Versions Compared

Old Version 3

changes.mady.by.user user-9bc78

Saved on

compared with

New Version 4

changes.mady.by.user user-9bc78

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • CKR_GENERAL_ERROR

    req id

    requirement description

    changed in version

    CT001

    pInitArgs shall have value NULL or shall point to a structure of type CK_C_INITIALIZE_ARGS

    -

    CT002

    pInitArgs shall be casted to a CK_C_INITIALIZE_ARGS_PTR when value is != NULL

    -

    CT003

    pInitArgs->pReserved shall be NULL when pInitArgs has a value != NULL

    -

    CT004

    when pInitArgs->pReserved and pInitArgs are both != NULL function shall return with CKR_ARGUMENTS_BAD

    -

    CT005

    when CKF_LIBRARY_CANT_CREATE_OS_THREADS flag is set and application expects P11 lib beeing capable of multithreading function shall return CKR_NEED_TO_CREATE_THREADS

    -

    CT006

    when CKF_OS_LOCKING_OK is not set and fields CreateMutex, DestroyMutex, LockMutex and UnlockMutex have value NULL P11 lib shall not use any multithreading

    -

    CT007

    when CKF_OS_LOCKING_OK is set and fields CreateMutex, DestroyMutex, LockMutex and UnlockMutex have value NULL P11 lib shall use OS primitives to ensure multithreaded safety

    -

    CT008

    when CKF_OS_LOCKING_OK is not set and fields CreateMutex, DestroyMutex, LockMutex and UnlockMutex have value != NULL P11 lib shall use these function pointers to ensure mutithreaded safety

    -

    CT009

    when CKF_OS_LOCKING_OK is set and fields CreateMutex, DestroyMutex, LockMutex and UnlockMutex have value != NULL P11 lib shall use either OS primitives or these function pointers to ensure multithreaded safety

    -

    CT010

    when P11 lib is unable to ensure desired safe multithreaded access level function shall return CKR_CANT_LOCK

    -

    CT011

    when CreateMutex, DestroyMutex, LockMutex and UnlockMutex partially have values != NULL function shall return CKR_ARGUMENTS_BAD

    -

    CT012

    when pInitArgs is NULL function shall behave like CreateMutex, DestroyMutex, LockMutex, UnlockMutex, pReserved having value NULL and no flag being set

    -

    CT013

    when function is called again and previously returned CKR_OK to the same application CKR_CRYPTOKI_ALREADY_INITIALIZED shall be returned

    -

    CT999

    the function shall clear all currently available slots event states

    -

    Anchor
    _Toc453149757
    _Toc453149757

    C_Finalize

    The function supports additional return values of:

  • CKR_GENERAL_ERROR

    req id

    requirement description

    changed in version

    CT014

    when pReserved parameter has value != NULL function shall return CKR_ARGUMENTS_BAD

    -

    CT015

    when function is called without a preceding call of C_Initialize function shall return CKR_CRYPTOKI_NOT_INITIALIZED

    -

    CT016

    when function is called all potentially waiting threads (which may called C_WaitForSlotEvent with enabled blocking) shall be unlocked

    -


    Anchor
    _Toc453149758
    _Toc453149758
    C_GetInfo

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_GENERAL_ERROR
  • CKR_ARGUMENTS_BAD

...

  • CKR_GENERAL_ERROR

  • CKR_ARGUMENTS_BAD

    req id

    requirement description

    changed in version

    CT017

    ppFunctionList shall receive the P11s references to the implemented api functions

    -


    Anchor
    _Toc453149760
    _Toc453149760
    C_GetSlotList

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_GENERAL_ERROR

  • CKR_ARGUMENTS_BAD

    req id

    requirement description

    changed in version

    CT018

    when pSlotList is NULL function shall set the number of current slots to out parameter pulCount and return with CKR_OK

    -

    CT019

    when pSlotList is != NULL function shall return CKR_CKR_BUFFER_TO_SMALL when in parameter pulCount indicates that the out parameter pSlotList is not capable of storing all current slots and write the neccessary size to pulCount

    -

    CT020

    when pSlotList is != NULL function shall insert all currently available slots to out parameter pSlotList, write the size to out parameter pulCount and return with CKR_OK

    -

    CT021

    when tokenPresent is set to CK_TRUE function shall only return / count currently available slots that have a token present

    -

    CT022

    unless function is called again with pSlotList = NULL all formerly reported slots shall be seen as valid slots (newly added slots are only accessible after calling this function with pSlotList = NULL again, slots which have been removed shall be still seen as valid as long as this function is called with pSlotList = NULL again)

    -


    Anchor
    _Toc453149761
    _Toc453149761
    C_GetSlotInfo

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_GENERAL_ERROR
  • CKR_SLOT_ID_INVALID
  • CKR_ARGUMENTS_BAD

...

  • CKR_GENERAL_ERROR

    req id

    requirement description

    changed in version

    CT023

    when pReserved has a value != NULL function shall return with CKR_ARGUMENTS_BAD

    -

    CT024

    when in parameter flag is set with CKF_DONT_BLOCK then the function shall set the ID of the reader where the most current event occured to the out parameter pSlot and return with CKR_OK

    -

    CT025

    when in parameter flag is set with CKF_DONT_BLOCK and there are no pending events the function shall return with CKR_NO_EVENT

    -

    CT026

    when in parameter flag has not set CKF_DONT_BLOCK the function shall wait until an event occurs

    -

    CT027

    when the function is in waiting state and C_Finalize is called the function shall stop waiting for an event and return with CKR_CRYPTOKI_NOT_INITIALIZED

    -

    CT028

    each currently accessable slot shall have an internal event flag which is set as soon as an event occurs

    -

    CT029

    this function shall clear a slot's event state whenever it reports the slot's ID to the caller

    -

    CT030

    this function shall react on token insertion event

    -

    CT031

    this function shall react on token removal events

    -


    Anchor
    _Toc453149764
    _Toc453149764
    C_GetMechanismList

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_GENERAL_ERROR
  • CKR_SLOT_ID_INVALID
  • CKR_TOKEN_NOT_PRESENT

  • CKR_ARGUMENTS_BAD

    req id

    requirement description

    changed in version

    CT032

    when pMechanismList is = NULL the function shall set the amount of the tokens supported mechanisms to pulCount out parameter and return with CKR_OK

    -

    CT033

    when pMechanismList is != NULL function shall return CKR_CKR_BUFFER_TO_SMALL when in parameter pulCount indicates that the out parameter pMechanismList is not capable of storing all mechanisms supported by the token and write the neccessary size to pulCount

    -

    CT034

    when pMechanismList is != NULL function shall insert all of the tokens supported mechanisms to out parameter pMechanismList and write its size to out parameter pulCount returning with CKR_OK

    -


    Anchor
    _Toc453149765
    _Toc453149765
    C_GetMechanismInfo

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_GENERAL_ERROR
  • CKR_MECHANISM_INVALID
  • CKR_SLOT_ID_INVALID
  • CKR_TOKEN_NOT_PRESENT
  • CKR_ARGUMENTS_BAD

...

  • CKR_ CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_GENERAL_ERROR
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID

  • CKR_ARGUMENTS_BAD

    req id

    requirement description

    changed in version

    CT035

    the function shall initialize a normal users PIN

    -

    CT036

    whenever the function is called not being in R/W SO Session state it shall return CKR_USER_NOT_LOGGED_IN

    -

    CT037

    when the token has CKF_PROTECTED_AUTHENTICATION_PATH flag set parameter pPin shall have value = NULL

    -


    Anchor
    _Toc453149767
    _Toc453149767
    C_SetPin

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_GENERAL_ERROR
  • CKR_PIN_INCORRECT
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID

  • CKR_ARGUMENTS_BAD

    req id

    requirement description

    changed in version

    CT038

    the function shall set the PIN of the currently logged in user

    -

    CT039

    when no user is logged in at the moment and session is in R/W Public Session state the user PIN shall be set

    -

    CT040

    whenever the function is called not being in a write state it shall return CKR_SESSION_READ_ONLY

    -

    CT041

    when the token has CKF_PROTECTED_AUTHENTICATION_PATH flag set in parameters pOldPin and pNewPin shall have value = NULL

    -


    Anchor
    _Toc453149768
    _Toc453149768
    C_OpenSession

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_SLOT_ID_INVALID
  • CKR_TOKEN_NOT_PRESENT

  • CKR_ARGUMENTS_BAD

    req id

    requirement description

    changed in version

    CT042

    whenever the function is called without CKF_SERIAL_SESSION being set in flags input parameter the function shall return with CKR_SESSION_PARALLEL_NOT_SUPPORTED

    -

    CT043

    whenever the function is called and the maximum amount of sessions is reached (token dependant) the function shall return with CKR_SESSION_COUNT

    -

    CT044

    whenever a R/W SO Session is already open and a R Session is requested the function shall return with CKR_SESSION_READ_WRITE_SO_EXISTS

    -


    Anchor
    _Toc453149769
    _Toc453149769
    C_CloseSession

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_ DEVICE_REMOVED
  • CKR_ FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_SESSION_CLOSED

  • CKR_SESSION_HANDLE_INVALID

    req id

    requirement description

    changed in version

    CT045

    all objects created during the session indicated by hSession shall be destroyed even when they are still be used by other sessions

    -

    Anchor
    _Toc453149770
    _Toc453149770

    C_CloseAllSessions

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_ FUNCTION_FAILED
  • CKR_ GENERAL_ERROR
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID

  • CKR_ARGUMENTS_BAD

    req id

    requirement description

    changed in version

    CT199

    whenever the function is called all sessions opened for the slot indicated in slotID shall be closed

    -

    CT200

    whenever the function is called all session objects created for that slot shall be destroyed

    -

    CT201

    on successful call of this function the login state shall return to public i.e. potential new sessions are created in public state

    -


    C_GetSessionInfo

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_ FUNCTION_FAILED
  • CKR_ GENERAL_ERROR
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID
  • CKR_ARGUMENTS_BAD

...

  • CKR_ARGUMENTS_BAD
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_PIN_LOCKED
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID
  • CKR_USER_ALREADY_LOGGED_IN
  • CKR_USER_ANOTHER_ALREADY_LOGGED_IN

  • CKR_USER_TYPE_INVALID

    req id

    requirement description

    changed in version

    CT046

    on successful login all existing sessions shall be upgraded from public sessions to private sessions (user specific)

    -

    CT047

    when trying to login with CKR_CONTEXT_SPECIFIC the function shall return CKR_OPERATION_NOT_INITIALIZED on improper use

    -

    CT048

    when trying to login the SO and there is a read only session the function shall return CKR_SESSION_READ_ONLY_EXISTS

    -

    CT049

    when CKF_PROTECTED_AUTHENTICATION_PATH flag is set the input parameter pPin shall be NULL

    -

    CT050

    on successful login the function shall return with CKR_OK

    -

    CT051

    the function shall return with CKR_PIN_INCORRECT when access can not be granted

    -

    CT052

    logging in shall only succeed when no active operation is ongoing (no crypto operation, no object finding operations, ...)

    -

    CT053

    the function shall only be called once unless a logout occurs or a key is post-accessed flagged with CKA_ALWAYS_AUTHENTICATE

    -


    Anchor
    _Toc453149772
    _Toc453149772
    C_Logout

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID

  • CKR_USER_NOT_LOGGED_IN

    req id

    requirement description

    changed in version

    CT054

    on successful logout all existing sessions shall be downgraded from private sessions to public sessions (user specific)

    -

    CT055

    on successful logout all private object handles shall be invalid even on re-login

    -

    CT056

    on successful logout all privatly created non-token objects shall be destroyed

    -

    CT057

    logging out shall only succeed when no active operation is ongoing (no crypto operation, no object finding operations, ...)

    -


    Anchor
    _Toc453149773
    _Toc453149773
    C_CreateObject

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID

  • CKR_USER_NOT_LOGGED_IN

    req id

    requirement description

    changed in version

    CT058

    whenever a template is unsupported the function shall return without creating an object

    -

    CT059

    when creating key-objects the CKA_LOCAL attribute shall be set to CK_FALSE (create object is always an import -> not generated by token)

    -

    CT060

    when creating private- or secret-key objects the CKA_ALWAYS_SENSITIVE attribute shall be set to CK_FALSE

    -

    CT061

    when creating private- or secret-key objects the CKA_NEVER_EXTRACTABLE attribute shall be set to CK_FALSE

    -

    CT062

    during a read only session only session objects shall be createable

    -

    CT063

    during a public session only public objects shall be createable

    -


    Anchor
    _Toc453149774
    _Toc453149774
    C_DestroyObject

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_OBJECT_HANDLE_INVALID
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID

  • CKR_SESSION_READ_ONLY

    req id

    requirement description

    changed in version

    CT069

    during a read only session only session objects shall be destroyed

    -

    CT070

    during a public session only public objects shall be destroyed

    -


    Anchor
    _Toc453149775
    _Toc453149775
    C_GetObjectSize

    The function supports additional return values of:
  • CKR_ARGUMENTS_BAD
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_OBJECT_HANDLE_INVALID
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID

...

  • CKR_ARGUMENTS_BAD
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_OBJECT_HANDLE_INVALID

  • CKR_SESSION_HANDLE_INVALID

    req id

    requirement description

    changed in version

    CT071

    in / out parameter pTemplate shall point to attributes described by type, value and length

    -

    CT072

    when an objects is flagged as SENSITIVE or UNEXTRACTABLE the attributes out length shall be set to -1 and return value shall be set to CKR_ATTRIBUTE_SENSITIVE

    -

    CT073

    when an object does not contain the specified attribute the attributes out length shall be set to -1 and return value shall be set to CKR_ATTRIBUTE_INVALID

    -

    CT074

    when an objects attribute is extractable but the attributes in parameter value is NULL then the exact length shall be set to the attributes out length

    -

    CT075

    when an objects attribute is extractable and the attributes out value field is large enough (indicated by length) the value shall be copied to out value and the exact length value shall be written to out length

    -

    CT076

    when an objects attribute is extractable and the attributes out value field is not large enough the attributes out length shall be set to -1 and return value shall be set to CKR_BUFFER_TO_SMALL

    -

    CT077

    whenever the return value is modified the function shall go on with the next attribute

    -

    CT078

    whenever an objects attribute is flagged with CKF_ARRAY_ATTRIBUTE and consists of attributes (an attribute contains an array of attributes) the function shall treat each attribute like specified (CT072-CT077)

    -


    Anchor
    _Toc453149777
    _Toc453149777
    C_SetAttributeValue

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_ATTRIBUTE_READ_ONLY
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_OBJECT_HANDLE_INVALID
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID
  • CKR_SESSION_READ_ONLY
  • CKR_USER_NOT_LOGGED_IN

  • CKR_ARGUMENTS_BAD

    req id

    requirement description

    changed in version

    CT079

    during a read only session only session objects shall be modified

    -

    CT080

    whenever the template includes attributes which are not compatible with the object or existing attributes the function shall return with CKR_TEMPLATE_INCONSISTENT

    -


    Anchor
    _Toc453149778
    _Toc453149778
    C_FindObjectsInit

    The function supports additional return values of:
  • CKR_ARGUMENTS_BAD
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_OPERATION_ACTIVE
  • CKR_SESSION_CLOSED

  • CKR_SESSION_HANDLE_INVALID

    req id

    requirement description

    changed in version

    CT081

    when in parameter ulCount has value 0 all objects shall be "found"

    -

    CT082

    objects shall be found in a session specific manner (public session -> only public objects)

    -


    Anchor
    _Toc453149779
    _Toc453149779
    C_FindObjects

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_OPERATION_NOT_INITIALIZED
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID

  • CKR_ARGUMENTS_BAD

    req id

    requirement description

    changed in version

    CT083

    the function shall compare the search patterns bytewise

    -

    CT084

    object finding shall be initialized with preceding call of C_FindObjectsInit

    -

    CT085

    when there are no more objects to find pulObjectCount parameter shall receive value 0 - when objects where found pulObjectCount shall receive the amount of found objects

    -


    Anchor
    _Toc453149780
    _Toc453149780
    C_FindObjectsFinal

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_OPERATION_NOT_INITIALIZED
  • CKR_SESSION_CLOSED

  • CKR_SESSION_HANDLE_INVALID

    req id

    requirement description

    changed in version

    CT086

    function shall finalize objects search in order to start a potentially new one

    -


    Anchor
    _Toc453149781
    _Toc453149781
    C_EncryptInit

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_KEY_FUNCTION_NOT_PERMITTED
  • CKR_KEY_HANDLE_INVALID
  • CKR_KEY_TYPE_INCONSISTENT
  • CKR_MECHANISM_INVALID
  • CKR_OPERATION_ACTIVE
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID

  • CKR_USER_NOT_LOGGED_IN

    req id

    requirement description

    changed in version

    CT087

    in parameter hKey, being used as encryption key, shall have a valid (CK_TRUE) CKA_ENCRYPT attribute

    -


    Anchor
    _Toc453149782
    _Toc453149782
    C_Encrypt

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_OPERATION_NOT_INITIALIZED
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID

  • CKR_ARGUMENTS_BAD

    req id

    requirement description

    changed in version

    CT088

    when out parameter pEncryptedData is NULL the function shall set parameter pulEncryptedDataLen to the number of bytes which would suffice to hold the output and return with CKR_OK

    -

    CT089

    when out parameter pEncryptedData is != NULL and pulEncrypedDataLen indicates that the buffer is large enough to hold the output the function shall copy the output to pEncryptedData, set the exact size to pulEncryptedDataLen and return with CKR_OK

    -

    CT090

    when out parameter pEncryptedData is != NULL and pulEncrypedDataLen indicates that the buffer is NOT large enough to hold the output the function shall set the exact size of the output to pulEncryptedDataLen and return with CKR_BUFFER_TO_SMALL

    -

    CT091

    the function shall be precalled by C_EncryptInit in order to initialize an encryption process

    -

    CT092

    the function shall always terminate an encryption process except it returns with CKR_BUFFER_TO_SMALL or was just used for a length call (CT088)

    -

    CT093

    the function shall only support single-part-operations and cannot be called to finish multi-part-operations

    -

    CT094

    when mechanism specific input length constraints are not satisfied the function shall return with CKR_DATA_LEN_RANGE

    -

    Anchor
    _Toc453149783
    _Toc453149783

    C_DecryptInit

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_KEY_FUNCTION_NOT_PERMITTED
  • CKR_KEY_HANDLE_INVALID
  • CKR_KEY_TYPE_INCONSISTENT
  • CKR_MECHANISM_INVALID
  • CKR_OPERATION_ACTIVE
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID
  • CKR_USER_NOT_LOGGED_IN

  • CKR_ARGUMENTS_BAD

    req id

    requirement description

    changed in version

    CT106

    in parameter hKey, being used as decryption key, shall have a valid (CK_TRUE) CKA_DECRYPT attribute

    -


    Anchor
    _Toc453149784
    _Toc453149784
    C_Decrypt

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_OPERATION_NOT_INITIALIZED
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID
  • CKR_USER_NOT_LOGGED_IN

  • CKR_ARGUMENTS_BAD

    req id

    requirement description

    changed in version

    CT107

    when out parameter pData is NULL the function shall set parameter pulDataLen to the number of bytes which would suffice to hold the output and return with CKR_OK

    -

    CT108

    when out parameter pData is != NULL and pulDataLen indicates that the buffer is large enough to hold the output the function shall copy the output to pData set the exact size to pulDataLen and return with CKR_OK

    -

    CT109

    when out parameter pData is != NULL and pulDataLen indicates that the buffer is NOT large enough to hold the output the function shall set the exact size of the output to pulDataLen and return with CKR_BUFFER_TO_SMALL

    -

    CT110

    the function shall be precalled by C_DecryptInit in order to initialize an decryption process

    -

    CT111

    the function shall always terminate an decryption process except it returns with CKR_BUFFER_TO_SMALL or was just used for a length call (CT107)

    -

    CT112

    the function shall only support single-part-operations and cannot be called to finish multi-part-operations

    -

    CT113

    when the ciphertext cannot be decrypted because it has inappropriate length the function shall either return CKR_ENCRYPTED_DATA_INVALID or CKR_ENCRYPTED_DATA_LEN_RANGE

    -


    Anchor
    _Toc453149785
    _Toc453149785
    C_DigestInit

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_MECHANISM_INVALID
  • CKR_OPERATION_ACTIVE
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID
  • CKR_ARGUMENTS_BA

...

  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_OPERATION_NOT_INITIALIZED
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID

  • CKR_ARGUMENTS_BAD

    req id

    requirement description

    changed in version

    CT125

    when out parameter pDigest is NULL the function shall set parameter pulDigestLen to the number of bytes which would suffice to hold the output and return with CKR_OK

    -

    CT126

    when out parameter pDigest is != NULL and pulDigestLen indicates that the buffer is large enough to hold the output the function shall copy the output to pDigest set the exact size to pulDigestLen and return with CKR_OK

    -

    CT127

    when out parameter pDigest is != NULL and pulDigestLen indicates that the buffer is NOT large enough to hold the output the function shall set the exact size of the output to pulDigestLen and return with CKR_BUFFER_TO_SMALL

    -

    CT128

    the function shall be precalled by C_DigestInit in order to initialize a hash process

    -

    CT129

    the function shall always terminate a hash process except it returns with CKR_BUFFER_TO_SMALL or was just used for a length call (CT125)

    -

    CT130

    the function shall only support single-part-operations and cannot be called to finish multi-part-operations

    -


    Anchor
    _Toc453149787
    _Toc453149787
    C_SignInit

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_KEY_FUNCTION_NOT_PERMITTED
  • CKR_KEY_HANDLE_INVALID
  • CKR_KEY_TYPE_INCONSISTENT
  • CKR_MECHANISM_INVALID
  • CKR_OPERATION_ACTIVE
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID

  • CKR_USER_NOT_LOGGED_IN

    req id

    requirement description

    changed in version

    CT138

    in parameter hKey, being used as signing key, shall have a valid (CK_TRUE) CKA_SIGN attribute

    -

    Anchor
    _Toc453149788
    _Toc453149788

    C_Sign

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_OPERATION_NOT_INITIALIZED
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID
  • CKR_USER_NOT_LOGGED_IN

  • CKR_ARGUMENTS_BAD

    req id

    requirement description

    changed in version

    CT139

    when out parameter pSignature is NULL the function shall set parameter pulDataLen to the number of bytes which would suffice to hold the output and return with CKR_OK

    -

    CT140

    when out parameter pSignature is != NULL and pulSignatureLen indicates that the buffer is large enough to hold the output the function shall copy the output to pSignature set the exact size to pulSignatureLen and return with CKR_OK

    -

    CT141

    when out parameter pSignature is != NULL and pulSignatureLen indicates that the buffer is NOT large enough to hold the output the function shall set the exact size of the output to pulSignatureLen and return with CKR_BUFFER_TO_SMALL

    -

    CT142

    the function shall be precalled by C_SignInit in order to initialize an decryption process

    -

    CT143

    the function shall always terminate a signing process except it returns with CKR_BUFFER_TO_SMALL or was just used for a length call (CT139)

    -

    CT144

    the function shall only support single-part-operations and cannot be called to finish multi-part-operations

    -


    Anchor
    _Toc453149789
    _Toc453149789
    C_VerifyInit

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_KEY_FUNCTION_NOT_PERMITTED
  • CKR_KEY_HANDLE_INVALID
  • CKR_KEY_TYPE_INCONSISTENT
  • CKR_MECHANISM_INVALID
  • CKR_OPERATION_ACTIVE
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID

  • CKR_ARGUMENTS_BAD

    req id

    requirement description

    changed in version

    CT152

    in parameter hKey, being used as verifying key, shall have a valid (CK_TRUE) CKA_VERIFY attribute

    -


    Anchor
    _Toc453149790
    _Toc453149790
    C_Verify

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_OPERATION_NOT_INITIALIZED
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID

  • CKR_ARGUMENTS_BAD

    req id

    requirement description

    changed in version

    CT153

    the function shall be precalled by C_VerifyInit in order to initialize a verification process

    -

    CT154

    the function shall always terminate a verification process

    -

    CT155

    the function shall only support single-part-operations and cannot be called to finish multi-part-operations

    -

    CT156

    whenever a signature can be seen as invalid purely on the basis of its length the function shall return CKR_SIGNATURE_LEN_RANGE

    -

    CT157

    whenever a signature is invalid (verification fails) the funtion shall return CKR_SIGNATURE_INVALID

    -

    CT158

    whenever a signature is valid the function shall return with CKR_OK

    -

    Anchor
    _Toc453149791
    _Toc453149791

    C_GenerateKeyPair

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_MECHANISM_INVALID
  • CKR_OPERATION_ACTIVE
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID
  • CKR_SESSION_READ_ONLY
  • CKR_TEMPLATE_INCOMPLETE
  • CKR_USER_NOT_LOGGED_IN

  • CKR_ARGUMENTS_BAD

    req id

    requirement description

    changed in version

    CT173

    the function shall be able to generate two new objects on a token

    -

    CT174

    the function shall never generate a single public or private key

    -

    CT175

    whenever the function succeeds it shall always generate a public AND a private key

    -

    CT176

    the function shall read the type of the objects being created from in parameter pMechanism carried in the CKA_KEY_TYPE attribute

    -

    CT177

    whenever one of the in parameter templates supplies a CKA_KEY_TYPE attribute other than specified in CKA_KEY_TYPE attribute of in parameter pMechanism the function shall return with CKR_TEMPLATE_INCONSISTENT

    -

    CT178

    whenever one of the in parameter templates supplies a CKA_CLASS attribute other than specified in CKA_CLASS attribute of in parameter pMechanism the function shall return with CKR_TEMPLATE_INCONSISTENT

    -

    CT179

    whenever one of the in parameter templates is not supported the function shall fail and do not create any object

    -

    CT180

    objects created by this function shall always receive the CKA_LOCAL attribute with a value of CK_TRUE

    -


    Anchor
    _Toc453149792
    _Toc453149792
    C_GenerateRandom

    The function supports additional return values of:
  • CKR_CRYPTOKI_NOT_INITIALIZED
  • CKR_DEVICE_REMOVED
  • CKR_FUNCTION_FAILED
  • CKR_GENERAL_ERROR
  • CKR_OPERATION_ACTIVE
  • CKR_SESSION_CLOSED
  • CKR_SESSION_HANDLE_INVALID
  • CKR_ARGUMENTS_BAD

...