1*7c478bd9Sstevel@tonic-gate /*
2*7c478bd9Sstevel@tonic-gate * CDDL HEADER START
3*7c478bd9Sstevel@tonic-gate *
4*7c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5*7c478bd9Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only
6*7c478bd9Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance
7*7c478bd9Sstevel@tonic-gate * with the License.
8*7c478bd9Sstevel@tonic-gate *
9*7c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10*7c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
11*7c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
12*7c478bd9Sstevel@tonic-gate * and limitations under the License.
13*7c478bd9Sstevel@tonic-gate *
14*7c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
15*7c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16*7c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
17*7c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
18*7c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
19*7c478bd9Sstevel@tonic-gate *
20*7c478bd9Sstevel@tonic-gate * CDDL HEADER END
21*7c478bd9Sstevel@tonic-gate */
22*7c478bd9Sstevel@tonic-gate /*
23*7c478bd9Sstevel@tonic-gate * Copyright 2003 Sun Microsystems, Inc. All rights reserved.
24*7c478bd9Sstevel@tonic-gate * Use is subject to license terms.
25*7c478bd9Sstevel@tonic-gate */
26*7c478bd9Sstevel@tonic-gate
27*7c478bd9Sstevel@tonic-gate #include <security/cryptoki.h>
28*7c478bd9Sstevel@tonic-gate #include "pkcs11Global.h"
29*7c478bd9Sstevel@tonic-gate #include "pkcs11Conf.h"
30*7c478bd9Sstevel@tonic-gate #include "pkcs11Session.h"
31*7c478bd9Sstevel@tonic-gate #include "pkcs11Slot.h"
32*7c478bd9Sstevel@tonic-gate
33*7c478bd9Sstevel@tonic-gate /*
34*7c478bd9Sstevel@tonic-gate * C_GenerateKey will verify that the session handle is valid within
35*7c478bd9Sstevel@tonic-gate * the framework, that the mechanism is not disabled for the slot
36*7c478bd9Sstevel@tonic-gate * associated with this session, and then redirect to the underlying
37*7c478bd9Sstevel@tonic-gate * provider.
38*7c478bd9Sstevel@tonic-gate */
39*7c478bd9Sstevel@tonic-gate CK_RV
C_GenerateKey(CK_SESSION_HANDLE hSession,CK_MECHANISM_PTR pMechanism,CK_ATTRIBUTE_PTR pTemplate,CK_ULONG ulCount,CK_OBJECT_HANDLE_PTR phKey)40*7c478bd9Sstevel@tonic-gate C_GenerateKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
41*7c478bd9Sstevel@tonic-gate CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount, CK_OBJECT_HANDLE_PTR phKey)
42*7c478bd9Sstevel@tonic-gate {
43*7c478bd9Sstevel@tonic-gate CK_RV rv;
44*7c478bd9Sstevel@tonic-gate pkcs11_session_t *sessp;
45*7c478bd9Sstevel@tonic-gate CK_SLOT_ID slotid;
46*7c478bd9Sstevel@tonic-gate
47*7c478bd9Sstevel@tonic-gate /* Check for a fastpath */
48*7c478bd9Sstevel@tonic-gate if (purefastpath || policyfastpath) {
49*7c478bd9Sstevel@tonic-gate if (policyfastpath &&
50*7c478bd9Sstevel@tonic-gate pkcs11_is_dismech(fast_slot, pMechanism->mechanism)) {
51*7c478bd9Sstevel@tonic-gate return (CKR_MECHANISM_INVALID);
52*7c478bd9Sstevel@tonic-gate }
53*7c478bd9Sstevel@tonic-gate return (fast_funcs->C_GenerateKey(hSession, pMechanism,
54*7c478bd9Sstevel@tonic-gate pTemplate, ulCount, phKey));
55*7c478bd9Sstevel@tonic-gate }
56*7c478bd9Sstevel@tonic-gate
57*7c478bd9Sstevel@tonic-gate if (!pkcs11_initialized) {
58*7c478bd9Sstevel@tonic-gate return (CKR_CRYPTOKI_NOT_INITIALIZED);
59*7c478bd9Sstevel@tonic-gate }
60*7c478bd9Sstevel@tonic-gate
61*7c478bd9Sstevel@tonic-gate /* Obtain the session pointer */
62*7c478bd9Sstevel@tonic-gate HANDLE2SESSION(hSession, sessp, rv);
63*7c478bd9Sstevel@tonic-gate
64*7c478bd9Sstevel@tonic-gate if (rv != CKR_OK) {
65*7c478bd9Sstevel@tonic-gate return (rv);
66*7c478bd9Sstevel@tonic-gate }
67*7c478bd9Sstevel@tonic-gate
68*7c478bd9Sstevel@tonic-gate slotid = sessp->se_slotid;
69*7c478bd9Sstevel@tonic-gate
70*7c478bd9Sstevel@tonic-gate /* Make sure this is not a disabled mechanism */
71*7c478bd9Sstevel@tonic-gate if (pkcs11_is_dismech(slotid, pMechanism->mechanism)) {
72*7c478bd9Sstevel@tonic-gate return (CKR_MECHANISM_INVALID);
73*7c478bd9Sstevel@tonic-gate }
74*7c478bd9Sstevel@tonic-gate
75*7c478bd9Sstevel@tonic-gate /* Initialize the digest with the underlying provider */
76*7c478bd9Sstevel@tonic-gate rv = FUNCLIST(slotid)->C_GenerateKey(sessp->se_handle,
77*7c478bd9Sstevel@tonic-gate pMechanism, pTemplate, ulCount, phKey);
78*7c478bd9Sstevel@tonic-gate
79*7c478bd9Sstevel@tonic-gate /* Present consistent interface to the application */
80*7c478bd9Sstevel@tonic-gate if (rv == CKR_FUNCTION_NOT_SUPPORTED) {
81*7c478bd9Sstevel@tonic-gate return (CKR_FUNCTION_FAILED);
82*7c478bd9Sstevel@tonic-gate }
83*7c478bd9Sstevel@tonic-gate
84*7c478bd9Sstevel@tonic-gate return (rv);
85*7c478bd9Sstevel@tonic-gate
86*7c478bd9Sstevel@tonic-gate }
87*7c478bd9Sstevel@tonic-gate
88*7c478bd9Sstevel@tonic-gate /*
89*7c478bd9Sstevel@tonic-gate * C_GenerateKeyPair will verify that the session handle is valid within
90*7c478bd9Sstevel@tonic-gate * the framework, that the mechanism is not disabled for the slot
91*7c478bd9Sstevel@tonic-gate * associated with this session, and then redirect to the underlying
92*7c478bd9Sstevel@tonic-gate * provider.
93*7c478bd9Sstevel@tonic-gate */
94*7c478bd9Sstevel@tonic-gate CK_RV
C_GenerateKeyPair(CK_SESSION_HANDLE hSession,CK_MECHANISM_PTR pMechanism,CK_ATTRIBUTE_PTR pPublicKeyTemplate,CK_ULONG ulPublicKeyAttributeCount,CK_ATTRIBUTE_PTR pPrivateKeyTemplate,CK_ULONG ulPrivateKeyAttributeCount,CK_OBJECT_HANDLE_PTR phPublicKey,CK_OBJECT_HANDLE_PTR phPrivateKey)95*7c478bd9Sstevel@tonic-gate C_GenerateKeyPair(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
96*7c478bd9Sstevel@tonic-gate CK_ATTRIBUTE_PTR pPublicKeyTemplate, CK_ULONG ulPublicKeyAttributeCount,
97*7c478bd9Sstevel@tonic-gate CK_ATTRIBUTE_PTR pPrivateKeyTemplate, CK_ULONG ulPrivateKeyAttributeCount,
98*7c478bd9Sstevel@tonic-gate CK_OBJECT_HANDLE_PTR phPublicKey, CK_OBJECT_HANDLE_PTR phPrivateKey)
99*7c478bd9Sstevel@tonic-gate {
100*7c478bd9Sstevel@tonic-gate CK_RV rv;
101*7c478bd9Sstevel@tonic-gate pkcs11_session_t *sessp;
102*7c478bd9Sstevel@tonic-gate CK_SLOT_ID slotid;
103*7c478bd9Sstevel@tonic-gate
104*7c478bd9Sstevel@tonic-gate
105*7c478bd9Sstevel@tonic-gate /* Check for a fastpath */
106*7c478bd9Sstevel@tonic-gate if (purefastpath || policyfastpath) {
107*7c478bd9Sstevel@tonic-gate if (policyfastpath &&
108*7c478bd9Sstevel@tonic-gate pkcs11_is_dismech(fast_slot, pMechanism->mechanism)) {
109*7c478bd9Sstevel@tonic-gate return (CKR_MECHANISM_INVALID);
110*7c478bd9Sstevel@tonic-gate }
111*7c478bd9Sstevel@tonic-gate return (fast_funcs->C_GenerateKeyPair(hSession, pMechanism,
112*7c478bd9Sstevel@tonic-gate pPublicKeyTemplate, ulPublicKeyAttributeCount,
113*7c478bd9Sstevel@tonic-gate pPrivateKeyTemplate, ulPrivateKeyAttributeCount,
114*7c478bd9Sstevel@tonic-gate phPublicKey, phPrivateKey));
115*7c478bd9Sstevel@tonic-gate }
116*7c478bd9Sstevel@tonic-gate
117*7c478bd9Sstevel@tonic-gate if (!pkcs11_initialized) {
118*7c478bd9Sstevel@tonic-gate return (CKR_CRYPTOKI_NOT_INITIALIZED);
119*7c478bd9Sstevel@tonic-gate }
120*7c478bd9Sstevel@tonic-gate
121*7c478bd9Sstevel@tonic-gate /* Obtain the session pointer */
122*7c478bd9Sstevel@tonic-gate HANDLE2SESSION(hSession, sessp, rv);
123*7c478bd9Sstevel@tonic-gate
124*7c478bd9Sstevel@tonic-gate if (rv != CKR_OK) {
125*7c478bd9Sstevel@tonic-gate return (rv);
126*7c478bd9Sstevel@tonic-gate }
127*7c478bd9Sstevel@tonic-gate
128*7c478bd9Sstevel@tonic-gate slotid = sessp->se_slotid;
129*7c478bd9Sstevel@tonic-gate
130*7c478bd9Sstevel@tonic-gate /* Make sure this is not a disabled mechanism */
131*7c478bd9Sstevel@tonic-gate if (pkcs11_is_dismech(slotid, pMechanism->mechanism)) {
132*7c478bd9Sstevel@tonic-gate return (CKR_MECHANISM_INVALID);
133*7c478bd9Sstevel@tonic-gate }
134*7c478bd9Sstevel@tonic-gate
135*7c478bd9Sstevel@tonic-gate /* Initialize the digest with the underlying provider */
136*7c478bd9Sstevel@tonic-gate rv = FUNCLIST(slotid)->C_GenerateKeyPair(sessp->se_handle,
137*7c478bd9Sstevel@tonic-gate pMechanism, pPublicKeyTemplate, ulPublicKeyAttributeCount,
138*7c478bd9Sstevel@tonic-gate pPrivateKeyTemplate, ulPrivateKeyAttributeCount,
139*7c478bd9Sstevel@tonic-gate phPublicKey, phPrivateKey);
140*7c478bd9Sstevel@tonic-gate
141*7c478bd9Sstevel@tonic-gate /* Present consistent interface to the application */
142*7c478bd9Sstevel@tonic-gate if (rv == CKR_FUNCTION_NOT_SUPPORTED) {
143*7c478bd9Sstevel@tonic-gate return (CKR_FUNCTION_FAILED);
144*7c478bd9Sstevel@tonic-gate }
145*7c478bd9Sstevel@tonic-gate
146*7c478bd9Sstevel@tonic-gate return (rv);
147*7c478bd9Sstevel@tonic-gate }
148*7c478bd9Sstevel@tonic-gate
149*7c478bd9Sstevel@tonic-gate /*
150*7c478bd9Sstevel@tonic-gate * C_WrapKey will verify that the session handle is valid within
151*7c478bd9Sstevel@tonic-gate * the framework, that the mechanism is not disabled for the slot
152*7c478bd9Sstevel@tonic-gate * associated with this session, and then redirect to the underlying
153*7c478bd9Sstevel@tonic-gate * provider.
154*7c478bd9Sstevel@tonic-gate */
155*7c478bd9Sstevel@tonic-gate CK_RV
C_WrapKey(CK_SESSION_HANDLE hSession,CK_MECHANISM_PTR pMechanism,CK_OBJECT_HANDLE hWrappingKey,CK_OBJECT_HANDLE hKey,CK_BYTE_PTR pWrappedKey,CK_ULONG_PTR pulWrappedKeyLen)156*7c478bd9Sstevel@tonic-gate C_WrapKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
157*7c478bd9Sstevel@tonic-gate CK_OBJECT_HANDLE hWrappingKey, CK_OBJECT_HANDLE hKey,
158*7c478bd9Sstevel@tonic-gate CK_BYTE_PTR pWrappedKey, CK_ULONG_PTR pulWrappedKeyLen)
159*7c478bd9Sstevel@tonic-gate {
160*7c478bd9Sstevel@tonic-gate CK_RV rv;
161*7c478bd9Sstevel@tonic-gate pkcs11_session_t *sessp;
162*7c478bd9Sstevel@tonic-gate CK_SLOT_ID slotid;
163*7c478bd9Sstevel@tonic-gate
164*7c478bd9Sstevel@tonic-gate /* Check for a fastpath */
165*7c478bd9Sstevel@tonic-gate if (purefastpath || policyfastpath) {
166*7c478bd9Sstevel@tonic-gate if (policyfastpath &&
167*7c478bd9Sstevel@tonic-gate pkcs11_is_dismech(fast_slot, pMechanism->mechanism)) {
168*7c478bd9Sstevel@tonic-gate return (CKR_MECHANISM_INVALID);
169*7c478bd9Sstevel@tonic-gate }
170*7c478bd9Sstevel@tonic-gate return (fast_funcs->C_WrapKey(hSession, pMechanism,
171*7c478bd9Sstevel@tonic-gate hWrappingKey, hKey, pWrappedKey,
172*7c478bd9Sstevel@tonic-gate pulWrappedKeyLen));
173*7c478bd9Sstevel@tonic-gate }
174*7c478bd9Sstevel@tonic-gate
175*7c478bd9Sstevel@tonic-gate if (!pkcs11_initialized) {
176*7c478bd9Sstevel@tonic-gate return (CKR_CRYPTOKI_NOT_INITIALIZED);
177*7c478bd9Sstevel@tonic-gate }
178*7c478bd9Sstevel@tonic-gate
179*7c478bd9Sstevel@tonic-gate /* Obtain the session pointer */
180*7c478bd9Sstevel@tonic-gate HANDLE2SESSION(hSession, sessp, rv);
181*7c478bd9Sstevel@tonic-gate
182*7c478bd9Sstevel@tonic-gate if (rv != CKR_OK) {
183*7c478bd9Sstevel@tonic-gate return (rv);
184*7c478bd9Sstevel@tonic-gate }
185*7c478bd9Sstevel@tonic-gate
186*7c478bd9Sstevel@tonic-gate slotid = sessp->se_slotid;
187*7c478bd9Sstevel@tonic-gate
188*7c478bd9Sstevel@tonic-gate /* Make sure this is not a disabled mechanism */
189*7c478bd9Sstevel@tonic-gate if (pkcs11_is_dismech(slotid, pMechanism->mechanism)) {
190*7c478bd9Sstevel@tonic-gate return (CKR_MECHANISM_INVALID);
191*7c478bd9Sstevel@tonic-gate }
192*7c478bd9Sstevel@tonic-gate
193*7c478bd9Sstevel@tonic-gate /* Initialize the digest with the underlying provider */
194*7c478bd9Sstevel@tonic-gate rv = FUNCLIST(slotid)->C_WrapKey(sessp->se_handle,
195*7c478bd9Sstevel@tonic-gate pMechanism, hWrappingKey, hKey, pWrappedKey, pulWrappedKeyLen);
196*7c478bd9Sstevel@tonic-gate
197*7c478bd9Sstevel@tonic-gate /* Present consistent interface to the application */
198*7c478bd9Sstevel@tonic-gate if (rv == CKR_FUNCTION_NOT_SUPPORTED) {
199*7c478bd9Sstevel@tonic-gate return (CKR_FUNCTION_FAILED);
200*7c478bd9Sstevel@tonic-gate }
201*7c478bd9Sstevel@tonic-gate
202*7c478bd9Sstevel@tonic-gate return (rv);
203*7c478bd9Sstevel@tonic-gate }
204*7c478bd9Sstevel@tonic-gate
205*7c478bd9Sstevel@tonic-gate /*
206*7c478bd9Sstevel@tonic-gate * C_UnwrapKey will verify that the session handle is valid within
207*7c478bd9Sstevel@tonic-gate * the framework, that the mechanism is not disabled for the slot
208*7c478bd9Sstevel@tonic-gate * associated with this session, and then redirect to the underlying
209*7c478bd9Sstevel@tonic-gate * provider.
210*7c478bd9Sstevel@tonic-gate */
211*7c478bd9Sstevel@tonic-gate CK_RV
C_UnwrapKey(CK_SESSION_HANDLE hSession,CK_MECHANISM_PTR pMechanism,CK_OBJECT_HANDLE hUnwrappingKey,CK_BYTE_PTR pWrappedKey,CK_ULONG ulWrappedKeyLen,CK_ATTRIBUTE_PTR pTemplate,CK_ULONG ulAttributeCount,CK_OBJECT_HANDLE_PTR phKey)212*7c478bd9Sstevel@tonic-gate C_UnwrapKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
213*7c478bd9Sstevel@tonic-gate CK_OBJECT_HANDLE hUnwrappingKey, CK_BYTE_PTR pWrappedKey,
214*7c478bd9Sstevel@tonic-gate CK_ULONG ulWrappedKeyLen, CK_ATTRIBUTE_PTR pTemplate,
215*7c478bd9Sstevel@tonic-gate CK_ULONG ulAttributeCount, CK_OBJECT_HANDLE_PTR phKey)
216*7c478bd9Sstevel@tonic-gate {
217*7c478bd9Sstevel@tonic-gate CK_RV rv;
218*7c478bd9Sstevel@tonic-gate pkcs11_session_t *sessp;
219*7c478bd9Sstevel@tonic-gate CK_SLOT_ID slotid;
220*7c478bd9Sstevel@tonic-gate
221*7c478bd9Sstevel@tonic-gate /* Check for a fastpath */
222*7c478bd9Sstevel@tonic-gate if (purefastpath || policyfastpath) {
223*7c478bd9Sstevel@tonic-gate if (policyfastpath &&
224*7c478bd9Sstevel@tonic-gate pkcs11_is_dismech(fast_slot, pMechanism->mechanism)) {
225*7c478bd9Sstevel@tonic-gate return (CKR_MECHANISM_INVALID);
226*7c478bd9Sstevel@tonic-gate }
227*7c478bd9Sstevel@tonic-gate return (fast_funcs->C_UnwrapKey(hSession, pMechanism,
228*7c478bd9Sstevel@tonic-gate hUnwrappingKey, pWrappedKey, ulWrappedKeyLen,
229*7c478bd9Sstevel@tonic-gate pTemplate, ulAttributeCount, phKey));
230*7c478bd9Sstevel@tonic-gate }
231*7c478bd9Sstevel@tonic-gate
232*7c478bd9Sstevel@tonic-gate if (!pkcs11_initialized) {
233*7c478bd9Sstevel@tonic-gate return (CKR_CRYPTOKI_NOT_INITIALIZED);
234*7c478bd9Sstevel@tonic-gate }
235*7c478bd9Sstevel@tonic-gate
236*7c478bd9Sstevel@tonic-gate /* Obtain the session pointer */
237*7c478bd9Sstevel@tonic-gate HANDLE2SESSION(hSession, sessp, rv);
238*7c478bd9Sstevel@tonic-gate
239*7c478bd9Sstevel@tonic-gate if (rv != CKR_OK) {
240*7c478bd9Sstevel@tonic-gate return (rv);
241*7c478bd9Sstevel@tonic-gate }
242*7c478bd9Sstevel@tonic-gate
243*7c478bd9Sstevel@tonic-gate slotid = sessp->se_slotid;
244*7c478bd9Sstevel@tonic-gate
245*7c478bd9Sstevel@tonic-gate /* Make sure this is not a disabled mechanism */
246*7c478bd9Sstevel@tonic-gate if (pkcs11_is_dismech(slotid, pMechanism->mechanism)) {
247*7c478bd9Sstevel@tonic-gate return (CKR_MECHANISM_INVALID);
248*7c478bd9Sstevel@tonic-gate }
249*7c478bd9Sstevel@tonic-gate
250*7c478bd9Sstevel@tonic-gate /* Initialize the digest with the underlying provider */
251*7c478bd9Sstevel@tonic-gate rv = FUNCLIST(slotid)->C_UnwrapKey(sessp->se_handle,
252*7c478bd9Sstevel@tonic-gate pMechanism, hUnwrappingKey, pWrappedKey, ulWrappedKeyLen,
253*7c478bd9Sstevel@tonic-gate pTemplate, ulAttributeCount, phKey);
254*7c478bd9Sstevel@tonic-gate
255*7c478bd9Sstevel@tonic-gate /* Present consistent interface to the application */
256*7c478bd9Sstevel@tonic-gate if (rv == CKR_FUNCTION_NOT_SUPPORTED) {
257*7c478bd9Sstevel@tonic-gate return (CKR_FUNCTION_FAILED);
258*7c478bd9Sstevel@tonic-gate }
259*7c478bd9Sstevel@tonic-gate
260*7c478bd9Sstevel@tonic-gate return (rv);
261*7c478bd9Sstevel@tonic-gate }
262*7c478bd9Sstevel@tonic-gate
263*7c478bd9Sstevel@tonic-gate /*
264*7c478bd9Sstevel@tonic-gate * C_DeriveKey will verify that the session handle is valid within
265*7c478bd9Sstevel@tonic-gate * the framework, that the mechanism is not disabled for the slot
266*7c478bd9Sstevel@tonic-gate * associated with this session, and then redirect to the underlying
267*7c478bd9Sstevel@tonic-gate * provider.
268*7c478bd9Sstevel@tonic-gate */
269*7c478bd9Sstevel@tonic-gate CK_RV
C_DeriveKey(CK_SESSION_HANDLE hSession,CK_MECHANISM_PTR pMechanism,CK_OBJECT_HANDLE hBaseKey,CK_ATTRIBUTE_PTR pTemplate,CK_ULONG ulAttributeCount,CK_OBJECT_HANDLE_PTR phKey)270*7c478bd9Sstevel@tonic-gate C_DeriveKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
271*7c478bd9Sstevel@tonic-gate CK_OBJECT_HANDLE hBaseKey, CK_ATTRIBUTE_PTR pTemplate,
272*7c478bd9Sstevel@tonic-gate CK_ULONG ulAttributeCount, CK_OBJECT_HANDLE_PTR phKey)
273*7c478bd9Sstevel@tonic-gate {
274*7c478bd9Sstevel@tonic-gate CK_RV rv;
275*7c478bd9Sstevel@tonic-gate pkcs11_session_t *sessp;
276*7c478bd9Sstevel@tonic-gate CK_SLOT_ID slotid;
277*7c478bd9Sstevel@tonic-gate
278*7c478bd9Sstevel@tonic-gate /* Check for a fastpath */
279*7c478bd9Sstevel@tonic-gate if (purefastpath || policyfastpath) {
280*7c478bd9Sstevel@tonic-gate if (policyfastpath &&
281*7c478bd9Sstevel@tonic-gate pkcs11_is_dismech(fast_slot, pMechanism->mechanism)) {
282*7c478bd9Sstevel@tonic-gate return (CKR_MECHANISM_INVALID);
283*7c478bd9Sstevel@tonic-gate }
284*7c478bd9Sstevel@tonic-gate return (fast_funcs->C_DeriveKey(hSession, pMechanism,
285*7c478bd9Sstevel@tonic-gate hBaseKey, pTemplate, ulAttributeCount, phKey));
286*7c478bd9Sstevel@tonic-gate }
287*7c478bd9Sstevel@tonic-gate
288*7c478bd9Sstevel@tonic-gate if (!pkcs11_initialized) {
289*7c478bd9Sstevel@tonic-gate return (CKR_CRYPTOKI_NOT_INITIALIZED);
290*7c478bd9Sstevel@tonic-gate }
291*7c478bd9Sstevel@tonic-gate
292*7c478bd9Sstevel@tonic-gate /* Obtain the session pointer */
293*7c478bd9Sstevel@tonic-gate HANDLE2SESSION(hSession, sessp, rv);
294*7c478bd9Sstevel@tonic-gate
295*7c478bd9Sstevel@tonic-gate if (rv != CKR_OK) {
296*7c478bd9Sstevel@tonic-gate return (rv);
297*7c478bd9Sstevel@tonic-gate }
298*7c478bd9Sstevel@tonic-gate
299*7c478bd9Sstevel@tonic-gate slotid = sessp->se_slotid;
300*7c478bd9Sstevel@tonic-gate
301*7c478bd9Sstevel@tonic-gate /* Make sure this is not a disabled mechanism */
302*7c478bd9Sstevel@tonic-gate if (pkcs11_is_dismech(slotid, pMechanism->mechanism)) {
303*7c478bd9Sstevel@tonic-gate return (CKR_MECHANISM_INVALID);
304*7c478bd9Sstevel@tonic-gate }
305*7c478bd9Sstevel@tonic-gate
306*7c478bd9Sstevel@tonic-gate /* Initialize the digest with the underlying provider */
307*7c478bd9Sstevel@tonic-gate rv = FUNCLIST(slotid)->C_DeriveKey(sessp->se_handle,
308*7c478bd9Sstevel@tonic-gate pMechanism, hBaseKey, pTemplate, ulAttributeCount, phKey);
309*7c478bd9Sstevel@tonic-gate
310*7c478bd9Sstevel@tonic-gate /* Present consistent interface to the application */
311*7c478bd9Sstevel@tonic-gate if (rv == CKR_FUNCTION_NOT_SUPPORTED) {
312*7c478bd9Sstevel@tonic-gate return (CKR_FUNCTION_FAILED);
313*7c478bd9Sstevel@tonic-gate }
314*7c478bd9Sstevel@tonic-gate
315*7c478bd9Sstevel@tonic-gate return (rv);
316*7c478bd9Sstevel@tonic-gate }
317