Cryptosense Compliance Tester

2
Failed
HIGH RISK
criteria
6
Failed
MEDIUM RISK
criteria
0
Failed
LOW RISK
criteria
88
PASSED
criteria

Testing: IBM - Meta PKCS11 LIBRARY (V3.2), cryptoki (V2.20), slot index: 0
Expand all
Collapse all
Number Criterion Risk level Failed tests Total tests
30 CKA_ALWAYS_SENSITIVE must be set to CK_FALSE on object created with C_CreateObject. High 4186 21713

Reference: v2.20 s11.7 p128

If the key material has come from outside the device, it cannot possibly be considered CKA_ALWAYS_SENSITIVE. A non compliant implementation would give a false measure of security.

C_CreateObject: (21713 tests, 4186 failed)

  • 80%: CKA_ALWAYS_SENSITIVE must be set to CK_FALSE in created object when creating secret or private key. (21713 tests, 4186 failed)

38 CKA_NEVER_EXTRACTABLE must be set to CK_FALSE on object created with C_CreateObject. High 3320 21713

Reference: v2.20 s11.7 p128

If the key material has come from outside the device, it cannot possibly be considered CKA_NEVER_EXTRACTABLE. A non-compliant implementation would give a false measure of security.

C_CreateObject: (21713 tests, 3320 failed)

  • 84%: CKA_NEVER_EXTRACTABLE must be set to CK_FALSE in created object when creating secret or private key. (21713 tests, 3320 failed)

9 CKA_KEY_TYPE must be specified when object is unwrapped with C_UnwrapKey. Medium 3 46

Reference: v2.20 s10.7 p79

A non-compliant implementation may misinterpret given key material.

C_UnwrapKey: (46 tests, 3 failed)

  • 93%: Call must fail if CKA_KEY_TYPE is not specified in input template. (46 tests, 3 failed)

37 CKA_NEVER_EXTRACTABLE must be CK_TRUE if key has never had the CKA_EXTRACTABLE attribute set to CK_TRUE. Medium 354 161673

Reference: v2.20 s10.7 p79

If not compliant, CKA_NEVER_EXTRACTABLE may have a misleading value giving a false assessment of the security of a key.

C_GenerateKey: (73956 tests, 0 failed)

  • 100%: CKA_EXTRACTABLE is CK_TRUE in generated object implies CKA_NEVER_EXTRACTABLE is CK_FALSE in generated object. (67600 tests, 0 failed)
  • 100%: CKA_EXTRACTABLE is CK_FALSE in generated object implies CKA_NEVER_EXTRACTABLE is CK_TRUE in generated object. (6356 tests, 0 failed)

C_CopyObject: (36007 tests, 191 failed)

  • 100%: CKA_EXTRACTABLE is CK_TRUE in result object implies CKA_NEVER_EXTRACTABLE is CK_FALSE in result object when copying secret or private key. (28840 tests, 0 failed)
  • 100%: CKA_NEVER_EXTRACTABLE is CK_TRUE in result object implies CKA_NEVER_EXTRACTABLE is CK_TRUE in copied object when copying secret or private key. (3488 tests, 0 failed)
  • 94%: CKA_EXTRACTABLE is CK_FALSE in result object and CKA_NEVER_EXTRACTABLE is CK_TRUE in copied object implies CKA_NEVER_EXTRACTABLE is CK_TRUE in result object when copying secret or private key. (3679 tests, 191 failed)

C_SetAttributeValue: (21688 tests, 163 failed)

  • 100%: CKA_EXTRACTABLE is CK_TRUE in result object implies CKA_NEVER_EXTRACTABLE is CK_FALSE in result object when modifying secret or private key. (17289 tests, 0 failed)
  • 100%: CKA_NEVER_EXTRACTABLE is CK_TRUE in result object implies CKA_NEVER_EXTRACTABLE is CK_TRUE in initial object when modifying secret or private key. (2118 tests, 0 failed)
  • 92%: CKA_EXTRACTABLE is CK_FALSE in result object and CKA_NEVER_EXTRACTABLE is CK_TRUE in initial object implies CKA_NEVER_EXTRACTABLE is CK_TRUE in result object when modifying secret or private key. (2281 tests, 163 failed)

C_CreateObject: (18393 tests, 0 failed)

  • 100%: CKA_EXTRACTABLE is CK_TRUE in created object implies CKA_NEVER_EXTRACTABLE is CK_FALSE in created object when creating secret or private key. (18393 tests, 0 failed)

C_GenerateKeyPair: (8013 tests, 0 failed)

  • 100%: CKA_EXTRACTABLE is CK_TRUE in generated private object implies CKA_NEVER_EXTRACTABLE is CK_FALSE in generated private object. (7337 tests, 0 failed)
  • 100%: CKA_EXTRACTABLE is CK_FALSE in generated private object implies CKA_NEVER_EXTRACTABLE is CK_TRUE in generated private object. (676 tests, 0 failed)

C_UnwrapKey: (3616 tests, 0 failed)

  • 100%: CKA_EXTRACTABLE is CK_TRUE in unwrapped object implies CKA_NEVER_EXTRACTABLE is CK_FALSE in unwrapped object when unwrapping secret or private key. (3616 tests, 0 failed)

75 CKA_VALUE_LEN must not be specified when AES secret keys are created with C_CreateObject. Medium 2665 4015

Reference: v2.20 s12.12.2 p268

Length of key should be obtained from key material, otherwise an insecure key may result.

C_CreateObject: (4015 tests, 2665 failed)

  • 33%: Call must fail if CKA_VALUE_LEN is specified in input template when creating AES key. (4015 tests, 2665 failed)

77 CKA_VALUE_LEN must not be specified when AES secret keys are unwrapped with C_UnwrapKey. Medium 2138 3302

Reference: v2.20 s12.12.2 p268

Length of key should be obtained from key material, otherwise an insecure key may result.

C_UnwrapKey: (3302 tests, 2138 failed)

  • 35%: Call must fail if CKA_VALUE_LEN is specified in input template when unwrapping AES key. (3302 tests, 2138 failed)

98 If a call to C_GenerateKey cannot support the precise template supplied to it, it must fail and return without creating any object. Medium 5641 16806

Reference: v2.20 s10.1.1 p63, s11.14 p174

If attributes do not match, an application may inadvertently create keys without adequate protection, or with excessive permissions

C_GenerateKey: (16806 tests, 5641 failed)

  • 100%: Call must fail if the provided value for CKA_CLASS in input template cannot be supported in generated object (375 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TOKEN in input template cannot be supported in generated object (230 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE in input template cannot be supported in generated object (230 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LABEL in input template cannot be supported in generated object (3180 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_VALUE in input template cannot be supported in generated object (196 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TRUSTED in input template cannot be supported in generated object (280 tests, 0 failed)
  • 9%: Call must fail if the provided value for CKA_KEY_TYPE in input template cannot be supported in generated object (6231 tests, 5641 failed)
  • -- : Call must fail if the provided value for CKA_SUBJECT in input template cannot be supported in generated object (untested after 77136 tests)
  • -- : Call must fail if the provided value for CKA_ID in input template cannot be supported in generated object (untested after 77136 tests)
  • 100%: Call must fail if the provided value for CKA_SENSITIVE in input template cannot be supported in generated object (230 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ENCRYPT in input template cannot be supported in generated object (230 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_DECRYPT in input template cannot be supported in generated object (230 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_WRAP in input template cannot be supported in generated object (230 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_UNWRAP in input template cannot be supported in generated object (230 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_SIGN in input template cannot be supported in generated object (230 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SIGN_RECOVER in input template cannot be supported in generated object (untested after 77136 tests)
  • 100%: Call must fail if the provided value for CKA_VERIFY in input template cannot be supported in generated object (230 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_VERIFY_RECOVER in input template cannot be supported in generated object (untested after 77136 tests)
  • 100%: Call must fail if the provided value for CKA_DERIVE in input template cannot be supported in generated object (230 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_MODULUS in input template cannot be supported in generated object (untested after 77136 tests)
  • -- : Call must fail if the provided value for CKA_MODULUS_BITS in input template cannot be supported in generated object (untested after 77136 tests)
  • -- : Call must fail if the provided value for CKA_PUBLIC_EXPONENT in input template cannot be supported in generated object (untested after 77136 tests)
  • -- : Call must fail if the provided value for CKA_PRIVATE_EXPONENT in input template cannot be supported in generated object (untested after 77136 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_1 in input template cannot be supported in generated object (untested after 77136 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_2 in input template cannot be supported in generated object (untested after 77136 tests)
  • -- : Call must fail if the provided value for CKA_EXPONENT_1 in input template cannot be supported in generated object (untested after 77136 tests)
  • -- : Call must fail if the provided value for CKA_EXPONENT_2 in input template cannot be supported in generated object (untested after 77136 tests)
  • -- : Call must fail if the provided value for CKA_COEFFICIENT in input template cannot be supported in generated object (untested after 77136 tests)
  • -- : Call must fail if the provided value for CKA_PRIME in input template cannot be supported in generated object (untested after 77136 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME in input template cannot be supported in generated object (untested after 77136 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_BITS in input template cannot be supported in generated object (untested after 77136 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME_BITS in input template cannot be supported in generated object (untested after 77136 tests)
  • 100%: Call must fail if the provided value for CKA_VALUE_LEN in input template cannot be supported in generated object (1824 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXTRACTABLE in input template cannot be supported in generated object (230 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LOCAL in input template cannot be supported in generated object (280 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_NEVER_EXTRACTABLE in input template cannot be supported in generated object (280 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ALWAYS_SENSITIVE in input template cannot be supported in generated object (280 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_GEN_MECHANISM in input template cannot be supported in generated object (840 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODIFIABLE in input template cannot be supported in generated object (230 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_EC_PARAMS in input template cannot be supported in generated object (untested after 77136 tests)
  • -- : Call must fail if the provided value for CKA_EC_POINT in input template cannot be supported in generated object (untested after 77136 tests)
  • -- : Call must fail if the provided value for CKA_ALWAYS_AUTHENTICATE in input template cannot be supported in generated object (untested after 77136 tests)
  • 100%: Call must fail if the provided value for CKA_WRAP_WITH_TRUSTED in input template cannot be supported in generated object (280 tests, 0 failed)

100 If a call to C_UnwrapKey cannot support the precise template supplied to it, it must fail and return without creating any object. Medium 46 8420

Reference: v2.20 s10.1.1 p63, s11.14 p174

If attributes do not match, an application may inadvertently create keys without adequate protection, or with excessive permissions

C_UnwrapKey: (8420 tests, 46 failed)

  • 100%: Call must fail if the provided value for CKA_CLASS in input template cannot be supported in unwrapped object (1119 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TOKEN in input template cannot be supported in unwrapped object (46 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE in input template cannot be supported in unwrapped object (46 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LABEL in input template cannot be supported in unwrapped object (2238 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_VALUE in input template cannot be supported in unwrapped object (240 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TRUSTED in input template cannot be supported in unwrapped object (80 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_TYPE in input template cannot be supported in unwrapped object (2195 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SUBJECT in input template cannot be supported in unwrapped object (untested after 5854 tests)
  • -- : Call must fail if the provided value for CKA_ID in input template cannot be supported in unwrapped object (untested after 5854 tests)
  • 75%: Call must fail if the provided value for CKA_SENSITIVE in input template cannot be supported in unwrapped object (92 tests, 23 failed)
  • 100%: Call must fail if the provided value for CKA_ENCRYPT in input template cannot be supported in unwrapped object (40 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_DECRYPT in input template cannot be supported in unwrapped object (46 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_WRAP in input template cannot be supported in unwrapped object (40 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_UNWRAP in input template cannot be supported in unwrapped object (46 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_SIGN in input template cannot be supported in unwrapped object (46 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SIGN_RECOVER in input template cannot be supported in unwrapped object (untested after 5854 tests)
  • 100%: Call must fail if the provided value for CKA_VERIFY in input template cannot be supported in unwrapped object (40 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_VERIFY_RECOVER in input template cannot be supported in unwrapped object (untested after 5854 tests)
  • 100%: Call must fail if the provided value for CKA_DERIVE in input template cannot be supported in unwrapped object (46 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODULUS in input template cannot be supported in unwrapped object (12 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_MODULUS_BITS in input template cannot be supported in unwrapped object (untested after 5854 tests)
  • 100%: Call must fail if the provided value for CKA_PUBLIC_EXPONENT in input template cannot be supported in unwrapped object (6 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE_EXPONENT in input template cannot be supported in unwrapped object (12 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIME_1 in input template cannot be supported in unwrapped object (12 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIME_2 in input template cannot be supported in unwrapped object (12 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXPONENT_1 in input template cannot be supported in unwrapped object (12 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXPONENT_2 in input template cannot be supported in unwrapped object (12 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_COEFFICIENT in input template cannot be supported in unwrapped object (12 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_PRIME in input template cannot be supported in unwrapped object (untested after 5854 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME in input template cannot be supported in unwrapped object (untested after 5854 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_BITS in input template cannot be supported in unwrapped object (untested after 5854 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME_BITS in input template cannot be supported in unwrapped object (untested after 5854 tests)
  • 100%: Call must fail if the provided value for CKA_VALUE_LEN in input template cannot be supported in unwrapped object (1188 tests, 0 failed)
  • 75%: Call must fail if the provided value for CKA_EXTRACTABLE in input template cannot be supported in unwrapped object (92 tests, 23 failed)
  • 100%: Call must fail if the provided value for CKA_LOCAL in input template cannot be supported in unwrapped object (92 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_NEVER_EXTRACTABLE in input template cannot be supported in unwrapped object (92 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ALWAYS_SENSITIVE in input template cannot be supported in unwrapped object (92 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_GEN_MECHANISM in input template cannot be supported in unwrapped object (276 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODIFIABLE in input template cannot be supported in unwrapped object (46 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_EC_PARAMS in input template cannot be supported in unwrapped object (untested after 5854 tests)
  • -- : Call must fail if the provided value for CKA_EC_POINT in input template cannot be supported in unwrapped object (untested after 5854 tests)
  • -- : Call must fail if the provided value for CKA_ALWAYS_AUTHENTICATE in input template cannot be supported in unwrapped object (untested after 5854 tests)
  • 100%: Call must fail if the provided value for CKA_WRAP_WITH_TRUSTED in input template cannot be supported in unwrapped object (92 tests, 0 failed)

1 CKA_CLASS must be specified when object is created with C_CreateObject. Pass 0 166

Reference: v2.20 s10.2 p66

A non-compliant implementation may misinterpret given key material.

C_CreateObject: (166 tests, 0 failed)

  • 100%: Call must fail if CKA_CLASS is not specified in input template. (166 tests, 0 failed)

2 CKA_CLASS cannot be changed. Pass 0 7048

Reference: v2.20 s10.2 p66

A non-compliant implementation may misinterpret given key material.

C_CopyObject: (3738 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_CLASS is specified in input template. (3738 tests, 0 failed)

C_SetAttributeValue: (3310 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_CLASS is specified in input template. (3310 tests, 0 failed)

3 CKA_TOKEN default value is CK_FALSE. Pass 0 88040

Reference: v2.20 s10.4 p71

If default is CK_TRUE an application may inadvertently create persistant keys that could be exposed in a future session.

C_GenerateKey: (55929 tests, 0 failed)

  • 100%: CKA_TOKEN must be set to CK_FALSE in generated object when not specified in input template. (55929 tests, 0 failed)

C_GenerateKeyPair: (14551 tests, 0 failed)

  • 100%: CKA_TOKEN must be set to CK_FALSE in generated public object when not specified in public template. (7344 tests, 0 failed)
  • 100%: CKA_TOKEN must be set to CK_FALSE in generated private object when not specified in private template. (7207 tests, 0 failed)

C_CreateObject: (13990 tests, 0 failed)

  • 100%: CKA_TOKEN must be set to CK_FALSE in created object when not specified in input template. (13990 tests, 0 failed)

C_UnwrapKey: (3570 tests, 0 failed)

  • 100%: CKA_TOKEN must be set to CK_FALSE in unwrapped object when not specified in input template. (3570 tests, 0 failed)

C_CopyObject: (untested after 100338 tests)

  • -- : CKA_TOKEN must be set to CK_FALSE in result object when not specified in input template. (untested after 100338 tests)

C_DeriveKey: (untested after 29526 tests)

  • -- : CKA_TOKEN must be set to CK_FALSE in derived key when not specified in input template. (untested after 29526 tests)

4 CKA_TOKEN cannot be changed with C_SetAttributeValue. Pass 0 1655

Reference: v2.20 s10.4 p71

If non-compliant, the device may allow a session key to be preserved and exposed in a future session, or a token key to be inadvertently removed.

C_SetAttributeValue: (1655 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_TOKEN is specified in input template. (1655 tests, 0 failed)

5 CKA_PRIVATE cannot be changed with C_SetAttributeValue. Pass 0 1655

Reference: v2.20 s10.4 p71

If non-compliant, the device may allow a key which has been marked as CKA_PRIVATE in one session to be compromised in a future session.

C_SetAttributeValue: (1655 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_PRIVATE is specified in input template. (1655 tests, 0 failed)

6 CKA_MODIFIABLE default value is CK_TRUE. Pass 0 106106

Reference: v2.20 s10.4 p71

If not compliant, the application could generate a key that it cannot later protect (e.g. by marking as unextractable).

C_GenerateKey: (65572 tests, 0 failed)

  • 100%: CKA_MODIFIABLE must be set to CK_TRUE in generated object when not specified in input template. (65572 tests, 0 failed)

C_CreateObject: (21924 tests, 0 failed)

  • 100%: CKA_MODIFIABLE must be set to CK_TRUE in created object when not specified in input template. (21924 tests, 0 failed)

C_GenerateKeyPair: (15040 tests, 0 failed)

  • 100%: CKA_MODIFIABLE must be set to CK_TRUE in generated public object when not specified in public template. (7344 tests, 0 failed)
  • 100%: CKA_MODIFIABLE must be set to CK_TRUE in generated private object when not specified in private template. (7696 tests, 0 failed)

C_UnwrapKey: (3570 tests, 0 failed)

  • 100%: CKA_MODIFIABLE must be set to CK_TRUE in unwrapped object when not specified in input template. (3570 tests, 0 failed)

C_CopyObject: (untested after 100338 tests)

  • -- : CKA_MODIFIABLE must be set to CK_TRUE in result object when not specified in input template. (untested after 100338 tests)

C_DeriveKey: (untested after 29526 tests)

  • -- : CKA_MODIFIABLE must be set to CK_TRUE in derived key when not specified in input template. (untested after 29526 tests)

7 CKA_MODIFIABLE cannot be changed with C_SetAttributeValue. Pass 0 1655

Reference: v2.20 s10.4 p71

If non-compliant, the device may allow a key whose attributes have been set and protected in one session to be compromised in a future session.

C_SetAttributeValue: (1655 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_MODIFIABLE is specified in input template. (1655 tests, 0 failed)

8 CKA_KEY_TYPE must be specified when object is created with C_CreateObject. Pass 0 166

Reference: v2.20 s10.7 p79

A non-compliant implementation may misinterpret given key material.

C_CreateObject: (166 tests, 0 failed)

  • 100%: Call must fail if CKA_KEY_TYPE is not specified in input template. (166 tests, 0 failed)

10 CKA_KEY_TYPE cannot be changed. Pass 0 14096

Reference: v2.20 s10.7.2 p79

Changing key type could lead to an insecure use of key material.

C_CopyObject: (7476 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_KEY_TYPE is specified in input template. (7476 tests, 0 failed)

C_SetAttributeValue: (6620 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_KEY_TYPE is specified in input template. (6620 tests, 0 failed)

11 CKA_DERIVE default value is CK_FALSE. Pass 0 104639

Reference: v2.20 s10.7.2 p79

Inadvertently adding derive permission to an object can lead to deriviation of insecure keys.

C_GenerateKey: (65514 tests, 0 failed)

  • 100%: CKA_DERIVE must be set to CK_FALSE in generated object when not specified in input template. (65514 tests, 0 failed)

C_CreateObject: (21004 tests, 0 failed)

  • 100%: CKA_DERIVE must be set to CK_FALSE in created object when not specified in input template. (21004 tests, 0 failed)

C_GenerateKeyPair: (14551 tests, 0 failed)

  • 100%: CKA_DERIVE must be set to CK_FALSE in generated public object when not specified in public template. (7344 tests, 0 failed)
  • 100%: CKA_DERIVE must be set to CK_FALSE in generated private object when not specified in private template. (7207 tests, 0 failed)

C_UnwrapKey: (3570 tests, 0 failed)

  • 100%: CKA_DERIVE must be set to CK_FALSE in unwrapped object when not specified in input template. (3570 tests, 0 failed)

C_CopyObject: (untested after 100338 tests)

  • -- : CKA_DERIVE must be set to CK_FALSE in result object when not specified in input template. (untested after 100338 tests)

C_DeriveKey: (untested after 29526 tests)

  • -- : CKA_DERIVE must be set to CK_FALSE in derived key when not specified in input template. (untested after 29526 tests)

12 CKA_LOCAL must not be specified when object is created with C_CreateObject. Pass 0 332

Reference: v2.20 s10.7 p79

If not compliant, device may create keys marked as CKA_LOCAL using key material generated outside the device.

C_CreateObject: (332 tests, 0 failed)

  • 100%: Call must fail if CKA_LOCAL is specified in input template. (332 tests, 0 failed)

13 CKA_LOCAL must not be specified when object is generated with C_GenerateKey or C_GenerateKeyPair. Pass 0 578

Reference: v2.20 s10.7 p79

If not compliant, device may create keys marked as CKA_LOCAL using key material generated outside the device.

C_GenerateKeyPair: (298 tests, 0 failed)

  • 100%: Call must fail if CKA_LOCAL is specified in public template. (36 tests, 0 failed)
  • 100%: Call must fail if CKA_LOCAL is specified in private template. (262 tests, 0 failed)

C_GenerateKey: (280 tests, 0 failed)

  • 100%: Call must fail if CKA_LOCAL is specified in input template. (280 tests, 0 failed)

14 CKA_LOCAL must not be specified when object is unwrapped with C_UnwrapKey. Pass 0 92

Reference: v2.20 s10.7 p79

If not compliant, device may create keys marked as CKA_LOCAL using key material generated outside the device.

C_UnwrapKey: (92 tests, 0 failed)

  • 100%: Call must fail if CKA_LOCAL is specified in input template. (92 tests, 0 failed)

15 CKA_LOCAL is CK_TRUE only if key was generated locally or is a copy of a key which had its CKA_LOCAL attribute set to CK_TRUE. Pass 0 151791

Reference: v2.20 s10.7 p79, s11.14 p174

If not compliant, device may contain keys marked as CKA_LOCAL using key material generated outside the device.

C_GenerateKey: (73956 tests, 0 failed)

  • 100%: CKA_LOCAL must be set to CK_TRUE in generated object. (73956 tests, 0 failed)

C_CopyObject: (34797 tests, 0 failed)

  • 100%: CKA_LOCAL must have the same value in copied object and result object. (34797 tests, 0 failed)

C_CreateObject: (23396 tests, 0 failed)

  • 100%: CKA_LOCAL must be set to CK_FALSE in created object. (23396 tests, 0 failed)

C_GenerateKeyPair: (16026 tests, 0 failed)

  • 100%: CKA_LOCAL must be set to CK_TRUE in generated public object. (8013 tests, 0 failed)
  • 100%: CKA_LOCAL must be set to CK_TRUE in generated private object. (8013 tests, 0 failed)

C_UnwrapKey: (3616 tests, 0 failed)

  • 100%: CKA_LOCAL must be set to CK_FALSE in unwrapped object. (3616 tests, 0 failed)

C_DeriveKey: (untested after 29526 tests)

  • -- : CKA_LOCAL must be set to CK_FALSE in derived key. (untested after 29526 tests)

16 CKA_LOCAL cannot be modified. Pass 0 3524

Reference: v2.20 s10.7 p79, s11.7 p128

If not compliant, device may contain keys marked as CKA_LOCAL using key material generated outside the device.

C_CopyObject: (1869 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_LOCAL is specified in input template. (1869 tests, 0 failed)

C_SetAttributeValue: (1655 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_LOCAL is specified in input template. (1655 tests, 0 failed)

17 CKA_KEY_GEN_MECHANISM must not be specified when object is created with C_CreateObject. Pass 0 996

Reference: v2.20 s10.7 p79

The mechanism cannot be known for externally generated key material.

C_CreateObject: (996 tests, 0 failed)

  • 100%: Call must fail if CKA_KEY_GEN_MECHANISM is specified in input template. (996 tests, 0 failed)

18 CKA_KEY_GEN_MECHANISM must not be specified when object is generated with C_GenerateKey or C_GenerateKeyPair. Pass 0 1734

Reference: v2.20 s10.7 p79

The mechanism cannot be known for externally generated key material.

C_GenerateKeyPair: (894 tests, 0 failed)

  • 100%: Call must fail if CKA_KEY_GEN_MECHANISM is specified in public template. (108 tests, 0 failed)
  • 100%: Call must fail if CKA_KEY_GEN_MECHANISM is specified in private template. (786 tests, 0 failed)

C_GenerateKey: (840 tests, 0 failed)

  • 100%: Call must fail if CKA_KEY_GEN_MECHANISM is specified in input template. (840 tests, 0 failed)

19 CKA_KEY_GEN_MECHANISM must not be specified when object is unwrapped with C_UnwrapKey. Pass 0 276

Reference: v2.20 s10.7 p79

The mechanism cannot be known for externally generated key material.

C_UnwrapKey: (276 tests, 0 failed)

  • 100%: Call must fail if CKA_KEY_GEN_MECHANISM is specified in input template. (276 tests, 0 failed)

22 CKA_TRUSTED can only be set to CK_TRUE by the SO user. Pass 0 3450

Reference: v2.20 s10.2 p66, s10.6.2 p73, s10.8 p81, s10.10 p84

If not compliant, a compromised session could set the CKA_TRUSTED attribute, causing untrusted certificates to be treated as trusted, and CKA_WRAP_WITH_TRUSTED keys could be wrapped under untrusted ones.

C_CopyObject: (1359 tests, 0 failed)

  • 100%: Call must fail if CKA_TRUSTED is specified as CK_TRUE in input template and is not CK_TRUE in copied object when copying secret or public key. (1359 tests, 0 failed)

C_SetAttributeValue: (1355 tests, 0 failed)

  • 100%: Call must fail if CKA_TRUSTED is specified as CK_TRUE in input template and is not CK_TRUE in initial object when modifying secret or public key. (1355 tests, 0 failed)

C_DeriveKey: (399 tests, 0 failed)

  • 100%: Call must fail if CKA_TRUSTED is specified as CK_TRUE in input template and is not CK_TRUE in base key. (399 tests, 0 failed)

C_CreateObject: (159 tests, 0 failed)

  • 100%: Call must fail if CKA_TRUSTED is specified as CK_TRUE in input template when creating secret or public key. (159 tests, 0 failed)

C_GenerateKey: (140 tests, 0 failed)

  • 100%: Call must fail if CKA_TRUSTED is specified as CK_TRUE in input template. (140 tests, 0 failed)

C_UnwrapKey: (20 tests, 0 failed)

  • 100%: Call must fail if CKA_TRUSTED is specified as CK_TRUE in input template when unwrapping secret key. (20 tests, 0 failed)

C_GenerateKeyPair: (18 tests, 0 failed)

  • 100%: Call must fail if CKA_TRUSTED is specified as CK_TRUE in public template. (18 tests, 0 failed)

23 CKA_SENSITIVE cannot be changed once set to CK_TRUE. Pass 0 388

Reference: v2.20 s10.9 p82, s10.10 p84

If CKA_SENSITIVE can be changed to CK_FALSE, a previously protected key can be read by the GetAttribute command, directly breaking the security properties described in section 7 of the standard.

C_CopyObject: (203 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_SENSITIVE is specified in input template when CKA_SENSITIVE is CK_TRUE in initial object when copying secret or private key. (203 tests, 0 failed)

C_SetAttributeValue: (185 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_SENSITIVE is specified in input template when CKA_SENSITIVE is CK_TRUE in initial object when modifying secret or private key. (185 tests, 0 failed)

24 CKA_ALWAYS_SENSITIVE must not be specified when object is created with C_CreateObject. Pass 0 270

Reference: v2.20 s10.9 p82, s10.10 p84

If not compliant, CKA_ALWAYS_SENSITIVE may be set with a misleading value giving a false assessment of security of a key.

C_CreateObject: (270 tests, 0 failed)

  • 100%: Call must fail if CKA_ALWAYS_SENSITIVE is specified in input template when creating secret or private key. (270 tests, 0 failed)

25 CKA_ALWAYS_SENSITIVE must not be specified when object is generated with C_GenerateKey or C_GenerateKeyPair. Pass 0 542

Reference: v2.20 s10.9 p82, s10.10 p84

If not compliant, CKA_ALWAYS_SENSITIVE may be set with a misleading value giving a false assessment of security of a key.

C_GenerateKey: (280 tests, 0 failed)

  • 100%: Call must fail if CKA_ALWAYS_SENSITIVE is specified in input template. (280 tests, 0 failed)

C_GenerateKeyPair: (262 tests, 0 failed)

  • 100%: Call must fail if CKA_ALWAYS_SENSITIVE is specified in private template. (262 tests, 0 failed)

26 CKA_ALWAYS_SENSITIVE must not be specified when object is unwrapped with C_UnwrapKey. Pass 0 92

Reference: v2.20 s10.9 p82, s10.10 p84

If not compliant, CKA_ALWAYS_SENSITIVE may be set with a misleading value giving a false assessment of security of a key.

C_UnwrapKey: (92 tests, 0 failed)

  • 100%: Call must fail if CKA_ALWAYS_SENSITIVE is specified in input template. (92 tests, 0 failed)

27 CKA_ALWAYS_SENSITIVE cannot be changed. Pass 0 3434

Reference: v2.20 s10.9 p82

If not compliant, CKA_ALWAYS_SENSITIVE may be set with a misleading value giving a false assessment of security of a key.

C_CopyObject: (1824 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_ALWAYS_SENSITIVE is specified in input template when copying secret or private key. (1824 tests, 0 failed)

C_SetAttributeValue: (1610 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_ALWAYS_SENSITIVE is specified in input template when modifying secret or private key. (1610 tests, 0 failed)

28 CKA_EXTRACTABLE cannot be changed once set to CK_FALSE. Pass 0 360

Reference: v2.20 s10.9 p82, s10.10 p84

If CKA_EXTRACTABLE can be changed to CK_TRUE, a previously protected key can be exported, directly breaking the security properties described in section 7 of the standard.

C_CopyObject: (191 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_EXTRACTABLE is specified in input template when CKA_EXTRACTABLE is CK_FALSE in initial object when copying secret or private key. (191 tests, 0 failed)

C_SetAttributeValue: (169 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_EXTRACTABLE is specified in input template when CKA_EXTRACTABLE is CK_FALSE in initial object when modifying secret or private key. (169 tests, 0 failed)

29 CKA_ALWAYS_SENSITIVE must be CK_TRUE if key has always had the CKA_SENSITIVE attribute set to CK_TRUE. Pass 0 161721

Reference: v2.20 s10.9 p82, s10.10 p84

If not compliant, CKA_ALWAYS_SENSITIVE may have a misleading value giving a false assessment of the security of a key.

C_GenerateKey: (73956 tests, 0 failed)

  • 100%: CKA_SENSITIVE is CK_FALSE in generated object implies CKA_ALWAYS_SENSITIVE is CK_FALSE in generated object. (67542 tests, 0 failed)
  • 100%: CKA_SENSITIVE is CK_TRUE in generated object implies CKA_ALWAYS_SENSITIVE is CK_TRUE in generated object. (6414 tests, 0 failed)

C_CopyObject: (36486 tests, 0 failed)

  • 100%: CKA_SENSITIVE is CK_FALSE in result object implies CKA_ALWAYS_SENSITIVE is CK_FALSE in result object when copying secret or private key. (28576 tests, 0 failed)
  • 100%: CKA_ALWAYS_SENSITIVE is CK_TRUE in result object implies CKA_ALWAYS_SENSITIVE is CK_TRUE in copied object when copying secret or private key. (3955 tests, 0 failed)
  • 100%: CKA_SENSITIVE is CK_TRUE in result object and CKA_ALWAYS_SENSITIVE is CK_TRUE in copied object implies CKA_ALWAYS_SENSITIVE is CK_TRUE in result object when copying secret or private key. (3955 tests, 0 failed)

C_SetAttributeValue: (22123 tests, 0 failed)

  • 100%: CKA_SENSITIVE is CK_FALSE in result object implies CKA_ALWAYS_SENSITIVE is CK_FALSE in result object when modifying secret or private key. (17049 tests, 0 failed)
  • 100%: CKA_ALWAYS_SENSITIVE is CK_TRUE in result object implies CKA_ALWAYS_SENSITIVE is CK_TRUE in initial object when modifying secret or private key. (2537 tests, 0 failed)
  • 100%: CKA_SENSITIVE is CK_TRUE in result object and CKA_ALWAYS_SENSITIVE is CK_TRUE in initial object implies CKA_ALWAYS_SENSITIVE is CK_TRUE in result object when modifying secret or private key. (2537 tests, 0 failed)

C_CreateObject: (17527 tests, 0 failed)

  • 100%: CKA_SENSITIVE is CK_FALSE in created object implies CKA_ALWAYS_SENSITIVE is CK_FALSE in created object when creating secret or private key. (17527 tests, 0 failed)

C_GenerateKeyPair: (8013 tests, 0 failed)

  • 100%: CKA_SENSITIVE is CK_FALSE in generated private object implies CKA_ALWAYS_SENSITIVE is CK_FALSE in generated private object. (7337 tests, 0 failed)
  • 100%: CKA_SENSITIVE is CK_TRUE in generated private object implies CKA_ALWAYS_SENSITIVE is CK_TRUE in generated private object. (676 tests, 0 failed)

C_UnwrapKey: (3616 tests, 0 failed)

  • 100%: CKA_SENSITIVE is CK_FALSE in unwrapped object implies CKA_ALWAYS_SENSITIVE is CK_FALSE in unwrapped object. (3616 tests, 0 failed)

31 CKA_ALWAYS_SENSITIVE must be set to CK_FALSE on object unwrapped with C_UnwrapKey. Pass 0 3616

Reference: v2.20 s11.14 p174

If the key material has come from outside the device, it cannot possibly be considered CKA_ALWAYS_SENSITIVE. A non compliant implementation would give a false measure of security.

C_UnwrapKey: (3616 tests, 0 failed)

  • 100%: CKA_ALWAYS_SENSITIVE must be set to CK_FALSE in unwrapped object. (3616 tests, 0 failed)

32 CKA_EXTRACTABLE default value is CK_TRUE on object unwrapped with C_UnwrapKey. Pass 0 3593

Reference: v2.20 s11.14 p174

A non-compliant device marking keys generated outside the device as unextractable by default may give a misleading assurance of security.

C_UnwrapKey: (3593 tests, 0 failed)

  • 100%: CKA_EXTRACTABLE must be set to CK_TRUE in unwrapped object when not specified in input template. (3593 tests, 0 failed)

33 CKA_NEVER_EXTRACTABLE must not be specified when object is created with C_CreateObject. Pass 0 270

Reference: v2.20 s10.9 p82, s10.10 p84

If not compliant, CKA_NEVER_EXTRACTABLE may be set with a misleading value giving a false assessment of security of a key.

C_CreateObject: (270 tests, 0 failed)

  • 100%: Call must fail if CKA_NEVER_EXTRACTABLE is specified in input template when creating secret or private key. (270 tests, 0 failed)

34 CKA_NEVER_EXTRACTABLE must not be specified when object is generated with C_GenerateKey or C_GenerateKeyPair. Pass 0 542

Reference: v2.20 s10.9 p82, s10.10 p84

If not compliant, CKA_NEVER_EXTRACTABLE may be set with a misleading value giving a false assessment of security of a key.

C_GenerateKey: (280 tests, 0 failed)

  • 100%: Call must fail if CKA_NEVER_EXTRACTABLE is specified in input template. (280 tests, 0 failed)

C_GenerateKeyPair: (262 tests, 0 failed)

  • 100%: Call must fail if CKA_NEVER_EXTRACTABLE is specified in private template. (262 tests, 0 failed)

35 CKA_NEVER_EXTRACTABLE must not be specified when object is unwrapped with C_UnwrapKey. Pass 0 92

Reference: v2.20 s10.9 p82, s10.10 p84

If not compliant, CKA_NEVER_EXTRACTABLE may be set with a misleading value giving a false assessment of security of a key.

C_UnwrapKey: (92 tests, 0 failed)

  • 100%: Call must fail if CKA_NEVER_EXTRACTABLE is specified in input template. (92 tests, 0 failed)

36 CKA_NEVER_EXTRACTABLE cannot be changed. Pass 0 3434

Reference: v2.20 s10.9 p82, s10.10 p84

If not compliant, CKA_NEVER_EXTRACTABLE may be set with a misleading value giving a false assessment of security of a key.

C_CopyObject: (1824 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_NEVER_EXTRACTABLE is specified in input template when copying secret or private key. (1824 tests, 0 failed)

C_SetAttributeValue: (1610 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_NEVER_EXTRACTABLE is specified in input template when modifying secret or private key. (1610 tests, 0 failed)

39 CKA_NEVER_EXTRACTABLE must be set to CK_FALSE on object unwrapped with C_UnwrapKey. Pass 0 3616

Reference: v2.20 s11.14 p174

If the key material has come from outside the device, it cannot possibly be considered CKA_NEVER_EXTRACTABLE. A non-compliant implementation would give a false measure of security.

C_UnwrapKey: (3616 tests, 0 failed)

  • 100%: CKA_NEVER_EXTRACTABLE must be set to CK_FALSE in unwrapped object. (3616 tests, 0 failed)

41 CKA_MODULUS must be specified when RSA keys are created with C_CreateObject. Pass 0 36

Reference: v2.20 s12.1.2 p193, s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a weak key.

C_CreateObject: (36 tests, 0 failed)

  • 100%: Call must fail if CKA_MODULUS is not specified in input template when creating RSA key. (36 tests, 0 failed)

42 CKA_MODULUS must not be specified when RSA keys are generated with C_GenerateKeyPair. Pass 0 147

Reference: v2.20 s12.1.2 p193, s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_GenerateKeyPair: (147 tests, 0 failed)

  • 100%: Call must fail if CKA_MODULUS is specified in public template when generating RSA keys . (17 tests, 0 failed)
  • 100%: Call must fail if CKA_MODULUS is specified in private template when generating RSA keys . (130 tests, 0 failed)

43 CKA_MODULUS must not be specified when RSA private keys are unwrapped with C_UnwrapKey. Pass 0 6

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (6 tests, 0 failed)

  • 100%: Call must fail if CKA_MODULUS is specified in input template when unwrapping RSA private key. (6 tests, 0 failed)

44 CKA_MODULUS cannot be changed. Pass 0 1186

Reference: v2.20 s12.1.2 p193

Alteration of key material may lead to loss of security.

C_CopyObject: (733 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_MODULUS is specified in input template when copying RSA key. (733 tests, 0 failed)

C_SetAttributeValue: (453 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_MODULUS is specified in input template when modifying RSA key. (453 tests, 0 failed)

45 CKA_MODULUS_BITS must be specified on public part when RSA keys are generated with C_GenerateKeyPair. Pass 0 17

Reference: v2.20 s12.1.2 p193

A non-compliant device would have ill-defined behavior.

C_GenerateKeyPair: (17 tests, 0 failed)

  • 100%: Call must fail if CKA_MODULUS_BITS is not specified in public template when generating RSA keys . (17 tests, 0 failed)

46 CKA_MODULUS_BITS must not be specified when RSA public key are created with C_CreateObject. Pass 0 30

Reference: v2.20 s12.1.2 p193

A non-compliant device would have ill-defined behavior.

C_CreateObject: (30 tests, 0 failed)

  • 100%: Call must fail if CKA_MODULUS_BITS is specified in input template when creating RSA public key. (30 tests, 0 failed)

47 CKA_MODULUS_BITS cannot be changed. Pass 0 90

Reference: v2.20 s12.1.2 p193

Alteration of key material may lead to loss of security.

C_SetAttributeValue: (45 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_MODULUS_BITS is specified in input template when modifying RSA public key. (45 tests, 0 failed)

C_CopyObject: (45 tests, 0 failed)

  • 100%: Call must fail if a new value of CKA_MODULUS_BITS is specified in input template when copying RSA public key. (45 tests, 0 failed)

48 CKA_PUBLIC_EXPONENT must be specified when RSA public keys are created with C_CreateObject. Pass 0 30

Reference: v2.20 s12.1.2 p193

A non-compliant device would have ill-defined behavior and may create a weak key.

C_CreateObject: (30 tests, 0 failed)

  • 100%: Call must fail if CKA_PUBLIC_EXPONENT is not specified in input template when creating RSA public key. (30 tests, 0 failed)

50 CKA_PUBLIC_EXPONENT must not be specified on private part when generating RSA keys with C_GenerateKeyPair. Pass 0 130

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_GenerateKeyPair: (130 tests, 0 failed)

  • 100%: Call must fail if CKA_PUBLIC_EXPONENT is specified in private template when generating RSA keys . (130 tests, 0 failed)

51 CKA_PUBLIC_EXPONENT must not be specified on RSA private keys unwrapped with C_UnwrapKey. Pass 0 3

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (3 tests, 0 failed)

  • 100%: Call must fail if CKA_PUBLIC_EXPONENT is specified in input template when unwrapping RSA private key. (3 tests, 0 failed)

52 CKA_PRIVATE_EXPONENT must be specified when RSA private keys are created with C_CreateObject. Pass 0 6

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a weak key.

C_CreateObject: (6 tests, 0 failed)

  • 100%: Call must fail if CKA_PRIVATE_EXPONENT is not specified in input template when creating RSA private key. (6 tests, 0 failed)

53 CKA_PRIVATE_EXPONENT must not be specified on private part when RSA private keys are generated with C_GenerateKeyPair. Pass 0 130

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_GenerateKeyPair: (130 tests, 0 failed)

  • 100%: Call must fail if CKA_PRIVATE_EXPONENT is specified in private template when generating RSA keys . (130 tests, 0 failed)

54 CKA_PRIVATE_EXPONENT must not be specified on RSA private keys unwrapped with C_UnwrapKey. Pass 0 6

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (6 tests, 0 failed)

  • 100%: Call must fail if CKA_PRIVATE_EXPONENT is specified in input template when unwrapping RSA private key. (6 tests, 0 failed)

55 CKA_PRIVATE_EXPONENT cannot be revealed if RSA private key has its CKA_SENSITIVE attribute set to CK_TRUE or its CKA_EXTRACTABLE attribute set to CK_FALSE. Pass 0 2

Reference: v2.20 s7 p30, s12.1.3 p194

If not compliant, device leaks the value of keys marked as CKA_SENSITIVE or un-EXTRACTABLE, breaking the security properties described in section 7 of the standard (see CVE-2010-3321)

C_GetAttributeValue: (2 tests, 0 failed)

  • 100%: Call must fail when requesting for CKA_PRIVATE_EXPONENT and attribute CKA_EXTRACTABLE is CK_FALSE when inspecting RSA private key. (1 tests, 0 failed)
  • 100%: Call must fail when requesting for CKA_PRIVATE_EXPONENT and attribute CKA_SENSITIVE is CK_TRUE when inspecting RSA private key. (1 tests, 0 failed)

56 CKA_PRIME_1 must not be specified on private part when RSA private keys are generated with C_GenerateKeyPair. Pass 0 130

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_GenerateKeyPair: (130 tests, 0 failed)

  • 100%: Call must fail if CKA_PRIME_1 is specified in private template when generating RSA keys . (130 tests, 0 failed)

57 CKA_PRIME_1 must not be specified on RSA private keys unwrapped with C_UnwrapKey. Pass 0 6

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (6 tests, 0 failed)

  • 100%: Call must fail if CKA_PRIME_1 is specified in input template when unwrapping RSA private key. (6 tests, 0 failed)

58 CKA_PRIME_1 cannot be revealed if RSA private key has its CKA_SENSITIVE attribute set to CK_TRUE or its CKA_EXTRACTABLE attribute set to CK_FALSE. Pass 0 2

Reference: v2.20 s7 p30, s12.1.3 p194

If not compliant, device leaks the value of keys marked as CKA_SENSITIVE or un-EXTRACTABLE, breaking the security properties described in section 7 of the standard (see CVE-2010-3321)

C_GetAttributeValue: (2 tests, 0 failed)

  • 100%: Call must fail when requesting for CKA_PRIME_1 and attribute CKA_EXTRACTABLE is CK_FALSE when inspecting RSA private key. (1 tests, 0 failed)
  • 100%: Call must fail when requesting for CKA_PRIME_1 and attribute CKA_SENSITIVE is CK_TRUE when inspecting RSA private key. (1 tests, 0 failed)

59 CKA_PRIME_2 must not be specified on private part when RSA private keys are generated with C_GenerateKeyPair. Pass 0 130

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_GenerateKeyPair: (130 tests, 0 failed)

  • 100%: Call must fail if CKA_PRIME_2 is specified in private template when generating RSA keys . (130 tests, 0 failed)

60 CKA_PRIME_2 must not be specified on RSA private keys unwrapped with C_UnwrapKey. Pass 0 6

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (6 tests, 0 failed)

  • 100%: Call must fail if CKA_PRIME_2 is specified in input template when unwrapping RSA private key. (6 tests, 0 failed)

61 CKA_PRIME_2 cannot be revealed if RSA private key has its CKA_SENSITIVE attribute set to CK_TRUE or its CKA_EXTRACTABLE attribute set to CK_FALSE. Pass 0 2

Reference: v2.20 s7 p30, s12.1.3 p194

If not compliant, device leaks the value of keys marked as CKA_SENSITIVE or un-EXTRACTABLE, breaking the security properties described in section 7 of the standard (see CVE-2010-3321)

C_GetAttributeValue: (2 tests, 0 failed)

  • 100%: Call must fail when requesting for CKA_PRIME_2 and attribute CKA_EXTRACTABLE is CK_FALSE when inspecting RSA private key. (1 tests, 0 failed)
  • 100%: Call must fail when requesting for CKA_PRIME_2 and attribute CKA_SENSITIVE is CK_TRUE when inspecting RSA private key. (1 tests, 0 failed)

62 CKA_EXPONENT_1 must not be specified on private part when RSA private keys are generated with C_GenerateKeyPair. Pass 0 130

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_GenerateKeyPair: (130 tests, 0 failed)

  • 100%: Call must fail if CKA_EXPONENT_1 is specified in private template when generating RSA keys . (130 tests, 0 failed)

63 CKA_EXPONENT_1 must not be specified on RSA private keys unwrapped with C_UnwrapKey. Pass 0 6

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (6 tests, 0 failed)

  • 100%: Call must fail if CKA_EXPONENT_1 is specified in input template when unwrapping RSA private key. (6 tests, 0 failed)

64 CKA_EXPONENT_1 cannot be revealed if RSA private key has its CKA_SENSITIVE attribute set to CK_TRUE or its CKA_EXTRACTABLE attribute set to CK_FALSE. Pass 0 2

Reference: v2.20 s7 p30, s12.1.3 p194

If not compliant, device leaks the value of keys marked as CKA_SENSITIVE or un-EXTRACTABLE, breaking the security properties described in section 7 of the standard (see CVE-2010-3321)

C_GetAttributeValue: (2 tests, 0 failed)

  • 100%: Call must fail when requesting for CKA_EXPONENT_1 and attribute CKA_EXTRACTABLE is CK_FALSE when inspecting RSA private key. (1 tests, 0 failed)
  • 100%: Call must fail when requesting for CKA_EXPONENT_1 and attribute CKA_SENSITIVE is CK_TRUE when inspecting RSA private key. (1 tests, 0 failed)

65 CKA_EXPONENT_2 must not be specified on private part when RSA private keys are generated with C_GenerateKeyPair. Pass 0 130

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_GenerateKeyPair: (130 tests, 0 failed)

  • 100%: Call must fail if CKA_EXPONENT_2 is specified in private template when generating RSA keys . (130 tests, 0 failed)

66 CKA_EXPONENT_2 must not be specified on RSA private keys unwrapped with C_UnwrapKey. Pass 0 6

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (6 tests, 0 failed)

  • 100%: Call must fail if CKA_EXPONENT_2 is specified in input template when unwrapping RSA private key. (6 tests, 0 failed)

67 CKA_EXPONENT_2 cannot be revealed if RSA private key has its CKA_SENSITIVE attribute set to CK_TRUE or its CKA_EXTRACTABLE attribute set to CK_FALSE. Pass 0 2

Reference: v2.20 s7 p30, s12.1.3 p194

If not compliant, device leaks the value of keys marked as CKA_SENSITIVE or un-EXTRACTABLE, breaking the security properties described in section 7 of the standard (see CVE-2010-3321)

C_GetAttributeValue: (2 tests, 0 failed)

  • 100%: Call must fail when requesting for CKA_EXPONENT_2 and attribute CKA_EXTRACTABLE is CK_FALSE when inspecting RSA private key. (1 tests, 0 failed)
  • 100%: Call must fail when requesting for CKA_EXPONENT_2 and attribute CKA_SENSITIVE is CK_TRUE when inspecting RSA private key. (1 tests, 0 failed)

68 CKA_COEFFICIENT must not be specified on private part when RSA private keys are generated with C_GenerateKeyPair. Pass 0 130

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_GenerateKeyPair: (130 tests, 0 failed)

  • 100%: Call must fail if CKA_COEFFICIENT is specified in private template when generating RSA keys . (130 tests, 0 failed)

69 CKA_COEFFICIENT must not be specified on RSA private keys unwrapped with C_UnwrapKey. Pass 0 6

Reference: v2.20 s12.1.3 p194

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (6 tests, 0 failed)

  • 100%: Call must fail if CKA_COEFFICIENT is specified in input template when unwrapping RSA private key. (6 tests, 0 failed)

70 CKA_COEFFICIENT cannot be revealed if RSA private key has its CKA_SENSITIVE attribute set to CK_TRUE or its CKA_EXTRACTABLE attribute set to CK_FALSE. Pass 0 2

Reference: v2.20 s7 p30, s12.1.3 p194

If not compliant, device leaks the value of keys marked as CKA_SENSITIVE or un-EXTRACTABLE, breaking the security properties described in section 7 of the standard (see CVE-2010-3321)

C_GetAttributeValue: (2 tests, 0 failed)

  • 100%: Call must fail when requesting for CKA_COEFFICIENT and attribute CKA_EXTRACTABLE is CK_FALSE when inspecting RSA private key. (1 tests, 0 failed)
  • 100%: Call must fail when requesting for CKA_COEFFICIENT and attribute CKA_SENSITIVE is CK_TRUE when inspecting RSA private key. (1 tests, 0 failed)

71 CKA_VALUE must be specified when secret keys are created with C_CreateObject. Pass 0 128

Reference: v2.20 s12.12.2 p268, s12.13.2 p275, s12.13.3 p276, s12.13.4 p277, s12.13.5 p277, s12.13.6 p278, s12.13.7 p278, s12.15.2 p287, s12.15.3 p288, s12.16.2 p292, s12.17.2 p300, s12.18.2 p304

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_CreateObject: (128 tests, 0 failed)

  • 100%: Call must fail if CKA_VALUE is not specified in input template when creating secret key. (128 tests, 0 failed)

72 CKA_VALUE must not be specified when secret keys are generated with C_GenerateKey. Pass 0 196

Reference: v2.20 s12.12.2 p268, s12.13.2 p275, s12.13.3 p276, s12.13.4 p277, s12.13.5 p277, s12.13.6 p278, s12.13.7 p278, s12.15.2 p287, s12.15.3 p288, s12.16.2 p292, s12.17.2 p300, s12.18.2 p304

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_GenerateKey: (196 tests, 0 failed)

  • 100%: Call must fail if CKA_VALUE is specified in input template. (196 tests, 0 failed)

73 CKA_VALUE must not be specified when secret keys are unwrapped with C_UnwrapKey. Pass 0 120

Reference: v2.20 s12.12.2 p268, s12.13.2 p275, s12.13.3 p276, s12.13.4 p277, s12.13.5 p277, s12.13.6 p278, s12.13.7 p278, s12.15.2 p287, s12.15.3 p288, s12.16.2 p292, s12.17.2 p300, s12.18.2 p304

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (120 tests, 0 failed)

  • 100%: Call must fail if CKA_VALUE is specified in input template when unwrapping secret key. (120 tests, 0 failed)

74 CKA_VALUE cannot be revealed if secret key has its CKA_SENSITIVE attribute set to CK_TRUE or its CKA_EXTRACTABLE attribute set to CK_FALSE. Pass 0 12

Reference: v2.20 s7 p30, s12.12.2 p268, s12.13.2 p275, s12.13.3 p276, s12.13.4 p277, s12.13.5 p277, s12.13.6 p278, s12.13.7 p278, s12.15.2 p287, s12.15.3 p288, s12.16.2 p292, s12.17.2 p300, s12.18.2 p304

If not compliant, device leaks the value of keys marked as CKA_SENSITIVE or un-EXTRACTABLE, breaking the security properties described in section 7 of the standard (see CVE-2010-3321).

C_GetAttributeValue: (12 tests, 0 failed)

  • 100%: Call must fail when requesting for CKA_VALUE and attribute CKA_EXTRACTABLE is CK_FALSE when inspecting secret key. (6 tests, 0 failed)
  • 100%: Call must fail when requesting for CKA_VALUE and attribute CKA_SENSITIVE is CK_TRUE when inspecting secret key. (6 tests, 0 failed)

76 CKA_VALUE_LEN must be specified when AES secret keys are generated with C_GenerateKey. Pass 0 84

Reference: v2.20 s12.12.2 p268

Insecure key material may result if length is not specified.

C_GenerateKey: (84 tests, 0 failed)

  • 100%: Call must fail if CKA_VALUE_LEN is not specified in input template when generating AES key . (84 tests, 0 failed)

78 CKA_EC_PARAMS must be specified when EC keys are created with C_CreateObject. Pass 0 68

Reference: v2.20 s12.3.3 p217, s12.3.4 p218

A non-compliant device would have ill-defined behavior and may create a weak key.

C_CreateObject: (68 tests, 0 failed)

  • 100%: Call must fail if CKA_EC_PARAMS is not specified in input template when creating EC key. (68 tests, 0 failed)

79 CKA_EC_PARAMS must be specified in public part when EC keys are generated with C_GenerateKeyPair. Pass 0 105

Reference: v2.20 s12.3.3 p217

A non-compliant device would have ill-defined behavior and may create a weak key.

C_GenerateKeyPair: (105 tests, 0 failed)

  • 100%: Call must fail if CKA_EC_PARAMS is not specified in public template when generating EC keys . (105 tests, 0 failed)

80 CKA_EC_POINT must be specified when public EC keys are created with C_CreateObject. Pass 0 50

Reference: v2.20 s12.3.3 p217

A non-compliant device would have ill-defined behavior and may create a weak key.

C_CreateObject: (50 tests, 0 failed)

  • 100%: Call must fail if CKA_EC_POINT is not specified in input template when creating EC public key. (50 tests, 0 failed)

81 CKA_EC_POINT must not be specified when EC keys are generated with C_GenerateKeyPair. Pass 0 1

Reference: v2.20 s12.3.3 p217

A non-compliant device would have ill-defined behavior and may create a weak key.

C_GenerateKeyPair: (1 tests, 0 failed)

  • 100%: Call must fail if CKA_EC_POINT is specified in public template when generating EC keys . (1 tests, 0 failed)
  • -- : Call must fail if CKA_EC_POINT is specified in private template when generating EC keys . (untested after 12100 tests)

82 CKA_EC_PARAMS must not be specified in private part when EC keys are generated with C_GenerateKeyPair. Pass 0 25

Reference: v2.20 s12.3.4 p218

The value of this field is taken from the public key template. If specified twice, there is a chance of an inconsistency that could lead to an invalid and/or insecure key.

C_GenerateKeyPair: (25 tests, 0 failed)

  • 100%: Call must fail if CKA_EC_PARAMS is specified in private template when generating EC keys . (25 tests, 0 failed)

84 CKA_VALUE must be specified when private EC keys are created with C_CreateObject. Pass 0 59

Reference: v2.20 s12.3.4 p218

Without a value, the call is ambiguous and may result in the creation of an insecure key.

C_CreateObject: (59 tests, 0 failed)

  • 100%: Call must fail if CKA_VALUE is not specified in input template when creating EC private key. (59 tests, 0 failed)

85 CKA_VALUE must not be specified in private part when EC keys are generated with C_GenerateKeyPair. Pass 0 6

Reference: v2.20 s12.3.4 p218

The value should be randomly generated by the device. If a value is given, an insecure key may result.

C_GenerateKeyPair: (6 tests, 0 failed)

  • 100%: Call must fail if CKA_VALUE is specified in private template when generating EC keys . (6 tests, 0 failed)

88 C_EncryptInit only succeeds if CKA_ENCRYPT is set to CK_TRUE. Pass 0 222

Reference: v2.20 s11.8 p139

A non-compliant device would allow encryption to be carried out by a key which does not have the correct permission to do this operation.

C_Encrypt: (222 tests, 0 failed)

  • 100%: Call must fail if CKA_ENCRYPT is not specified as CK_TRUE in encryption key. (222 tests, 0 failed)

89 C_DecryptInit only succeeds if CKA_DECRYPT is set to CK_TRUE. Pass 0 356

Reference: v2.20 s11.9 p144

A non-compliant device would allow decryption to be carried out by a key which does not have the correct permission to do this operation.

C_Decrypt: (356 tests, 0 failed)

  • 100%: Call must fail if CKA_DECRYPT is not specified as CK_TRUE in decryption key. (356 tests, 0 failed)

90 C_SignInit only succeeds if CKA_SIGN is CK_TRUE. Pass 0 171

Reference: v2.20 s11.11 p152

A non-compliant device would allow signatures to be created by a key which does not have the correct permission to do this operation.

C_Sign: (171 tests, 0 failed)

  • 100%: Call must fail if CKA_SIGN is not specified as CK_TRUE in signing key. (171 tests, 0 failed)

91 C_VerifyInit succeeds only if CKA_VERIFY is CK_TRUE. Pass 0 72

Reference: v2.20 s11.12 p157

A non-compliant device would allow signature verification to be carried out by a key which does not have the correct permission to do this operation.

C_Verify: (72 tests, 0 failed)

  • 100%: Call must fail if CKA_VERIFY is not specified as CK_TRUE in verifying key. (72 tests, 0 failed)

92 C_WrapKey succeeds only if wrapping key has CKA_WRAP set to CK_TRUE. Pass 0 900

Reference: v2.20 s11.14 p174

A non-compliant device would allow a key to be wrapped under a key-encrypting key which does not have the correct permission.

C_WrapKey: (900 tests, 0 failed)

  • 100%: Call must fail if CKA_WRAP is not specified as CK_TRUE in wrapping key. (900 tests, 0 failed)

93 C_UnwrapKey succeeds only if CKA_UNWRAP is set to CK_TRUE. Pass 0 480

Reference: v2.20 s11.14 p174

A non-compliance device would allow encrypted keys to be imported under a key-encrypting key which does not have the correct permissions.

C_UnwrapKey: (480 tests, 0 failed)

  • 100%: Call must fail if CKA_UNWRAP is not specified as CK_TRUE in unwrapping key. (480 tests, 0 failed)

94 C_WrapKey succeeds only if wrapped key has CKA_EXTRACTABLE set to CK_TRUE. Pass 0 226

Reference: v2.20 s11.14 p174

A non-compliant device would allow keys marked as being unextractable to be exported from the device, breaking the security properties described in section 7 of the standard.

C_WrapKey: (226 tests, 0 failed)

  • 100%: Call must fail if CKA_EXTRACTABLE is not specified as CK_TRUE in wrapped key. (226 tests, 0 failed)

95 If a call to C_CreateObject cannot support the precise template supplied to it, it must fail and return without creating any object. Pass 0 20569

Reference: v2.20 s10.1.1 p63, s11.7 p128

If attributes do not match, an application may inadvertently create keys without adequate protection, or with excessive permissions

C_CreateObject: (20569 tests, 0 failed)

  • 100%: Call must fail if the provided value for CKA_CLASS in input template cannot be supported in created object (3058 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TOKEN in input template cannot be supported in created object (262 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE in input template cannot be supported in created object (262 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LABEL in input template cannot be supported in created object (3224 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_VALUE in input template cannot be supported in created object (2310 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TRUSTED in input template cannot be supported in created object (318 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_TYPE in input template cannot be supported in created object (3058 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SUBJECT in input template cannot be supported in created object (untested after 26620 tests)
  • -- : Call must fail if the provided value for CKA_ID in input template cannot be supported in created object (untested after 26620 tests)
  • 100%: Call must fail if the provided value for CKA_SENSITIVE in input template cannot be supported in created object (200 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ENCRYPT in input template cannot be supported in created object (252 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_DECRYPT in input template cannot be supported in created object (200 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_WRAP in input template cannot be supported in created object (252 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_UNWRAP in input template cannot be supported in created object (200 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_SIGN in input template cannot be supported in created object (200 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SIGN_RECOVER in input template cannot be supported in created object (untested after 26620 tests)
  • 100%: Call must fail if the provided value for CKA_VERIFY in input template cannot be supported in created object (252 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_VERIFY_RECOVER in input template cannot be supported in created object (untested after 26620 tests)
  • 100%: Call must fail if the provided value for CKA_DERIVE in input template cannot be supported in created object (262 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODULUS in input template cannot be supported in created object (636 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODULUS_BITS in input template cannot be supported in created object (118 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PUBLIC_EXPONENT in input template cannot be supported in created object (552 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE_EXPONENT in input template cannot be supported in created object (216 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIME_1 in input template cannot be supported in created object (132 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIME_2 in input template cannot be supported in created object (132 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXPONENT_1 in input template cannot be supported in created object (132 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXPONENT_2 in input template cannot be supported in created object (132 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_COEFFICIENT in input template cannot be supported in created object (132 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_PRIME in input template cannot be supported in created object (untested after 26620 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME in input template cannot be supported in created object (untested after 26620 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_BITS in input template cannot be supported in created object (untested after 26620 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME_BITS in input template cannot be supported in created object (untested after 26620 tests)
  • 100%: Call must fail if the provided value for CKA_VALUE_LEN in input template cannot be supported in created object (1425 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXTRACTABLE in input template cannot be supported in created object (200 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LOCAL in input template cannot be supported in created object (332 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_NEVER_EXTRACTABLE in input template cannot be supported in created object (270 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ALWAYS_SENSITIVE in input template cannot be supported in created object (270 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_GEN_MECHANISM in input template cannot be supported in created object (996 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODIFIABLE in input template cannot be supported in created object (262 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EC_PARAMS in input template cannot be supported in created object (50 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EC_POINT in input template cannot be supported in created object (2 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_ALWAYS_AUTHENTICATE in input template cannot be supported in created object (untested after 26620 tests)
  • 100%: Call must fail if the provided value for CKA_WRAP_WITH_TRUSTED in input template cannot be supported in created object (270 tests, 0 failed)

96 If a call to C_CopyObject cannot support the precise template supplied to it, it must fail and return without creating any object. Pass 0 149742

Reference: v2.20 s10.1.1 p63, s10.1.3 p65, s11.7 p128

If attributes do not match, an application may inadvertently create keys without adequate protection, or with excessive permissions

C_CopyObject: (149742 tests, 0 failed)

  • 100%: Call must fail if the provided value for CKA_CLASS in input template cannot be supported in result object (5607 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TOKEN in input template cannot be supported in result object (2340 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE in input template cannot be supported in result object (2340 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LABEL in input template cannot be supported in result object (65541 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_VALUE in input template cannot be supported in result object (7884 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TRUSTED in input template cannot be supported in result object (2718 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_TYPE in input template cannot be supported in result object (9345 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SUBJECT in input template cannot be supported in result object (untested after 100338 tests)
  • -- : Call must fail if the provided value for CKA_ID in input template cannot be supported in result object (untested after 100338 tests)
  • 100%: Call must fail if the provided value for CKA_SENSITIVE in input template cannot be supported in result object (2934 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_ENCRYPT in input template cannot be supported in result object (untested after 100338 tests)
  • 100%: Call must fail if the provided value for CKA_DECRYPT in input template cannot be supported in result object (2340 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_WRAP in input template cannot be supported in result object (untested after 100338 tests)
  • 100%: Call must fail if the provided value for CKA_UNWRAP in input template cannot be supported in result object (2340 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_SIGN in input template cannot be supported in result object (2340 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SIGN_RECOVER in input template cannot be supported in result object (untested after 100338 tests)
  • -- : Call must fail if the provided value for CKA_VERIFY in input template cannot be supported in result object (untested after 100338 tests)
  • -- : Call must fail if the provided value for CKA_VERIFY_RECOVER in input template cannot be supported in result object (untested after 100338 tests)
  • 100%: Call must fail if the provided value for CKA_DERIVE in input template cannot be supported in result object (2340 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODULUS in input template cannot be supported in result object (1110 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODULUS_BITS in input template cannot be supported in result object (90 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PUBLIC_EXPONENT in input template cannot be supported in result object (555 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE_EXPONENT in input template cannot be supported in result object (1020 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIME_1 in input template cannot be supported in result object (1020 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIME_2 in input template cannot be supported in result object (1020 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXPONENT_1 in input template cannot be supported in result object (1020 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXPONENT_2 in input template cannot be supported in result object (1020 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_COEFFICIENT in input template cannot be supported in result object (1020 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_PRIME in input template cannot be supported in result object (untested after 100338 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME in input template cannot be supported in result object (untested after 100338 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_BITS in input template cannot be supported in result object (untested after 100338 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME_BITS in input template cannot be supported in result object (untested after 100338 tests)
  • 100%: Call must fail if the provided value for CKA_VALUE_LEN in input template cannot be supported in result object (2628 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXTRACTABLE in input template cannot be supported in result object (2934 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LOCAL in input template cannot be supported in result object (3738 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_NEVER_EXTRACTABLE in input template cannot be supported in result object (3648 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ALWAYS_SENSITIVE in input template cannot be supported in result object (3648 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_GEN_MECHANISM in input template cannot be supported in result object (11214 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODIFIABLE in input template cannot be supported in result object (2340 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_EC_PARAMS in input template cannot be supported in result object (untested after 100338 tests)
  • -- : Call must fail if the provided value for CKA_EC_POINT in input template cannot be supported in result object (untested after 100338 tests)
  • -- : Call must fail if the provided value for CKA_ALWAYS_AUTHENTICATE in input template cannot be supported in result object (untested after 100338 tests)
  • 100%: Call must fail if the provided value for CKA_WRAP_WITH_TRUSTED in input template cannot be supported in result object (3648 tests, 0 failed)

97 If a specified change cannot be made with C_SetAttributeValue, the call must fail. Pass 0 80789

Reference: v2.20 s10.1.1 p63, s10.1.2 p65, s11.7 p128

If attributes do not match, an application may inadvertently create keys without adequate protection, or with excessive permissions

C_SetAttributeValue: (80789 tests, 0 failed)

  • 100%: Call must fail if the provided value for CKA_CLASS in input template cannot be supported in result object (4965 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TOKEN in input template cannot be supported in result object (3310 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE in input template cannot be supported in result object (3310 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_LABEL in input template cannot be supported in result object (untested after 91263 tests)
  • 100%: Call must fail if the provided value for CKA_VALUE in input template cannot be supported in result object (7860 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TRUSTED in input template cannot be supported in result object (2710 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_TYPE in input template cannot be supported in result object (8275 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SUBJECT in input template cannot be supported in result object (untested after 91263 tests)
  • -- : Call must fail if the provided value for CKA_ID in input template cannot be supported in result object (untested after 91263 tests)
  • 100%: Call must fail if the provided value for CKA_SENSITIVE in input template cannot be supported in result object (2864 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ENCRYPT in input template cannot be supported in result object (198 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_DECRYPT in input template cannot be supported in result object (2616 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_WRAP in input template cannot be supported in result object (198 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_UNWRAP in input template cannot be supported in result object (2616 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_SIGN in input template cannot be supported in result object (2616 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SIGN_RECOVER in input template cannot be supported in result object (untested after 91263 tests)
  • 100%: Call must fail if the provided value for CKA_VERIFY in input template cannot be supported in result object (198 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_VERIFY_RECOVER in input template cannot be supported in result object (untested after 91263 tests)
  • 100%: Call must fail if the provided value for CKA_DERIVE in input template cannot be supported in result object (2634 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODULUS in input template cannot be supported in result object (690 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODULUS_BITS in input template cannot be supported in result object (90 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PUBLIC_EXPONENT in input template cannot be supported in result object (345 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE_EXPONENT in input template cannot be supported in result object (600 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIME_1 in input template cannot be supported in result object (600 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIME_2 in input template cannot be supported in result object (600 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXPONENT_1 in input template cannot be supported in result object (600 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXPONENT_2 in input template cannot be supported in result object (600 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_COEFFICIENT in input template cannot be supported in result object (600 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_PRIME in input template cannot be supported in result object (untested after 91263 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME in input template cannot be supported in result object (untested after 91263 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_BITS in input template cannot be supported in result object (untested after 91263 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME_BITS in input template cannot be supported in result object (untested after 91263 tests)
  • 100%: Call must fail if the provided value for CKA_VALUE_LEN in input template cannot be supported in result object (2620 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXTRACTABLE in input template cannot be supported in result object (2864 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LOCAL in input template cannot be supported in result object (3310 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_NEVER_EXTRACTABLE in input template cannot be supported in result object (3220 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ALWAYS_SENSITIVE in input template cannot be supported in result object (3220 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_GEN_MECHANISM in input template cannot be supported in result object (9930 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODIFIABLE in input template cannot be supported in result object (3310 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_EC_PARAMS in input template cannot be supported in result object (untested after 91263 tests)
  • -- : Call must fail if the provided value for CKA_EC_POINT in input template cannot be supported in result object (untested after 91263 tests)
  • -- : Call must fail if the provided value for CKA_ALWAYS_AUTHENTICATE in input template cannot be supported in result object (untested after 91263 tests)
  • 100%: Call must fail if the provided value for CKA_WRAP_WITH_TRUSTED in input template cannot be supported in result object (3220 tests, 0 failed)

99 If a call to C_GenerateKeyPair cannot support the precise template supplied to it, it must fail and return without creating any object. Pass 0 27180

Reference: v2.20 s10.1.1 p63, s11.14 p174

If attributes do not match, an application may inadvertently create keys without adequate protection, or with excessive permissions

C_GenerateKeyPair: (27180 tests, 0 failed)

  • 100%: Call must fail if the provided value for CKA_CLASS in public template cannot be supported in generated public object (500 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TOKEN in public template cannot be supported in generated public object (880 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE in public template cannot be supported in generated public object (880 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LABEL in public template cannot be supported in generated public object (4087 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_VALUE in public template cannot be supported in generated public object (untested after 12100 tests)
  • 100%: Call must fail if the provided value for CKA_TRUSTED in public template cannot be supported in generated public object (36 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_TYPE in public template cannot be supported in generated public object (532 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SUBJECT in public template cannot be supported in generated public object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_ID in public template cannot be supported in generated public object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_SENSITIVE in public template cannot be supported in generated public object (untested after 12100 tests)
  • 100%: Call must fail if the provided value for CKA_ENCRYPT in public template cannot be supported in generated public object (880 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_DECRYPT in public template cannot be supported in generated public object (untested after 12100 tests)
  • 100%: Call must fail if the provided value for CKA_WRAP in public template cannot be supported in generated public object (880 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_UNWRAP in public template cannot be supported in generated public object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_SIGN in public template cannot be supported in generated public object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_SIGN_RECOVER in public template cannot be supported in generated public object (untested after 12100 tests)
  • 100%: Call must fail if the provided value for CKA_VERIFY in public template cannot be supported in generated public object (880 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_VERIFY_RECOVER in public template cannot be supported in generated public object (untested after 12100 tests)
  • 100%: Call must fail if the provided value for CKA_DERIVE in public template cannot be supported in generated public object (880 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODULUS in public template cannot be supported in generated public object (17 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODULUS_BITS in public template cannot be supported in generated public object (3940 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PUBLIC_EXPONENT in public template cannot be supported in generated public object (3940 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_PRIVATE_EXPONENT in public template cannot be supported in generated public object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_1 in public template cannot be supported in generated public object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_2 in public template cannot be supported in generated public object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_EXPONENT_1 in public template cannot be supported in generated public object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_EXPONENT_2 in public template cannot be supported in generated public object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_COEFFICIENT in public template cannot be supported in generated public object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_PRIME in public template cannot be supported in generated public object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME in public template cannot be supported in generated public object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_BITS in public template cannot be supported in generated public object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME_BITS in public template cannot be supported in generated public object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_VALUE_LEN in public template cannot be supported in generated public object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_EXTRACTABLE in public template cannot be supported in generated public object (untested after 12100 tests)
  • 100%: Call must fail if the provided value for CKA_LOCAL in public template cannot be supported in generated public object (36 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_NEVER_EXTRACTABLE in public template cannot be supported in generated public object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_ALWAYS_SENSITIVE in public template cannot be supported in generated public object (untested after 12100 tests)
  • 100%: Call must fail if the provided value for CKA_KEY_GEN_MECHANISM in public template cannot be supported in generated public object (108 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODIFIABLE in public template cannot be supported in generated public object (880 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EC_PARAMS in public template cannot be supported in generated public object (25 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EC_POINT in public template cannot be supported in generated public object (1 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_ALWAYS_AUTHENTICATE in public template cannot be supported in generated public object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_WRAP_WITH_TRUSTED in public template cannot be supported in generated public object (untested after 12100 tests)
  • 100%: Call must fail if the provided value for CKA_CLASS in private template cannot be supported in generated private object (263 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TOKEN in private template cannot be supported in generated private object (2 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE in private template cannot be supported in generated private object (2 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LABEL in private template cannot be supported in generated private object (4087 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_VALUE in private template cannot be supported in generated private object (6 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_TRUSTED in private template cannot be supported in generated private object (untested after 12100 tests)
  • 100%: Call must fail if the provided value for CKA_KEY_TYPE in private template cannot be supported in generated private object (525 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SUBJECT in private template cannot be supported in generated private object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_ID in private template cannot be supported in generated private object (untested after 12100 tests)
  • 100%: Call must fail if the provided value for CKA_SENSITIVE in private template cannot be supported in generated private object (2 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_ENCRYPT in private template cannot be supported in generated private object (untested after 12100 tests)
  • 100%: Call must fail if the provided value for CKA_DECRYPT in private template cannot be supported in generated private object (2 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_WRAP in private template cannot be supported in generated private object (untested after 12100 tests)
  • 100%: Call must fail if the provided value for CKA_UNWRAP in private template cannot be supported in generated private object (2 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_SIGN in private template cannot be supported in generated private object (2 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SIGN_RECOVER in private template cannot be supported in generated private object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_VERIFY in private template cannot be supported in generated private object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_VERIFY_RECOVER in private template cannot be supported in generated private object (untested after 12100 tests)
  • 100%: Call must fail if the provided value for CKA_DERIVE in private template cannot be supported in generated private object (2 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODULUS in private template cannot be supported in generated private object (130 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_MODULUS_BITS in private template cannot be supported in generated private object (untested after 12100 tests)
  • 100%: Call must fail if the provided value for CKA_PUBLIC_EXPONENT in private template cannot be supported in generated private object (130 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE_EXPONENT in private template cannot be supported in generated private object (130 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIME_1 in private template cannot be supported in generated private object (130 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIME_2 in private template cannot be supported in generated private object (130 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXPONENT_1 in private template cannot be supported in generated private object (130 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXPONENT_2 in private template cannot be supported in generated private object (130 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_COEFFICIENT in private template cannot be supported in generated private object (130 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_PRIME in private template cannot be supported in generated private object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME in private template cannot be supported in generated private object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_BITS in private template cannot be supported in generated private object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME_BITS in private template cannot be supported in generated private object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_VALUE_LEN in private template cannot be supported in generated private object (untested after 12100 tests)
  • 100%: Call must fail if the provided value for CKA_EXTRACTABLE in private template cannot be supported in generated private object (2 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LOCAL in private template cannot be supported in generated private object (262 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_NEVER_EXTRACTABLE in private template cannot be supported in generated private object (262 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ALWAYS_SENSITIVE in private template cannot be supported in generated private object (262 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_GEN_MECHANISM in private template cannot be supported in generated private object (786 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODIFIABLE in private template cannot be supported in generated private object (2 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EC_PARAMS in private template cannot be supported in generated private object (25 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_EC_POINT in private template cannot be supported in generated private object (untested after 12100 tests)
  • -- : Call must fail if the provided value for CKA_ALWAYS_AUTHENTICATE in private template cannot be supported in generated private object (untested after 12100 tests)
  • 100%: Call must fail if the provided value for CKA_WRAP_WITH_TRUSTED in private template cannot be supported in generated private object (262 tests, 0 failed)

101 If a call to C_DeriveKey cannot support the precise template supplied to it, it must fail and return without creating any object. Pass 0 87381

Reference: v2.20 s10.1.1 p63, s11.14 p174

If attributes do not match, an application may inadvertently create keys without adequate protection, or with excessive permissions

C_DeriveKey: (87381 tests, 0 failed)

  • 100%: Call must fail if the provided value for CKA_CLASS in input template cannot be supported in derived key (29127 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TOKEN in input template cannot be supported in derived key (798 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_PRIVATE in input template cannot be supported in derived key (798 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LABEL in input template cannot be supported in derived key (29526 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_VALUE in input template cannot be supported in derived key (2394 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_TRUSTED in input template cannot be supported in derived key (798 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_TYPE in input template cannot be supported in derived key (7980 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SUBJECT in input template cannot be supported in derived key (untested after 29526 tests)
  • -- : Call must fail if the provided value for CKA_ID in input template cannot be supported in derived key (untested after 29526 tests)
  • 100%: Call must fail if the provided value for CKA_SENSITIVE in input template cannot be supported in derived key (798 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ENCRYPT in input template cannot be supported in derived key (798 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_DECRYPT in input template cannot be supported in derived key (798 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_WRAP in input template cannot be supported in derived key (798 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_UNWRAP in input template cannot be supported in derived key (798 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_SIGN in input template cannot be supported in derived key (798 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_SIGN_RECOVER in input template cannot be supported in derived key (untested after 29526 tests)
  • 100%: Call must fail if the provided value for CKA_VERIFY in input template cannot be supported in derived key (798 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_VERIFY_RECOVER in input template cannot be supported in derived key (untested after 29526 tests)
  • 100%: Call must fail if the provided value for CKA_DERIVE in input template cannot be supported in derived key (798 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_MODULUS in input template cannot be supported in derived key (untested after 29526 tests)
  • -- : Call must fail if the provided value for CKA_MODULUS_BITS in input template cannot be supported in derived key (untested after 29526 tests)
  • -- : Call must fail if the provided value for CKA_PUBLIC_EXPONENT in input template cannot be supported in derived key (untested after 29526 tests)
  • -- : Call must fail if the provided value for CKA_PRIVATE_EXPONENT in input template cannot be supported in derived key (untested after 29526 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_1 in input template cannot be supported in derived key (untested after 29526 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_2 in input template cannot be supported in derived key (untested after 29526 tests)
  • -- : Call must fail if the provided value for CKA_EXPONENT_1 in input template cannot be supported in derived key (untested after 29526 tests)
  • -- : Call must fail if the provided value for CKA_EXPONENT_2 in input template cannot be supported in derived key (untested after 29526 tests)
  • -- : Call must fail if the provided value for CKA_COEFFICIENT in input template cannot be supported in derived key (untested after 29526 tests)
  • -- : Call must fail if the provided value for CKA_PRIME in input template cannot be supported in derived key (untested after 29526 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME in input template cannot be supported in derived key (untested after 29526 tests)
  • -- : Call must fail if the provided value for CKA_PRIME_BITS in input template cannot be supported in derived key (untested after 29526 tests)
  • -- : Call must fail if the provided value for CKA_SUBPRIME_BITS in input template cannot be supported in derived key (untested after 29526 tests)
  • 100%: Call must fail if the provided value for CKA_VALUE_LEN in input template cannot be supported in derived key (2394 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_EXTRACTABLE in input template cannot be supported in derived key (798 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_LOCAL in input template cannot be supported in derived key (798 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_NEVER_EXTRACTABLE in input template cannot be supported in derived key (798 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_ALWAYS_SENSITIVE in input template cannot be supported in derived key (798 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_KEY_GEN_MECHANISM in input template cannot be supported in derived key (2394 tests, 0 failed)
  • 100%: Call must fail if the provided value for CKA_MODIFIABLE in input template cannot be supported in derived key (798 tests, 0 failed)
  • -- : Call must fail if the provided value for CKA_EC_PARAMS in input template cannot be supported in derived key (untested after 29526 tests)
  • -- : Call must fail if the provided value for CKA_EC_POINT in input template cannot be supported in derived key (untested after 29526 tests)
  • -- : Call must fail if the provided value for CKA_ALWAYS_AUTHENTICATE in input template cannot be supported in derived key (untested after 29526 tests)
  • 100%: Call must fail if the provided value for CKA_WRAP_WITH_TRUSTED in input template cannot be supported in derived key (798 tests, 0 failed)

102 The value of the CKA_SENSITIVE and CKA_ALWAYS_SENSITIVE attribute for the base key affect the value that theses attribute can hold for the newly-derived key. Pass 0 45

Reference: v2.20 s11.14 p174

Since derived key are generated from the value of the base key, a good management of these attribute is require to prevent leak of the base key.

C_DeriveKey: (45 tests, 0 failed)

  • -- : CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_DES_ECB_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_DES_ECB_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_DES_ECB_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_DES3_ECB_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_DES3_ECB_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_DES3_ECB_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_AES_ECB_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_AES_ECB_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_AES_ECB_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_DES_CBC_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_DES_CBC_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_DES_CBC_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_DES3_CBC_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_DES3_CBC_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_DES3_CBC_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_AES_CBC_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_AES_CBC_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_AES_CBC_ENCRYPT_DATA. (untested after 29526 tests)
  • 100%: Call must fail if a new value of CKA_SENSITIVE is specified in input template when CKA_SENSITIVE is CK_TRUE in initial object when using CKM_CONCATENATE_BASE_AND_DATA. (9 tests, 0 failed)
  • -- : CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_CONCATENATE_BASE_AND_DATA. (untested after 29526 tests)
  • -- : CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_CONCATENATE_BASE_AND_DATA. (untested after 29526 tests)
  • -- : CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_CONCATENATE_BASE_AND_DATA. (untested after 29526 tests)
  • 100%: Call must fail if a new value of CKA_SENSITIVE is specified in input template when CKA_SENSITIVE is CK_TRUE in initial object when using CKM_CONCATENATE_DATA_AND_BASE. (9 tests, 0 failed)
  • -- : CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_CONCATENATE_DATA_AND_BASE. (untested after 29526 tests)
  • -- : CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_CONCATENATE_DATA_AND_BASE. (untested after 29526 tests)
  • -- : CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_CONCATENATE_DATA_AND_BASE. (untested after 29526 tests)
  • 100%: Call must fail if a new value of CKA_SENSITIVE is specified in input template when CKA_SENSITIVE is CK_TRUE in initial object when using CKM_XOR_BASE_AND_DATA. (18 tests, 0 failed)
  • -- : CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_XOR_BASE_AND_DATA. (untested after 29526 tests)
  • -- : CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_XOR_BASE_AND_DATA. (untested after 29526 tests)
  • -- : CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_XOR_BASE_AND_DATA. (untested after 29526 tests)
  • 100%: Call must fail if a new value of CKA_SENSITIVE is specified in input template when CKA_SENSITIVE is CK_TRUE in initial object when using CKM_EXTRACT_KEY_FROM_KEY. (9 tests, 0 failed)
  • -- : CKA_SENSITIVE is CK_FALSE in derived key implies CKA_ALWAYS_SENSITIVE is CK_FALSE in derived key when using CKM_EXTRACT_KEY_FROM_KEY. (untested after 29526 tests)
  • -- : CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in base key when using CKM_EXTRACT_KEY_FROM_KEY. (untested after 29526 tests)
  • -- : CKA_SENSITIVE is CK_TRUE in derived key and CKA_ALWAYS_SENSITIVE is CK_TRUE in base key implies CKA_ALWAYS_SENSITIVE is CK_TRUE in derived key when using CKM_EXTRACT_KEY_FROM_KEY. (untested after 29526 tests)

103 The value of the CKA_EXTRACTABLE and CKA_NEVER_EXTRACTABLE attribute for the base key affect the value that theses attribute can hold for the newly-derived key. Pass 0 45

Reference: v2.20 s11.14 p174

Since derived key are generated from the value of the base key, a good management of these attribute is require to prevent leak of the base key.

C_DeriveKey: (45 tests, 0 failed)

  • -- : CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_DES_ECB_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_DES_ECB_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_DES_ECB_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_DES3_ECB_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_DES3_ECB_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_DES3_ECB_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_AES_ECB_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_AES_ECB_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_AES_ECB_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_DES_CBC_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_DES_CBC_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_DES_CBC_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_DES3_CBC_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_DES3_CBC_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_DES3_CBC_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_AES_CBC_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_AES_CBC_ENCRYPT_DATA. (untested after 29526 tests)
  • -- : CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_AES_CBC_ENCRYPT_DATA. (untested after 29526 tests)
  • 100%: Call must fail if a new value of CKA_EXTRACTABLE is specified in input template when CKA_EXTRACTABLE is CK_FALSE in initial object when using CKM_CONCATENATE_BASE_AND_DATA. (9 tests, 0 failed)
  • -- : CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_CONCATENATE_BASE_AND_DATA. (untested after 29526 tests)
  • -- : CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_CONCATENATE_BASE_AND_DATA. (untested after 29526 tests)
  • -- : CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_CONCATENATE_BASE_AND_DATA. (untested after 29526 tests)
  • 100%: Call must fail if a new value of CKA_EXTRACTABLE is specified in input template when CKA_EXTRACTABLE is CK_FALSE in initial object when using CKM_CONCATENATE_DATA_AND_BASE. (9 tests, 0 failed)
  • -- : CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_CONCATENATE_DATA_AND_BASE. (untested after 29526 tests)
  • -- : CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_CONCATENATE_DATA_AND_BASE. (untested after 29526 tests)
  • -- : CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_CONCATENATE_DATA_AND_BASE. (untested after 29526 tests)
  • 100%: Call must fail if a new value of CKA_EXTRACTABLE is specified in input template when CKA_EXTRACTABLE is CK_FALSE in initial object when using CKM_XOR_BASE_AND_DATA. (18 tests, 0 failed)
  • -- : CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_XOR_BASE_AND_DATA. (untested after 29526 tests)
  • -- : CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_XOR_BASE_AND_DATA. (untested after 29526 tests)
  • -- : CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_XOR_BASE_AND_DATA. (untested after 29526 tests)
  • 100%: Call must fail if a new value of CKA_EXTRACTABLE is specified in input template when CKA_EXTRACTABLE is CK_FALSE in initial object when using CKM_EXTRACT_KEY_FROM_KEY. (9 tests, 0 failed)
  • -- : CKA_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_FALSE in derived key when using CKM_EXTRACT_KEY_FROM_KEY. (untested after 29526 tests)
  • -- : CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in base key when using CKM_EXTRACT_KEY_FROM_KEY. (untested after 29526 tests)
  • -- : CKA_EXTRACTABLE is CK_FALSE in derived key and CKA_NEVER_EXTRACTABLE is CK_TRUE in base key implies CKA_NEVER_EXTRACTABLE is CK_TRUE in derived key when using CKM_EXTRACT_KEY_FROM_KEY. (untested after 29526 tests)

Untested

Number Criterion Risk level Failed tests Total tests
40 CKA_WRAP_WITH_TRUSTED cannot be changed once set to CK_TRUE. High 0 0

Reference: v2.20 s10.9 p82, s10.10 p84

If not compliant, a key which has previously been marked as CKA_WRAP_WITH_TRUSTED may later be wrapped under an untrusted key-encryption key.

C_CopyObject: (untested after 100338 tests)

  • -- : Call must fail if a new value of CKA_WRAP_WITH_TRUSTED is specified in input template when CKA_WRAP_WITH_TRUSTED is CK_TRUE in initial object when copying secret or private key. (untested after 100338 tests)

C_SetAttributeValue: (untested after 91263 tests)

  • -- : Call must fail if a new value of CKA_WRAP_WITH_TRUSTED is specified in input template when CKA_WRAP_WITH_TRUSTED is CK_TRUE in initial object when modifying secret or private key. (untested after 91263 tests)

49 CKA_PUBLIC_EXPONENT default value is 65537 for RSA keys generated with C_GenerateKeyPair. High 0 0

Reference: v2.20 s12.1.2 p193

A default value of 3 leaves certain padding modes available in PKCS#11 open to attack.

C_GenerateKeyPair: (untested after 12100 tests)

  • -- : CKA_PUBLIC_EXPONENT must be set to 65537 in generated public object when not specified in public template when generating RSA keys . (untested after 12100 tests)

87 CKA_VALUE cannot be revealed if private EC key has its CKA_SENSITIVE attribute set to CK_TRUE or its CKA_EXTRACTABLE attribute set to CK_FALSE. High 0 0

Reference: v2.20 s12.3.4 p218

If not compliant, device leaks the value of keys marked as CKA_SENSITIVE or un-EXTRACTABLE, breaking the security properties described in section 7 of the standard (see CVE-2010-3321).

C_GetAttributeValue: (untested after 39 tests)

  • -- : Call must fail when requesting for CKA_VALUE and attribute CKA_EXTRACTABLE is CK_FALSE when inspecting EC private key. (untested after 39 tests)
  • -- : Call must fail when requesting for CKA_VALUE and attribute CKA_SENSITIVE is CK_TRUE when inspecting EC private key. (untested after 39 tests)

83 CKA_EC_PARAMS must not be specified when private EC keys are unwrapped with C_UnwrapKey. Medium 0 0

Reference: v2.20 s12.3.4 p218

The parameters should be obtained from the wrapped data, otherwise an invalid and/or insecure key may result.

C_UnwrapKey: (untested after 5854 tests)

  • -- : Call must fail if CKA_EC_PARAMS is specified in input template when unwrapping EC private key. (untested after 5854 tests)

86 CKA_VALUE must not be specified when private EC keys are unwrapped with C_UnwrapKey. Medium 0 0

Reference: v2.20 s12.3.4 p218

A non-compliant device would have ill-defined behavior and may create a fixed key for all calls.

C_UnwrapKey: (untested after 5854 tests)

  • -- : Call must fail if CKA_VALUE is specified in input template when unwrapping EC private key. (untested after 5854 tests)

20 CKA_KEY_GEN_MECHANISM has a value only if CKA_LOCAL is CK_TRUE. Low 0 0

Reference: v2.20 s10.7 p79

The mechanism cannot be known for externally generated key material.

C_CopyObject: (untested after 100338 tests)

  • -- : CKA_KEY_GEN_MECHANISM have a value in result object and CKA_KEY_GEN_MECHANISM isn't CK_UNAVAILABLE_INFORMATION in result object implies CKA_LOCAL is CK_TRUE in result object. (untested after 100338 tests)

C_GenerateKey: (untested after 77136 tests)

  • -- : CKA_KEY_GEN_MECHANISM have a value in generated object and CKA_KEY_GEN_MECHANISM isn't CK_UNAVAILABLE_INFORMATION in generated object implies CKA_LOCAL is CK_TRUE in generated object. (untested after 77136 tests)

C_DeriveKey: (untested after 29526 tests)

  • -- : CKA_KEY_GEN_MECHANISM have a value in derived key and CKA_KEY_GEN_MECHANISM isn't CK_UNAVAILABLE_INFORMATION in derived key implies CKA_LOCAL is CK_TRUE in derived key. (untested after 29526 tests)

C_CreateObject: (untested after 26620 tests)

  • -- : CKA_KEY_GEN_MECHANISM have a value in created object and CKA_KEY_GEN_MECHANISM isn't CK_UNAVAILABLE_INFORMATION in created object implies CKA_LOCAL is CK_TRUE in created object. (untested after 26620 tests)

C_GenerateKeyPair: (untested after 12100 tests)

  • -- : CKA_KEY_GEN_MECHANISM have a value in generated public object and CKA_KEY_GEN_MECHANISM isn't CK_UNAVAILABLE_INFORMATION in generated public object implies CKA_LOCAL is CK_TRUE in generated public object. (untested after 12100 tests)
  • -- : CKA_KEY_GEN_MECHANISM have a value in generated private object and CKA_KEY_GEN_MECHANISM isn't CK_UNAVAILABLE_INFORMATION in generated private object implies CKA_LOCAL is CK_TRUE in generated private object. (untested after 12100 tests)

C_UnwrapKey: (untested after 5854 tests)

  • -- : CKA_KEY_GEN_MECHANISM have a value in unwrapped object and CKA_KEY_GEN_MECHANISM isn't CK_UNAVAILABLE_INFORMATION in unwrapped object implies CKA_LOCAL is CK_TRUE in unwrapped object. (untested after 5854 tests)

Cryptosense Test Information

IBM - Meta PKCS11 LIBRARY (V3.2), cryptoki (V2.20), flags : (none)
Slot ID Slot Information Token Information
0 Description: Linux
Manufacturer ID: IBM
Flags: CKF_TOKEN_PRESENT
Hardware Version: 0.0
Firmware Version: 0.0
Label: SW
Serial Number: 123
Model: IBM SoftTok
Manufacturer ID: IBM Corp.
Pin Length Range: (4,8)
Max Session Count: 18446744073709551614
Max RW Session Count: 18446744073709551614
Flags: CKF_RNG | CKF_LOGIN_REQUIRED | CKF_USER_PIN_INITIALIZED | CKF_CLOCK_ON_TOKEN | CKF_TOKEN_INITIALIZED | CKF_SO_PIN_TO_BE_CHANGED
Hardware Version: 1.0
Firmware Version: 1.0
Supported mechanisms : 45
Mechanism Type Key Size Range ENCRYPT / DECRYPT SIGN / VERIFY SIGN_RECOVER / VERIFY_RECOVER WRAP / UNWRAP GENERATE + GENERATE_KEY_PAIR DIGEST DERIVE
CKM_AES_CBC (16,32) ✔ / ✔ ✔ / ✔
CKM_AES_CBC_PAD (16,32) ✔ / ✔ ✔ / ✔
CKM_AES_ECB (16,32) ✔ / ✔ ✔ / ✔
CKM_AES_KEY_GEN (16,32)
CKM_DES3_CBC (24,24) ✔ / ✔ ✔ / ✔
CKM_DES3_CBC_PAD (24,24) ✔ / ✔ ✔ / ✔
CKM_DES3_ECB (24,24) ✔ / ✔ ✔ / ✔
CKM_DES3_KEY_GEN (24,24)
CKM_DES_CBC (8,8) ✔ / ✔ ✔ / ✔
CKM_DES_CBC_PAD (8,8) ✔ / ✔ ✔ / ✔
CKM_DES_ECB (8,8) ✔ / ✔ ✔ / ✔
CKM_DES_KEY_GEN (8,8)
CKM_DH_PKCS_DERIVE (512,2048)
CKM_DH_PKCS_KEY_PAIR_GEN (512,2048)
CKM_MD5 (0,0)
CKM_MD5_HMAC (0,0) ✔ / ✔
CKM_MD5_HMAC_GENERAL (0,0) ✔ / ✔
CKM_MD5_RSA_PKCS (512,4096) ✔ / ✔
CKM_RSA_PKCS (512,4096) ✔ / ✔ ✔ / ✔ ✔ / ✔ ✔ / ✔
CKM_RSA_PKCS_KEY_PAIR_GEN (512,4096)
CKM_RSA_PKCS_OAEP (1024,4096) ✔ / ✔ ✔ / ✔
CKM_RSA_PKCS_PSS (1024,4096) ✔ / ✔
CKM_RSA_X_509 (512,4096) ✔ / ✔ ✔ / ✔ ✔ / ✔ ✔ / ✔
CKM_SHA1_RSA_PKCS (512,4096) ✔ / ✔
CKM_SHA1_RSA_PKCS_PSS (1024,4096) ✔ / ✔
CKM_SHA256 (0,0)
CKM_SHA256_HMAC (0,0) ✔ / ✔
CKM_SHA256_HMAC_GENERAL (0,0) ✔ / ✔
CKM_SHA256_RSA_PKCS_PSS (1024,4096) ✔ / ✔
CKM_SHA384 (0,0)
CKM_SHA384_HMAC (0,0) ✔ / ✔
CKM_SHA384_HMAC_GENERAL (0,0) ✔ / ✔
CKM_SHA384_RSA_PKCS_PSS (1024,4096) ✔ / ✔
CKM_SHA512 (0,0)
CKM_SHA512_HMAC (0,0) ✔ / ✔
CKM_SHA512_HMAC_GENERAL (0,0) ✔ / ✔
CKM_SHA512_RSA_PKCS_PSS (1024,4096) ✔ / ✔
CKM_SHA_1 (0,0)
CKM_SHA_1_HMAC (0,0) ✔ / ✔
CKM_SHA_1_HMAC_GENERAL (0,0) ✔ / ✔
CKM_SSL3_KEY_AND_MAC_DERIVE (48,48)
CKM_SSL3_MASTER_KEY_DERIVE (48,48)
CKM_SSL3_MD5_MAC (384,384) ✔ / ✔
CKM_SSL3_PRE_MASTER_KEY_GEN (48,48)
CKM_SSL3_SHA1_MAC (384,384) ✔ / ✔