xref: /titanic_51/usr/src/lib/pkcs11/pkcs11_softtoken/common/softSlotToken.c (revision 25c28e83beb90e7c80452a7c818c5e6f73a07dc8)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
24  */
25 
26 #include <strings.h>
27 #include <cryptoutil.h>
28 #include <security/cryptoki.h>
29 #include <sys/crypto/common.h>
30 #include <arcfour.h>
31 #include "softGlobal.h"
32 #include "softSession.h"
33 #include <aes_impl.h>
34 #include <blowfish_impl.h>
35 #include <des_impl.h>
36 #include <ecc_impl.h>
37 #include "softDH.h"
38 #include "softObject.h"
39 #include "softKeystore.h"
40 #include "softKeystoreUtil.h"
41 
42 
43 static CK_MECHANISM_TYPE soft_mechanisms[] = {
44 	CKM_DES_CBC,
45 	CKM_DES_CBC_PAD,
46 	CKM_DES_ECB,
47 	CKM_DES_KEY_GEN,
48 	CKM_DES_MAC_GENERAL,
49 	CKM_DES_MAC,
50 	CKM_DES3_CBC,
51 	CKM_DES3_CBC_PAD,
52 	CKM_DES3_ECB,
53 	CKM_DES2_KEY_GEN,
54 	CKM_DES3_KEY_GEN,
55 	CKM_AES_CBC,
56 	CKM_AES_CBC_PAD,
57 	CKM_AES_CTR,
58 	CKM_AES_ECB,
59 	CKM_AES_KEY_GEN,
60 	CKM_BLOWFISH_CBC,
61 	CKM_BLOWFISH_KEY_GEN,
62 	CKM_SHA_1,
63 	CKM_SHA_1_HMAC,
64 	CKM_SHA_1_HMAC_GENERAL,
65 	CKM_SHA256,
66 	CKM_SHA256_HMAC,
67 	CKM_SHA256_HMAC_GENERAL,
68 	CKM_SHA384,
69 	CKM_SHA384_HMAC,
70 	CKM_SHA384_HMAC_GENERAL,
71 	CKM_SHA512,
72 	CKM_SHA512_HMAC,
73 	CKM_SHA512_HMAC_GENERAL,
74 	CKM_SSL3_SHA1_MAC,
75 	CKM_MD5,
76 	CKM_MD5_HMAC,
77 	CKM_MD5_HMAC_GENERAL,
78 	CKM_SSL3_MD5_MAC,
79 	CKM_RC4,
80 	CKM_RC4_KEY_GEN,
81 	CKM_DSA,
82 	CKM_DSA_SHA1,
83 	CKM_DSA_KEY_PAIR_GEN,
84 	CKM_RSA_PKCS,
85 	CKM_RSA_PKCS_KEY_PAIR_GEN,
86 	CKM_RSA_X_509,
87 	CKM_MD5_RSA_PKCS,
88 	CKM_SHA1_RSA_PKCS,
89 	CKM_SHA256_RSA_PKCS,
90 	CKM_SHA384_RSA_PKCS,
91 	CKM_SHA512_RSA_PKCS,
92 	CKM_DH_PKCS_KEY_PAIR_GEN,
93 	CKM_DH_PKCS_DERIVE,
94 	CKM_MD5_KEY_DERIVATION,
95 	CKM_SHA1_KEY_DERIVATION,
96 	CKM_SHA256_KEY_DERIVATION,
97 	CKM_SHA384_KEY_DERIVATION,
98 	CKM_SHA512_KEY_DERIVATION,
99 	CKM_PBE_SHA1_RC4_128,
100 	CKM_PKCS5_PBKD2,
101 	CKM_SSL3_PRE_MASTER_KEY_GEN,
102 	CKM_TLS_PRE_MASTER_KEY_GEN,
103 	CKM_SSL3_MASTER_KEY_DERIVE,
104 	CKM_TLS_MASTER_KEY_DERIVE,
105 	CKM_SSL3_MASTER_KEY_DERIVE_DH,
106 	CKM_TLS_MASTER_KEY_DERIVE_DH,
107 	CKM_SSL3_KEY_AND_MAC_DERIVE,
108 	CKM_TLS_KEY_AND_MAC_DERIVE,
109 	CKM_TLS_PRF,
110 	CKM_EC_KEY_PAIR_GEN,
111 	CKM_ECDSA,
112 	CKM_ECDSA_SHA1,
113 	CKM_ECDH1_DERIVE
114 };
115 
116 /*
117  * This is the table of CK_MECHANISM_INFO structs for the supported mechanisms.
118  * The index for this table is the same as the one above for the same
119  * mechanism.
120  * The minimum and maximum sizes of the key for the mechanism can be measured
121  * in bits or in bytes (i.e. mechanism-dependent). This table specifies the
122  * supported range of key sizes in bytes; unless noted as in bits.
123  */
124 static CK_MECHANISM_INFO soft_mechanism_info[] = {
125 	{DES_MINBYTES, DES_MAXBYTES,
126 		CKF_ENCRYPT|CKF_DECRYPT|
127 		CKF_WRAP|CKF_UNWRAP},		/* CKM_DES_CBC */
128 	{DES_MINBYTES, DES_MAXBYTES,
129 		CKF_ENCRYPT|CKF_DECRYPT|
130 		CKF_WRAP|CKF_UNWRAP},		/* CKM_DES_CBC_PAD */
131 	{DES_MINBYTES, DES_MAXBYTES,
132 		CKF_ENCRYPT|CKF_DECRYPT|
133 		CKF_WRAP|CKF_UNWRAP},		/* CKM_DES_ECB */
134 	{DES_MINBYTES, DES_MAXBYTES,
135 		CKF_GENERATE},			/* CKM_DES_KEY_GEN */
136 	{DES_MINBYTES, DES_MAXBYTES,
137 		CKF_SIGN|CKF_VERIFY},		/* CKM_DES_MAC_GENERAL */
138 	{DES_MINBYTES, DES_MAXBYTES,
139 		CKF_SIGN|CKF_VERIFY},		/* CKM_DES_MAC */
140 	{DES3_MINBYTES, DES3_MAXBYTES,
141 		CKF_ENCRYPT|CKF_DECRYPT|
142 		CKF_WRAP|CKF_UNWRAP},		/* CKM_DES3_CBC */
143 	{DES3_MINBYTES, DES3_MAXBYTES,
144 		CKF_ENCRYPT|CKF_DECRYPT|
145 		CKF_WRAP|CKF_UNWRAP},		/* CKM_DES3_CBC_PAD */
146 	{DES3_MINBYTES, DES3_MAXBYTES,
147 		CKF_ENCRYPT|CKF_DECRYPT|
148 		CKF_WRAP|CKF_UNWRAP},		/* CKM_DES3_ECB */
149 	{DES2_MAXBYTES, DES2_MAXBYTES,
150 		CKF_GENERATE},			/* CKM_DES2_KEY_GEN */
151 	{DES3_MAXBYTES, DES3_MAXBYTES,		/* CKK_DES3 only */
152 		CKF_GENERATE},			/* CKM_DES3_KEY_GEN */
153 	{AES_MINBYTES, AES_MAXBYTES,
154 		CKF_ENCRYPT|CKF_DECRYPT|
155 		CKF_WRAP|CKF_UNWRAP},		/* CKM_AES_CBC */
156 	{AES_MINBYTES, AES_MAXBYTES,
157 		CKF_ENCRYPT|CKF_DECRYPT|
158 		CKF_WRAP|CKF_UNWRAP},		/* CKM_AES_CBC_PAD */
159 	{AES_MINBYTES, AES_MAXBYTES,
160 		CKF_ENCRYPT|CKF_DECRYPT|
161 		CKF_WRAP|CKF_UNWRAP},		/* CKM_AES_CTR */
162 	{AES_MINBYTES, AES_MAXBYTES,
163 		CKF_ENCRYPT|CKF_DECRYPT|
164 		CKF_WRAP|CKF_UNWRAP},		/* CKM_AES_ECB */
165 	{AES_MINBYTES, AES_MAXBYTES,
166 		CKF_GENERATE},			/* CKM_AES_KEY_GEN */
167 	{BLOWFISH_MINBYTES, BLOWFISH_MAXBYTES,
168 		CKF_ENCRYPT|CKF_DECRYPT|
169 		CKF_WRAP|CKF_UNWRAP},		/* CKM_BLOWFISH_ECB */
170 	{BLOWFISH_MINBYTES, BLOWFISH_MAXBYTES,
171 		CKF_GENERATE},			/* CKM_BLOWFISH_KEY_GEN */
172 	{0, 0, CKF_DIGEST},			/* CKM_SHA_1 */
173 	{1, 64, CKF_SIGN|CKF_VERIFY},		/* CKM_SHA_1_HMAC */
174 	{1, 64, CKF_SIGN|CKF_VERIFY},		/* CKM_SHA_1_HMAC_GENERAL */
175 	{0, 0, CKF_DIGEST},			/* CKM_SHA256 */
176 	{1, 64, CKF_SIGN|CKF_VERIFY},		/* CKM_SHA256_HMAC */
177 	{1, 64, CKF_SIGN|CKF_VERIFY},		/* CKM_SHA256_HMAC_GENERAL */
178 	{0, 0, CKF_DIGEST},			/* CKM_SHA384 */
179 	{1, 128, CKF_SIGN|CKF_VERIFY},		/* CKM_SHA384_HMAC */
180 	{1, 128, CKF_SIGN|CKF_VERIFY},		/* CKM_SHA384_HMAC_GENERAL */
181 	{0, 0, CKF_DIGEST},			/* CKM_SHA512 */
182 	{1, 128, CKF_SIGN|CKF_VERIFY},		/* CKM_SHA512_HMAC */
183 	{1, 128, CKF_SIGN|CKF_VERIFY},		/* CKM_SHA512_HMAC_GENERAL */
184 	{1, 512, CKF_SIGN|CKF_VERIFY},		/* CKM_SSL3_SHA1_MAC */
185 	{0, 0, CKF_DIGEST},			/* CKM_MD5 */
186 	{1, 64, CKF_SIGN|CKF_VERIFY},		/* CKM_MD5_HMAC */
187 	{1, 64, CKF_SIGN|CKF_VERIFY},		/* CKM_MD5_HMAC_GENERAL */
188 	{1, 512, CKF_SIGN|CKF_VERIFY},		/* CKM_SSL3_MD5_MAC */
189 	{8, ARCFOUR_MAX_KEY_BITS, CKF_ENCRYPT|CKF_DECRYPT}, /* CKM_RC4; */
190 							    /* in bits  */
191 	{8, ARCFOUR_MAX_KEY_BITS, CKF_GENERATE }, /* CKM_RC4_KEY_GEN; in bits */
192 	{512, 1024, CKF_SIGN|CKF_VERIFY},	/* CKM_DSA; in bits */
193 	{512, 1024, CKF_SIGN|CKF_VERIFY},	/* CKM_DSA_SHA1; in bits */
194 	{512, 1024, CKF_GENERATE_KEY_PAIR},	/* CKM_DSA_KEY_PAIR_GEN; */
195 						/* in bits */
196 	{256, 4096, CKF_ENCRYPT|CKF_DECRYPT|
197 		CKF_SIGN|CKF_SIGN_RECOVER|
198 		CKF_WRAP|CKF_UNWRAP|
199 		CKF_VERIFY|CKF_VERIFY_RECOVER},	/* CKM_RSA_PKCS; in bits */
200 	{256, 4096, CKF_GENERATE_KEY_PAIR},	/* CKM_RSA_PKCS_KEY_PAIR_GEN; */
201 						/* in bits */
202 	{256, 4096, CKF_ENCRYPT|CKF_DECRYPT|
203 		CKF_SIGN|CKF_SIGN_RECOVER|
204 		CKF_WRAP|CKF_UNWRAP|
205 		CKF_VERIFY|CKF_VERIFY_RECOVER},	/* CKM_RSA_X_509 in bits */
206 	{256, 4096, CKF_SIGN|CKF_VERIFY},	/* CKM_MD5_RSA_PKCS in bits */
207 	{256, 4096, CKF_SIGN|CKF_VERIFY},	/* CKM_SHA1_RSA_PKCS in bits */
208 	{256, 4096, CKF_SIGN|CKF_VERIFY}, /* CKM_SHA256_RSA_PKCS in bits */
209 	{256, 4096, CKF_SIGN|CKF_VERIFY}, /* CKM_SHA384_RSA_PKCS in bits */
210 	{256, 4096, CKF_SIGN|CKF_VERIFY}, /* CKM_SHA512_RSA_PKCS in bits */
211 	{DH_MIN_KEY_LEN, DH_MAX_KEY_LEN, CKF_GENERATE_KEY_PAIR},
212 						/* CKM_DH_PKCS_KEY_PAIR_GEN */
213 						/* in bits */
214 	{DH_MIN_KEY_LEN, DH_MAX_KEY_LEN, CKF_DERIVE},
215 						/* CKM_DH_PKCS_DERIVE; */
216 						/* in bits */
217 	{1, 16, CKF_DERIVE},			/* CKM_MD5_KEY_DERIVATION */
218 	{1, 20, CKF_DERIVE},			/* CKM_SHA1_KEY_DERIVATION */
219 	{1, 32, CKF_DERIVE},			/* CKM_SHA256_KEY_DERIVATION */
220 	{1, 48, CKF_DERIVE},			/* CKM_SHA384_KEY_DERIVATION */
221 	{1, 64, CKF_DERIVE},			/* CKM_SHA512_KEY_DERIVATION */
222 	{0, 0, CKF_GENERATE},			/* CKM_PBE_SHA1_RC4_128 */
223 	{0, 0, CKF_GENERATE},			/* CKM_PKCS5_PBKD2 */
224 	{48, 48, CKF_GENERATE},		/* CKM_SSL3_PRE_MASTER_KEY_GEN */
225 	{48, 48, CKF_GENERATE},		/* CKM_TLS_PRE_MASTER_KEY_GEN */
226 	{48, 48, CKF_DERIVE},		/* CKM_SSL3_MASTER_KEY_DERIVE */
227 	{48, 48, CKF_DERIVE},		/* CKM_TLS_MASTER_KEY_DERIVE */
228 	{48, 48, CKF_DERIVE},		/* CKM_SSL3_MASTER_KEY_DERIVE_DH */
229 	{48, 48, CKF_DERIVE},		/* CKM_TLS_MASTER_KEY_DERIVE_DH */
230 	{0, 0, CKF_DERIVE},		/* CKM_SSL3_KEY_AND_MAC_DERIVE */
231 	{0, 0, CKF_DERIVE},		/* CKM_TLS_KEY_AND_MAC_DERIVE */
232 	{0, 0, CKF_DERIVE},		/* CKM_TLS_PRF */
233 	{EC_MIN_KEY_LEN, EC_MAX_KEY_LEN, CKF_GENERATE_KEY_PAIR},
234 	{EC_MIN_KEY_LEN, EC_MAX_KEY_LEN, CKF_SIGN|CKF_VERIFY},
235 	{EC_MIN_KEY_LEN, EC_MAX_KEY_LEN, CKF_SIGN|CKF_VERIFY},
236 	{EC_MIN_KEY_LEN, EC_MAX_KEY_LEN, CKF_DERIVE}
237 };
238 
239 /*
240  * Slot ID for softtoken is always 1. tokenPresent is ignored.
241  * Also, only one slot is used.
242  */
243 /*ARGSUSED*/
244 CK_RV
245 C_GetSlotList(CK_BBOOL tokenPresent, CK_SLOT_ID_PTR pSlotList,
246     CK_ULONG_PTR pulCount)
247 {
248 
249 	CK_RV rv;
250 
251 	if (!softtoken_initialized)
252 		return (CKR_CRYPTOKI_NOT_INITIALIZED);
253 
254 	if (pulCount == NULL) {
255 		return (CKR_ARGUMENTS_BAD);
256 	}
257 
258 	if (pSlotList == NULL) {
259 		/*
260 		 * Application only wants to know the number of slots.
261 		 */
262 		*pulCount = 1;
263 		return (CKR_OK);
264 	}
265 
266 	if ((*pulCount < 1) && (pSlotList != NULL)) {
267 		rv = CKR_BUFFER_TOO_SMALL;
268 	} else {
269 		pSlotList[0] = SOFTTOKEN_SLOTID;
270 		rv = CKR_OK;
271 	}
272 
273 	*pulCount = 1;
274 	return (rv);
275 }
276 
277 
278 CK_RV
279 C_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo)
280 {
281 
282 	if (!softtoken_initialized)
283 		return (CKR_CRYPTOKI_NOT_INITIALIZED);
284 
285 	if (pInfo == NULL)
286 		return (CKR_ARGUMENTS_BAD);
287 
288 	/* Make sure the slot ID is valid */
289 	if (slotID != SOFTTOKEN_SLOTID)
290 		return (CKR_SLOT_ID_INVALID);
291 
292 	/* Provide information about the slot in the provided buffer */
293 	(void) strncpy((char *)pInfo->slotDescription, SOFT_SLOT_DESCRIPTION,
294 	    64);
295 	(void) strncpy((char *)pInfo->manufacturerID, SOFT_MANUFACTURER_ID, 32);
296 	pInfo->flags = CKF_TOKEN_PRESENT;
297 	pInfo->hardwareVersion.major = HARDWARE_VERSION_MAJOR;
298 	pInfo->hardwareVersion.minor = HARDWARE_VERSION_MINOR;
299 	pInfo->firmwareVersion.major = FIRMWARE_VERSION_MAJOR;
300 	pInfo->firmwareVersion.minor = FIRMWARE_VERSION_MINOR;
301 
302 	return (CKR_OK);
303 }
304 
305 CK_RV
306 C_GetTokenInfo(CK_SLOT_ID slotID, CK_TOKEN_INFO_PTR pInfo)
307 {
308 	boolean_t pin_initialized = B_FALSE;
309 	char	*ks_cryptpin = NULL;
310 
311 	if (!softtoken_initialized)
312 		return (CKR_CRYPTOKI_NOT_INITIALIZED);
313 
314 	/* Make sure the slot ID is valid */
315 	if (slotID != SOFTTOKEN_SLOTID)
316 		return (CKR_SLOT_ID_INVALID);
317 
318 	if (pInfo == NULL)
319 		return (CKR_ARGUMENTS_BAD);
320 
321 	/*
322 	 * It is intentional that we don't forward the error code
323 	 * returned from soft_keystore_pin_initialized() to the caller
324 	 */
325 	pInfo->flags = SOFT_TOKEN_FLAGS;
326 	if (soft_slot.keystore_load_status == KEYSTORE_UNAVAILABLE) {
327 		pInfo->flags |= CKF_WRITE_PROTECTED;
328 	} else {
329 		if ((soft_keystore_pin_initialized(&pin_initialized,
330 		    &ks_cryptpin, B_FALSE) == CKR_OK) && !pin_initialized)
331 			pInfo->flags |= CKF_USER_PIN_TO_BE_CHANGED;
332 	}
333 
334 	if (ks_cryptpin)
335 		free(ks_cryptpin);
336 
337 	/* Provide information about a token in the provided buffer */
338 	(void) strncpy((char *)pInfo->label, SOFT_TOKEN_LABEL, 32);
339 	(void) strncpy((char *)pInfo->manufacturerID, SOFT_MANUFACTURER_ID, 32);
340 	(void) strncpy((char *)pInfo->model, TOKEN_MODEL, 16);
341 	(void) strncpy((char *)pInfo->serialNumber, SOFT_TOKEN_SERIAL, 16);
342 
343 	pInfo->ulMaxSessionCount = CK_EFFECTIVELY_INFINITE;
344 	pInfo->ulSessionCount = soft_session_cnt;
345 	pInfo->ulMaxRwSessionCount = CK_EFFECTIVELY_INFINITE;
346 	pInfo->ulRwSessionCount = soft_session_rw_cnt;
347 	pInfo->ulMaxPinLen = MAX_PIN_LEN;
348 	pInfo->ulMinPinLen = MIN_PIN_LEN;
349 	pInfo->ulTotalPublicMemory = CK_UNAVAILABLE_INFORMATION;
350 	pInfo->ulFreePublicMemory = CK_UNAVAILABLE_INFORMATION;
351 	pInfo->ulTotalPrivateMemory = CK_UNAVAILABLE_INFORMATION;
352 	pInfo->ulFreePrivateMemory = CK_UNAVAILABLE_INFORMATION;
353 	pInfo->hardwareVersion.major = HARDWARE_VERSION_MAJOR;
354 	pInfo->hardwareVersion.minor = HARDWARE_VERSION_MINOR;
355 	pInfo->firmwareVersion.major = FIRMWARE_VERSION_MAJOR;
356 	pInfo->firmwareVersion.minor = FIRMWARE_VERSION_MINOR;
357 	(void) memset(pInfo->utcTime, ' ', 16);
358 
359 	return (CKR_OK);
360 }
361 
362 /*ARGSUSED*/
363 CK_RV
364 C_WaitForSlotEvent(CK_FLAGS flags, CK_SLOT_ID_PTR pSlot, CK_VOID_PTR pReserved)
365 {
366 	if (!softtoken_initialized)
367 		return (CKR_CRYPTOKI_NOT_INITIALIZED);
368 
369 	/*
370 	 * This is currently not implemented, however we could cause this
371 	 * to wait for the token files to appear if soft_token_present is
372 	 * false.
373 	 * However there is currently no polite and portable way to do that
374 	 * because we might not even be able to get to an fd to the
375 	 * parent directory, so instead we don't support any slot events.
376 	 */
377 	return (CKR_FUNCTION_NOT_SUPPORTED);
378 }
379 
380 
381 CK_RV
382 C_GetMechanismList(CK_SLOT_ID slotID, CK_MECHANISM_TYPE_PTR pMechanismList,
383     CK_ULONG_PTR pulCount)
384 {
385 
386 	ulong_t i;
387 	ulong_t mechnum;
388 
389 	if (!softtoken_initialized)
390 		return (CKR_CRYPTOKI_NOT_INITIALIZED);
391 
392 	if (slotID != SOFTTOKEN_SLOTID)
393 		return (CKR_SLOT_ID_INVALID);
394 
395 	mechnum = sizeof (soft_mechanisms) / sizeof (CK_MECHANISM_TYPE);
396 
397 	if (pMechanismList == NULL) {
398 		/*
399 		 * Application only wants to know the number of
400 		 * supported mechanism types.
401 		 */
402 		*pulCount = mechnum;
403 		return (CKR_OK);
404 	}
405 
406 	if (*pulCount < mechnum) {
407 		*pulCount = mechnum;
408 		return (CKR_BUFFER_TOO_SMALL);
409 	}
410 
411 	for (i = 0; i < mechnum; i++) {
412 		pMechanismList[i] = soft_mechanisms[i];
413 	}
414 
415 	*pulCount = mechnum;
416 
417 	return (CKR_OK);
418 }
419 
420 
421 CK_RV
422 C_GetMechanismInfo(CK_SLOT_ID slotID, CK_MECHANISM_TYPE type,
423     CK_MECHANISM_INFO_PTR pInfo)
424 {
425 
426 	ulong_t i;
427 	ulong_t mechnum;
428 
429 	if (!softtoken_initialized)
430 		return (CKR_CRYPTOKI_NOT_INITIALIZED);
431 
432 	if (slotID != SOFTTOKEN_SLOTID)
433 		return (CKR_SLOT_ID_INVALID);
434 
435 	if (pInfo == NULL) {
436 		return (CKR_ARGUMENTS_BAD);
437 	}
438 
439 	mechnum = sizeof (soft_mechanisms) / sizeof (CK_MECHANISM_TYPE);
440 	for (i = 0; i < mechnum; i++) {
441 		if (soft_mechanisms[i] == type)
442 			break;
443 	}
444 
445 	if (i == mechnum)
446 		/* unsupported mechanism */
447 		return (CKR_MECHANISM_INVALID);
448 
449 	pInfo->ulMinKeySize = soft_mechanism_info[i].ulMinKeySize;
450 	pInfo->ulMaxKeySize = soft_mechanism_info[i].ulMaxKeySize;
451 	pInfo->flags = soft_mechanism_info[i].flags;
452 
453 	return (CKR_OK);
454 }
455 
456 
457 /*ARGSUSED*/
458 CK_RV
459 C_InitToken(CK_SLOT_ID slotID, CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen,
460     CK_UTF8CHAR_PTR pLabel)
461 {
462 	if (!softtoken_initialized)
463 		return (CKR_CRYPTOKI_NOT_INITIALIZED);
464 
465 	if (create_keystore() != 0)
466 		return (CKR_FUNCTION_FAILED);
467 
468 	return (CKR_OK);
469 }
470 
471 /*ARGSUSED*/
472 CK_RV
473 C_InitPIN(CK_SESSION_HANDLE hSession, CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen)
474 {
475 	if (!softtoken_initialized)
476 		return (CKR_CRYPTOKI_NOT_INITIALIZED);
477 
478 	return (CKR_FUNCTION_NOT_SUPPORTED);
479 }
480 
481 
482 CK_RV
483 C_SetPIN(CK_SESSION_HANDLE hSession, CK_UTF8CHAR_PTR pOldPin,
484     CK_ULONG ulOldPinLen, CK_UTF8CHAR_PTR pNewPin, CK_ULONG ulNewPinLen)
485 {
486 
487 	soft_session_t *session_p;
488 	CK_RV rv;
489 	boolean_t lock_held = B_FALSE;
490 
491 	if (!softtoken_initialized)
492 		return (CKR_CRYPTOKI_NOT_INITIALIZED);
493 
494 	/*
495 	 * Obtain the session pointer. Also, increment the session
496 	 * reference count.
497 	 */
498 	rv = handle2session(hSession, &session_p);
499 	if (rv != CKR_OK)
500 		return (rv);
501 
502 	if (!soft_keystore_status(KEYSTORE_LOAD)) {
503 		SES_REFRELE(session_p, lock_held);
504 		return (CKR_DEVICE_REMOVED);
505 	}
506 
507 	if ((ulOldPinLen < MIN_PIN_LEN) || (ulOldPinLen > MAX_PIN_LEN) ||
508 	    (ulNewPinLen < MIN_PIN_LEN) ||(ulNewPinLen > MAX_PIN_LEN)) {
509 		SES_REFRELE(session_p, lock_held);
510 		return (CKR_PIN_LEN_RANGE);
511 	}
512 
513 	if ((pOldPin == NULL_PTR) || (pNewPin == NULL_PTR)) {
514 		/*
515 		 * We don't support CKF_PROTECTED_AUTHENTICATION_PATH
516 		 */
517 		SES_REFRELE(session_p, lock_held);
518 		return (CKR_ARGUMENTS_BAD);
519 	}
520 
521 	/* check the state of the session */
522 	if ((session_p->state != CKS_RW_PUBLIC_SESSION) &&
523 	    (session_p->state != CKS_RW_USER_FUNCTIONS)) {
524 		SES_REFRELE(session_p, lock_held);
525 		return (CKR_SESSION_READ_ONLY);
526 	}
527 
528 	rv = soft_setpin(pOldPin, ulOldPinLen, pNewPin, ulNewPinLen);
529 
530 	SES_REFRELE(session_p, lock_held);
531 	return (rv);
532 }
533