERIVE in private template cannot be supported in generated private object (2 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODULUS in private template cannot be supported in generated private object (165 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_MODULUS_BITS in private template cannot be supported in generated private object (untested after 63612 tests)
  • 100%: Call must fail if the provided value for CKA_PUBLIC_EXPONENT in private template cannot be supported in generated private object (165 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE_EXPONENT in private template cannot be supported in generated private object (165 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIME_1 in private template cannot be supported in generated private object (165 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIME_2 in private template cannot be supported in generated private object (165 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXPONENT_1 in private template cannot be supported in generated private object (165 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXPONENT_2 in private template cannot be supported in generated private object (165 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_COEFFICIENT in private template cannot be supported in generated private object (165 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_PRIME in private template cannot be supported in generated private object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME in private template cannot be supported in generated private object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_BITS in private template cannot be supported in generated private object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME_BITS in private template cannot be supported in generated private object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_VALUE_LEN in private template cannot be supported in generated private object (untested after 63612 tests)
  • 100%: Call must fail if the provided value for CKA_EXTRACTABLE in private template cannot be supported in generated private object (2 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LOCAL in private template cannot be supported in generated private object (944 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_NEVER_EXTRACTABLE in private template cannot be supported in generated private object (944 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ALWAYS_SENSITIVE in private template cannot be supported in generated private object (944 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_GEN_MECHANISM in private template cannot be supported in generated private object (2832 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODIFIABLE in private template cannot be supported in generated private object (2 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EC_PARAMS in private template cannot be supported in generated private object (7675 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_EC_POINT in private template cannot be supported in generated private object (untested after 63612 tests)
  • -- : Call must fail if the provided value for CKA_ALWAYS_AUTHENTICATE in private template cannot be supported in generated private object (untested after 63612 tests)
  • 100%: Call must fail if the provided value for CKA_WRAP_WITH_TRUSTED in private template cannot be supported in generated private object (2 tests, 0 failed)

100 If a call to C_UnwrapKey cannot support the precise template supplied to it, it must fail and return without creating any object. Pass 0 9097

Reference: v2.20 s10.1.1 p63, s11.14 p174

If attributes do not match, an application may inadvertently create keys without adequate protection, or with excessive permissions

C_UnwrapKey: (9097 tests, 0 failed)

  • 100%: Call must fail if the provided value for CKA_CLASS in input template cannot be supported in unwrapped object (151 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TOKEN in input template cannot be supported in unwrapped object (100 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE in input template cannot be supported in unwrapped object (100 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LABEL in input template cannot be supported in unwrapped object (2582 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_VALUE in input template cannot be supported in unwrapped object (300 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TRUSTED in input template cannot be supported in unwrapped object (100 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_TYPE in input template cannot be supported in unwrapped object (2532 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SUBJECT in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • -- : Call must fail if the provided value for CKA_ID in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • 100%: Call must fail if the provided value for CKA_SENSITIVE in input template cannot be supported in unwrapped object (100 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ENCRYPT in input template cannot be supported in unwrapped object (100 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_DECRYPT in input template cannot be supported in unwrapped object (100 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_WRAP in input template cannot be supported in unwrapped object (100 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_UNWRAP in input template cannot be supported in unwrapped object (100 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_SIGN in input template cannot be supported in unwrapped object (100 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SIGN_RECOVER in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • 100%: Call must fail if the provided value for CKA_VERIFY in input template cannot be supported in unwrapped object (100 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_VERIFY_RECOVER in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • 100%: Call must fail if the provided value for CKA_DERIVE in input template cannot be supported in unwrapped object (100 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_MODULUS in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • -- : Call must fail if the provided value for CKA_MODULUS_BITS in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • -- : Call must fail if the provided value for CKA_PUBLIC_EXPONENT in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • -- : Call must fail if the provided value for CKA_PRIVATE_EXPONENT in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_1 in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_2 in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • -- : Call must fail if the provided value for CKA_EXPONENT_1 in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • -- : Call must fail if the provided value for CKA_EXPONENT_2 in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • -- : Call must fail if the provided value for CKA_COEFFICIENT in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • -- : Call must fail if the provided value for CKA_PRIME in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_BITS in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME_BITS in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • 100%: Call must fail if the provided value for CKA_VALUE_LEN in input template cannot be supported in unwrapped object (1532 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXTRACTABLE in input template cannot be supported in unwrapped object (100 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LOCAL in input template cannot be supported in unwrapped object (100 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_NEVER_EXTRACTABLE in input template cannot be supported in unwrapped object (100 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ALWAYS_SENSITIVE in input template cannot be supported in unwrapped object (100 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_GEN_MECHANISM in input template cannot be supported in unwrapped object (300 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODIFIABLE in input template cannot be supported in unwrapped object (100 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_EC_PARAMS in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • -- : Call must fail if the provided value for CKA_EC_POINT in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • -- : Call must fail if the provided value for CKA_ALWAYS_AUTHENTICATE in input template cannot be supported in unwrapped object (untested after 2582 tests)
  • 100%: Call must fail if the provided value for CKA_WRAP_WITH_TRUSTED in input template cannot be supported in unwrapped object (100 tests, 0 failed)

101 If a call to C_DeriveKey cannot support the precise template supplied to it, it must fail and return without creating any object. Pass 0 91839

Reference: v2.20 s10.1.1 p63, s11.14 p174

If attributes do not match, an application may inadvertently create keys without adequate protection, or with excessive permissions

C_DeriveKey: (91839 tests, 0 failed)

  • 100%: Call must fail if the provided value for CKA_CLASS in input template cannot be supported in derived key (29929 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TOKEN in input template cannot be supported in derived key (770 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE in input template cannot be supported in derived key (770 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LABEL in input template cannot be supported in derived key (30390 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_VALUE in input template cannot be supported in derived key (2766 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TRUSTED in input template cannot be supported in derived key (846 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_TYPE in input template cannot be supported in derived key (9600 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SUBJECT in input template cannot be supported in derived key (untested after 32518 tests)
  • -- : Call must fail if the provided value for CKA_ID in input template cannot be supported in derived key (untested after 32518 tests)
  • 100%: Call must fail if the provided value for CKA_SENSITIVE in input template cannot be supported in derived key (770 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ENCRYPT in input template cannot be supported in derived key (770 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_DECRYPT in input template cannot be supported in derived key (770 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_WRAP in input template cannot be supported in derived key (770 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_UNWRAP in input template cannot be supported in derived key (770 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_SIGN in input template cannot be supported in derived key (770 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SIGN_RECOVER in input template cannot be supported in derived key (untested after 32518 tests)
  • 100%: Call must fail if the provided value for CKA_VERIFY in input template cannot be supported in derived key (770 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_VERIFY_RECOVER in input template cannot be supported in derived key (untested after 32518 tests)
  • 100%: Call must fail if the provided value for CKA_DERIVE in input template cannot be supported in derived key (770 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_MODULUS in input template cannot be supported in derived key (untested after 32518 tests)
  • -- : Call must fail if the provided value for CKA_MODULUS_BITS in input template cannot be supported in derived key (untested after 32518 tests)
  • -- : Call must fail if the provided value for CKA_PUBLIC_EXPONENT in input template cannot be supported in derived key (untested after 32518 tests)
  • -- : Call must fail if the provided value for CKA_PRIVATE_EXPONENT in input template cannot be supported in derived key (untested after 32518 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_1 in input template cannot be supported in derived key (untested after 32518 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_2 in input template cannot be supported in derived key (untested after 32518 tests)
  • -- : Call must fail if the provided value for CKA_EXPONENT_1 in input template cannot be supported in derived key (untested after 32518 tests)
  • -- : Call must fail if the provided value for CKA_EXPONENT_2 in input template cannot be supported in derived key (untested after 32518 tests)
  • -- : Call must fail if the provided value for CKA_COEFFICIENT in input template cannot be supported in derived key (untested after 32518 tests)
  • -- : Call must fail if the provided value for CKA_PRIME in input template cannot be supported in derived key (untested after 32518 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME in input template cannot be supported in derived key (untested after 32518 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_BITS in input template cannot be supported in derived key (untested after 32518 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME_BITS in input template cannot be supported in derived key (untested after 32518 tests)
  • 100%: Call must fail if the provided value for CKA_VALUE_LEN in input template cannot be supported in derived key (2766 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXTRACTABLE in input template cannot be supported in derived key (770 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LOCAL in input template cannot be supported in derived key (922 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_NEVER_EXTRACTABLE in input template cannot be supported in derived key (922 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ALWAYS_SENSITIVE in input template cannot be supported in derived key (922 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_GEN_MECHANISM in input template cannot be supported in derived key (2766 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODIFIABLE in input template cannot be supported in derived key (770 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_EC_PARAMS in input template cannot be supported in derived key (untested after 32518 tests)
  • -- : Call must fail if the provided value for CKA_EC_POINT in input template cannot be supported in derived key (untested after 32518 tests)
  • -- : Call must fail if the provided value for CKA_ALWAYS_AUTHENTICATE in input template cannot be supported in derived key (untested after 32518 tests)
  • 100%: Call must fail if the provided value for CKA_WRAP_WITH_TRUSTED in input template cannot be supported in derived key (770 tests, 0 failed)

102 The value of the CKA_SENSITIVE and CKA_ALWAYS_SENSITIVE attribute for the base key affect the value that theses attribute can hold for the newly-derived key. Pass 0 2123

Reference: v2.20 s11.14 p174

Since derived key are generated from the value of the base key, a good management of these attribute is require to prevent leak of the base key.

C_DeriveKey: (2123 tests, 0 failed)

  • 100%: CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_DES_ECB_ENCRYPT_DATA. (324 tests, 0 failed)
  • 100%: CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_DES_ECB_ENCRYPT_DATA. (1 tests, 0 failed)
  • 100%: CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_DES_ECB_ENCRYPT_DATA. (1 tests, 0 failed)
  • 100%: CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_DES3_ECB_ENCRYPT_DATA. (324 tests, 0 failed)
  • 100%: CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_DES3_ECB_ENCRYPT_DATA. (1 tests, 0 failed)
  • 100%: CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_DES3_ECB_ENCRYPT_DATA. (1 tests, 0 failed)
  • 100%: CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_AES_ECB_ENCRYPT_DATA. (378 tests, 0 failed)
  • 100%: CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_AES_ECB_ENCRYPT_DATA. (2 tests, 0 failed)
  • 100%: CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_AES_ECB_ENCRYPT_DATA. (2 tests, 0 failed)
  • 100%: CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_DES_CBC_ENCRYPT_DATA. (324 tests, 0 failed)
  • 100%: CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_DES_CBC_ENCRYPT_DATA. (1 tests, 0 failed)
  • 100%: CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_DES_CBC_ENCRYPT_DATA. (1 tests, 0 failed)
  • 100%: CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_DES3_CBC_ENCRYPT_DATA. (324 tests, 0 failed)
  • 100%: CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_DES3_CBC_ENCRYPT_DATA. (1 tests, 0 failed)
  • 100%: CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_DES3_CBC_ENCRYPT_DATA. (1 tests, 0 failed)
  • 100%: CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_AES_CBC_ENCRYPT_DATA. (378 tests, 0 failed)
  • 100%: CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_AES_CBC_ENCRYPT_DATA. (2 tests, 0 failed)
  • 100%: CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_AES_CBC_ENCRYPT_DATA. (2 tests, 0 failed)
  • 100%: Call must fail if a new value of CKA_SENSITIVE is specified in input template when CKA_SENSITIVE is CK_TRUE in initial object when using CKM_CONCATENATE_BASE_AND_DATA. (11 tests, 0 failed)
  • -- : CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_CONCATENATE_BASE_AND_DATA. (untested after 32518 tests)
  • -- : CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_CONCATENATE_BASE_AND_DATA. (untested after 32518 tests)
  • -- : CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_CONCATENATE_BASE_AND_DATA. (untested after 32518 tests)
  • 100%: Call must fail if a new value of CKA_SENSITIVE is specified in input template when CKA_SENSITIVE is CK_TRUE in initial object when using CKM_CONCATENATE_DATA_AND_BASE. (11 tests, 0 failed)
  • -- : CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_CONCATENATE_DATA_AND_BASE. (untested after 32518 tests)
  • -- : CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_CONCATENATE_DATA_AND_BASE. (untested after 32518 tests)
  • -- : CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_CONCATENATE_DATA_AND_BASE. (untested after 32518 tests)
  • 100%: Call must fail if a new value of CKA_SENSITIVE is specified in input template when CKA_SENSITIVE is CK_TRUE in initial object when using CKM_XOR_BASE_AND_DATA. (22 tests, 0 failed)
  • -- : CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_XOR_BASE_AND_DATA. (untested after 32518 tests)
  • -- : CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_XOR_BASE_AND_DATA. (untested after 32518 tests)
  • -- : CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_XOR_BASE_AND_DATA. (untested after 32518 tests)
  • 100%: Call must fail if a new value of CKA_SENSITIVE is specified in input template when CKA_SENSITIVE is CK_TRUE in initial object when using CKM_EXTRACT_KEY_FROM_KEY. (11 tests, 0 failed)
  • -- : CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_EXTRACT_KEY_FROM_KEY. (untested after 32518 tests)
  • -- : CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_EXTRACT_KEY_FROM_KEY. (untested after 32518 tests)
  • -- : CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_EXTRACT_KEY_FROM_KEY. (untested after 32518 tests)

103 The value of the CKA_EXTRACTABLE and CKA_NEVER_EXTRACTABLE attribute for the base key affect the value that theses attribute can hold for the newly-derived key. Pass 0 3767

Reference: v2.20 s11.14 p174

Since derived key are generated from the value of the base key, a good management of these attribute is require to prevent leak of the base key.

C_DeriveKey: (3767 tests, 0 failed)

  • 100%: CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_DES_ECB_ENCRYPT_DATA. (12 tests, 0 failed)
  • 100%: CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_DES_ECB_ENCRYPT_DATA. (270 tests, 0 failed)
  • 100%: CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_DES_ECB_ENCRYPT_DATA. (270 tests, 0 failed)
  • 100%: CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_DES3_ECB_ENCRYPT_DATA. (12 tests, 0 failed)
  • 100%: CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_DES3_ECB_ENCRYPT_DATA. (270 tests, 0 failed)
  • 100%: CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_DES3_ECB_ENCRYPT_DATA. (270 tests, 0 failed)
  • 100%: CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_AES_ECB_ENCRYPT_DATA. (14 tests, 0 failed)
  • 100%: CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_AES_ECB_ENCRYPT_DATA. (324 tests, 0 failed)
  • 100%: CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_AES_ECB_ENCRYPT_DATA. (324 tests, 0 failed)
  • 100%: CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_DES_CBC_ENCRYPT_DATA. (12 tests, 0 failed)
  • 100%: CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_DES_CBC_ENCRYPT_DATA. (270 tests, 0 failed)
  • 100%: CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_DES_CBC_ENCRYPT_DATA. (270 tests, 0 failed)
  • 100%: CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_DES3_CBC_ENCRYPT_DATA. (12 tests, 0 failed)
  • 100%: CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_DES3_CBC_ENCRYPT_DATA. (270 tests, 0 failed)
  • 100%: CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_DES3_CBC_ENCRYPT_DATA. (270 tests, 0 failed)
  • 100%: CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_AES_CBC_ENCRYPT_DATA. (14 tests, 0 failed)
  • 100%: CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_AES_CBC_ENCRYPT_DATA. (324 tests, 0 failed)
  • 100%: CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_AES_CBC_ENCRYPT_DATA. (324 tests, 0 failed)
  • 100%: Call must fail if a new value of CKA_EXTRACTABLE is specified in input template when CKA_EXTRACTABLE is CK_FALSE in initial object when using CKM_CONCATENATE_BASE_AND_DATA. (47 tests, 0 failed)
  • -- : CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_CONCATENATE_BASE_AND_DATA. (untested after 32518 tests)
  • -- : CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_CONCATENATE_BASE_AND_DATA. (untested after 32518 tests)
  • -- : CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_CONCATENATE_BASE_AND_DATA. (untested after 32518 tests)
  • 100%: Call must fail if a new value of CKA_EXTRACTABLE is specified in input template when CKA_EXTRACTABLE is CK_FALSE in initial object when using CKM_CONCATENATE_DATA_AND_BASE. (47 tests, 0 failed)
  • -- : CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_CONCATENATE_DATA_AND_BASE. (untested after 32518 tests)
  • -- : CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_CONCATENATE_DATA_AND_BASE. (untested after 32518 tests)
  • -- : CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_CONCATENATE_DATA_AND_BASE. (untested after 32518 tests)
  • 100%: Call must fail if a new value of CKA_EXTRACTABLE is specified in input template when CKA_EXTRACTABLE is CK_FALSE in initial object when using CKM_XOR_BASE_AND_DATA. (94 tests, 0 failed)
  • -- : CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_XOR_BASE_AND_DATA. (untested after 32518 tests)
  • -- : CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_XOR_BASE_AND_DATA. (untested after 32518 tests)
  • -- : CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_XOR_BASE_AND_DATA. (untested after 32518 tests)
  • 100%: Call must fail if a new value of CKA_EXTRACTABLE is specified in input template when CKA_EXTRACTABLE is CK_FALSE in initial object when using CKM_EXTRACT_KEY_FROM_KEY. (47 tests, 0 failed)
  • -- : CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_EXTRACT_KEY_FROM_KEY. (untested after 32518 tests)
  • -- : CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_EXTRACT_KEY_FROM_KEY. (untested after 32518 tests)
  • -- : CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_EXTRACT_KEY_FROM_KEY. (untested after 32518 tests)

Untested

Number Criterion Risk level Failed tests Total tests
31 CKA_ALWAYS_SENSITIVE must be set to CK_FALSE on object unwrapped with C_UnwrapKey. High 0 0

Reference: v2.20 s11.14 p174

If the key material has come from outside the device, it cannot possibly be considered CKA_ALWAYS_SENSITIVE. A non compliant implementation would give a false measure of security.

C_UnwrapKey: (untested after 2582 tests)

  • -- : CKA_ALWAYS_SENSITIVE must be set to CK_FALSE in unwrapped object. (untested after 2582 tests)

39 CKA_NEVER_EXTRACTABLE must be set to CK_FALSE on object unwrapped with C_UnwrapKey. High 0 0

Reference: v2.20 s11.14 p174

If the key material has come from outside the device, it cannot possibly be considered CKA_NEVER_EXTRACTABLE. A non-compliant implementation would give a false measure of security.

C_UnwrapKey: (untested after 2582 tests)

  • -- : CKA_NEVER_EXTRACTABLE must be set to CK_FALSE in unwrapped object. (untested after 2582 tests)

87 CKA_VALUE cannot be revealed if private EC key has its CKA_SENSITIVE attribute set to CK_TRUE or its CKA_EXTRACTABLE attribute set to CK_FALSE. High 0 0

Reference: v2.20 s12.3.4 p218

If not compliant, device leaks the value of keys marked as CKA_SENSITIVE or un-EXTRACTABLE, breaking the security properties described in section 7 of the standard (see CVE-2010-3321).

C_GetAttributeValue: (untested after 47 tests)

  • -- : Call must fail when requesting for CKA_VALUE and attribute CKA_EXTRACTABLE is CK_FALSE when inspecting EC private key. (untested after 47 tests)
  • -- : Call must fail when requesting for CKA_VALUE and attribute CKA_SENSITIVE is CK_TRUE when inspecting EC private key. (untested after 47 tests)

93 C_UnwrapKey succeeds only if CKA_UNWRAP is set to CK_TRUE. High 0 0

Reference: v2.20 s11.14 p174

A non-compliance device would allow encrypted keys to be imported under a key-encrypting key which does not have the correct permissions.

C_UnwrapKey: (untested after 2582 tests)

  • -- : Call must fail if CKA_UNWRAP is not specified as CK_TRUE in unwrapping key. (untested after 2582 tests)

32 CKA_EXTRACTABLE default value is CK_TRUE on object unwrapped with C_UnwrapKey. Medium 0 0

Reference: v2.20 s11.14 p174

A non-compliant device marking keys generated outside the device as unextractable by default may give a misleading assurance of security.

C_UnwrapKey: (untested after 2582 tests)

  • -- : CKA_EXTRACTABLE must be set to CK_TRUE in unwrapped object when not specified in input template. (untested after 2582 tests)

43 CKA_MODULUS must not be specified when RSA private keys are unwrapped with C_UnwrapKey. Medium 0 0

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (untested after 2582 tests)

  • -- : Call must fail if CKA_MODULUS is specified in input template when unwrapping RSA private key. (untested after 2582 tests)

51 CKA_PUBLIC_EXPONENT must not be specified on RSA private keys unwrapped with C_UnwrapKey. Medium 0 0

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (untested after 2582 tests)

  • -- : Call must fail if CKA_PUBLIC_EXPONENT is specified in input template when unwrapping RSA private key. (untested after 2582 tests)

54 CKA_PRIVATE_EXPONENT must not be specified on RSA private keys unwrapped with C_UnwrapKey. Medium 0 0

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (untested after 2582 tests)

  • -- : Call must fail if CKA_PRIVATE_EXPONENT is specified in input template when unwrapping RSA private key. (untested after 2582 tests)

57 CKA_PRIME_1 must not be specified on RSA private keys unwrapped with C_UnwrapKey. Medium 0 0

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (untested after 2582 tests)

  • -- : Call must fail if CKA_PRIME_1 is specified in input template when unwrapping RSA private key. (untested after 2582 tests)

60 CKA_PRIME_2 must not be specified on RSA private keys unwrapped with C_UnwrapKey. Medium 0 0

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (untested after 2582 tests)

  • -- : Call must fail if CKA_PRIME_2 is specified in input template when unwrapping RSA private key. (untested after 2582 tests)

63 CKA_EXPONENT_1 must not be specified on RSA private keys unwrapped with C_UnwrapKey. Medium 0 0

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (untested after 2582 tests)

  • -- : Call must fail if CKA_EXPONENT_1 is specified in input template when unwrapping RSA private key. (untested after 2582 tests)

66 CKA_EXPONENT_2 must not be specified on RSA private keys unwrapped with C_UnwrapKey. Medium 0 0

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (untested after 2582 tests)

  • -- : Call must fail if CKA_EXPONENT_2 is specified in input template when unwrapping RSA private key. (untested after 2582 tests)

69 CKA_COEFFICIENT must not be specified on RSA private keys unwrapped with C_UnwrapKey. Medium 0 0

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (untested after 2582 tests)

  • -- : Call must fail if CKA_COEFFICIENT is specified in input template when unwrapping RSA private key. (untested after 2582 tests)

73 CKA_VALUE must not be specified when secret keys are unwrapped with C_UnwrapKey. Medium 0 0

Reference: v2.20 s12.12.2 p268, s12.13.2 p275, s12.13.3 p276, s12.13.4 p277, s12.13.5 p277, s12.13.6 p278, s12.13.7 p278, s12.15.2 p287, s12.15.3 p288, s12.16.2 p292, s12.17.2 p300, s12.18.2 p304

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (untested after 2582 tests)

  • -- : Call must fail if CKA_VALUE is specified in input template when unwrapping secret key. (untested after 2582 tests)

83 CKA_EC_PARAMS must not be specified when private EC keys are unwrapped with C_UnwrapKey. Medium 0 0

Reference: v2.20 s12.3.4 p218

The parameters should be obtained from the wrapped data, otherwise an invalid and/or insecure key may result.

C_UnwrapKey: (untested after 2582 tests)

  • -- : Call must fail if CKA_EC_PARAMS is specified in input template when unwrapping EC private key. (untested after 2582 tests)

86 CKA_VALUE must not be specified when private EC keys are unwrapped with C_UnwrapKey. Medium 0 0

Reference: v2.20 s12.3.4 p218

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (untested after 2582 tests)

  • -- : Call must fail if CKA_VALUE is specified in input template when unwrapping EC private key. (untested after 2582 tests)

Cryptosense Test Information

SoftHSM - Implementation of PKCS11 (V2.0), cryptoki (V2.30), flags : (none)
Slot ID Slot Information Token Information
0 Description: SoftHSM slot 0
Manufacturer ID: SoftHSM project
Flags: CKF_TOKEN_PRESENT
Hardware Version: 2.0
Firmware Version: 2.0
Label: My token 1
Serial Number: ec7dce574804a56b
Model: SoftHSM v2
Manufacturer ID: SoftHSM project
Pin Length Range: (4,255)
Max Session Count: CK_EFFECTIVELY_INFINITE
Max RW Session Count: CK_EFFECTIVELY_INFINITE
Flags: CKF_RNG | CKF_LOGIN_REQUIRED | CKF_USER_PIN_INITIALIZED | CKF_RESTORE_KEY_NOT_NEEDED | CKF_TOKEN_INITIALIZED
Hardware Version: 2.0
Firmware Version: 2.0
Supported mechanisms : 66
Mechanism Type Key Size Range ENCRYPT / DECRYPT SIGN / VERIFY WRAP / UNWRAP GENERATE + GENERATE_KEY_PAIR DIGEST DERIVE EC_F_P EC_NAMEDCURVE EC_UNCOMPRESS
19 (512,1024) ✔ / ✔
20 (512,1024) ✔ / ✔
21 (512,1024) ✔ / ✔
22 (512,1024) ✔ / ✔
4608 (0,0)
4609 (0,0) ✔ / ✔
4610 (0,0) ✔ / ✔
4624 (0,0)
4625 (0,0) ✔ / ✔
8457 (16,2147483648) ✔ / ✔
CKM_AES_CBC (16,32) ✔ / ✔
CKM_AES_CBC_ENCRYPT_DATA (0,0)
CKM_AES_CBC_PAD (16,32) ✔ / ✔
CKM_AES_ECB (16,32) ✔ / ✔
CKM_AES_ECB_ENCRYPT_DATA (0,0)
CKM_AES_KEY_GEN (16,32)
CKM_DES2_KEY_GEN (0,0)
CKM_DES3_CBC (0,0) ✔ / ✔
CKM_DES3_CBC_ENCRYPT_DATA (0,0)
CKM_DES3_CBC_PAD (0,0) ✔ / ✔
CKM_DES3_ECB (0,0) ✔ / ✔
CKM_DES3_ECB_ENCRYPT_DATA (0,0)
CKM_DES3_KEY_GEN (0,0)
CKM_DES_CBC (0,0) ✔ / ✔
CKM_DES_CBC_ENCRYPT_DATA (0,0)
CKM_DES_CBC_PAD (0,0) ✔ / ✔
CKM_DES_ECB (0,0) ✔ / ✔
CKM_DES_ECB_ENCRYPT_DATA (0,0)
CKM_DES_KEY_GEN (0,0)
CKM_DH_PKCS_DERIVE (512,10000)
CKM_DH_PKCS_KEY_PAIR_GEN (512,10000)
CKM_DH_PKCS_PARAMETER_GEN (512,10000)
CKM_DSA (512,1024) ✔ / ✔
CKM_DSA_KEY_PAIR_GEN (512,1024)
CKM_DSA_PARAMETER_GEN (512,1024)
CKM_DSA_SHA1 (512,1024) ✔ / ✔
CKM_ECDH1_DERIVE (112,521)
CKM_ECDSA (112,521) ✔ / ✔
CKM_EC_KEY_PAIR_GEN (112,521)
CKM_MD5 (0,0)
CKM_MD5_HMAC (0,0) ✔ / ✔
CKM_MD5_RSA_PKCS (512,16384) ✔ / ✔
CKM_RSA_PKCS (512,16384) ✔ / ✔ ✔ / ✔ ✔ / ✔
CKM_RSA_PKCS_KEY_PAIR_GEN (512,16384)
CKM_RSA_PKCS_OAEP (512,16384) ✔ / ✔ ✔ / ✔
CKM_RSA_X_509 (512,16384) ✔ / ✔ ✔ / ✔
CKM_SHA1_RSA_PKCS (512,16384) ✔ / ✔
CKM_SHA1_RSA_PKCS_PSS (512,16384) ✔ / ✔
CKM_SHA224 (0,0)
CKM_SHA224_HMAC (0,0) ✔ / ✔
CKM_SHA224_RSA_PKCS (512,16384) ✔ / ✔
CKM_SHA224_RSA_PKCS_PSS (512,16384) ✔ / ✔
CKM_SHA256 (0,0)
CKM_SHA256_HMAC (0,0) ✔ / ✔
CKM_SHA256_RSA_PKCS (512,16384) ✔ / ✔
CKM_SHA256_RSA_PKCS_PSS (512,16384) ✔ / ✔
CKM_SHA384 (0,0)
CKM_SHA384_HMAC (0,0) ✔ / ✔
CKM_SHA384_RSA_PKCS (512,16384) ✔ / ✔
CKM_SHA384_RSA_PKCS_PSS (512,16384) ✔ / ✔
CKM_SHA512 (0,0)
CKM_SHA512_HMAC (0,0) ✔ / ✔
CKM_SHA512_RSA_PKCS (512,16384) ✔ / ✔
CKM_SHA512_RSA_PKCS_PSS (512,16384) ✔ / ✔
CKM_SHA_1 (0,0)
CKM_SHA_1_HMAC (0,0) ✔ / ✔