pkcs11c.c

Bug Summary

File:	s/lib/softoken/pkcs11c.c
Warning:	line 3268, column 13 Null pointer passed to 2nd parameter expecting 'nonnull'
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name pkcs11c.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/var/lib/jenkins/workspace/nss-scan-build/nss/lib/softoken -ffunction-sections -fdata-sections -fcoverage-compilation-dir=/var/lib/jenkins/workspace/nss-scan-build/nss/lib/softoken -resource-dir /usr/lib/llvm-18/lib/clang/18 -D HAVE_STRERROR -D LINUX -D linux -D XP_UNIX -D XP_UNIX -D SHLIB_SUFFIX="so" -D SHLIB_PREFIX="lib" -D SOFTOKEN_LIB_NAME="libsoftokn3.so" -D SHLIB_VERSION="3" -D DEBUG -U NDEBUG -D _DEFAULT_SOURCE -D _BSD_SOURCE -D _POSIX_SOURCE -D SDB_MEASURE_USE_TEMP_DIR -D _REENTRANT -D DEBUG -U NDEBUG -D _DEFAULT_SOURCE -D _BSD_SOURCE -D _POSIX_SOURCE -D SDB_MEASURE_USE_TEMP_DIR -D _REENTRANT -D NSS_DISABLE_SSE3 -D NSS_NO_INIT_SUPPORT -D USE_UTIL_DIRECTLY -D NO_NSPR_10_SUPPORT -D SSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES -I ../../../dist/Linux4.19_x86_64_gcc_glibc_PTH_64_DBG.OBJ/include -I ../../../dist/public/nss -I ../../../dist/private/nss -internal-isystem /usr/lib/llvm-18/lib/clang/18/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -std=c99 -ferror-limit 19 -fgnuc-version=4.2.1 -analyzer-output=html -analyzer-config stable-report-filename=true -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/scan-build-2024-05-18-082241-28900-1 -x c pkcs11c.c
1/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
4/*
* This file implements PKCS 11 on top of our existing security modules
*
* For more information about PKCS 11 See PKCS 11 Token Inteface Standard.
*   This implementation has two slots:
*      slot 1 is our generic crypto support. It does not require login.
*   It supports Public Key ops, and all they bulk ciphers and hashes.
*   It can also support Private Key ops for imported Private keys. It does
*   not have any token storage.
*      slot 2 is our private key support. It requires a login before use. It
*   can store Private Keys and Certs as token objects. Currently only private
*   keys and their associated Certificates are saved on the token.
*
*   In this implementation, session objects are only visible to the session
*   that created or generated them.
*/

21#include <limits.h> /* for UINT_MAX and ULONG_MAX */

23#include "seccomon.h"
24#include "secitem.h"
25#include "secport.h"
26#include "blapi.h"
27#include "pkcs11.h"
28#include "pkcs11i.h"
29#include "pkcs1sig.h"
30#include "lowkeyi.h"
31#include "secder.h"
32#include "secdig.h"
33#include "lowpbe.h" /* We do PBE below */
34#include "pkcs11t.h"
35#include "secoid.h"
36#include "cmac.h"
37#include "alghmac.h"
38#include "softoken.h"
39#include "secasn1.h"
40#include "secerr.h"
41#include "kem.h"
42#include "kyber.h"

44#include "prprf.h"
45#include "prenv.h"

47#define __PASTE(x, y)xy x##y
48#define BAD_PARAM_CAST(pMech, typeSize)(!pMech->pParameter || pMech->ulParameterLen < typeSize
) (!pMech->pParameter || pMech->ulParameterLen < typeSize)
49/*
* we renamed all our internal functions, get the correct
* definitions for them...
*/
53#undef CK_PKCS11_FUNCTION_INFO
54#undef CK_NEED_ARG_LIST1

56#define CK_PKCS11_3_01 1

58#define CK_EXTERNextern extern
59#define CK_PKCS11_FUNCTION_INFO(func)CK_RV NSfunc \
  CK_RV __PASTE(NS, func)NSfunc
61#define CK_NEED_ARG_LIST1 1

63#include "pkcs11f.h"

65/* create a definition of SHA1 that's consistent
* with the rest of the CKM_SHAxxx hashes*/
67#define CKM_SHA10x00000220UL CKM_SHA_10x00000220UL
68#define CKM_SHA1_HMAC0x00000221UL CKM_SHA_1_HMAC0x00000221UL
69#define CKM_SHA1_HMAC_GENERAL0x00000222UL CKM_SHA_1_HMAC_GENERAL0x00000222UL

71typedef struct {
  PRUint8 client_version[2];
  PRUint8 random[46];
74} SSL3RSAPreMasterSecret;

76static void
77sftk_Null(void *data, PRBool freeit)
78{
  return;
80}

82#ifdef EC_DEBUG
83#define SEC_PRINT(str1, str2, num, sitem)             \
  printf("pkcs11c.c:%s:%s (keytype=%d) [len=%d]\n", \
         str1, str2, num, sitem->len);              \
  for (i = 0; i < sitem->len; i++) {                \
      printf("%02x:", sitem->data[i]);              \
  }                                                 \
  printf("\n")
90#else
91#undef EC_DEBUG
92#define SEC_PRINT(a, b, c, d)
93#endif

95/*
* free routines.... Free local type  allocated data, and convert
* other free routines to the destroy signature.
*/
99static void
100sftk_FreePrivKey(NSSLOWKEYPrivateKey *key, PRBool freeit)
101{
  nsslowkey_DestroyPrivateKey(key);
103}

105static void
106sftk_Space(void *data, PRBool freeit)
107{
  PORT_FreePORT_Free_Util(data);
109}

111static void
112sftk_ZSpace(void *data, PRBool freeit)
113{
  size_t len = *(size_t *)data;
  PORT_ZFreePORT_ZFree_Util(data, len);
116}

118/*
* turn a CDMF key into a des key. CDMF is an old IBM scheme to export DES by
* Deprecating a full des key to 40 bit key strenth.
*/
122static CK_RV
123sftk_cdmf2des(unsigned char *cdmfkey, unsigned char *deskey)
124{
  unsigned char key1[8] = { 0xc4, 0x08, 0xb0, 0x54, 0x0b, 0xa1, 0xe0, 0xae };
  unsigned char key2[8] = { 0xef, 0x2c, 0x04, 0x1c, 0xe6, 0x38, 0x2f, 0xe6 };
  unsigned char enc_src[8];
  unsigned char enc_dest[8];
  unsigned int leng, i;
  DESContext *descx;
  SECStatus rv;
  CK_RV crv = CKR_OK0x00000000UL;

  /* zero the parity bits */
  for (i = 0; i < 8; i++) {
      enc_src[i] = cdmfkey[i] & 0xfe;
  }

  /* encrypt with key 1 */
  descx = DES_CreateContext(key1, NULL((void*)0), NSS_DES0, PR_TRUE1);
  if (descx == NULL((void*)0)) {
      crv = CKR_HOST_MEMORY0x00000002UL;
      goto done;
  }
  rv = DES_Encrypt(descx, enc_dest, &leng, 8, enc_src, 8);
  DES_DestroyContext(descx, PR_TRUE1);
  if (rv != SECSuccess) {
      crv = sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
      goto done;
  }

  /* xor source with des, zero the parity bits and deprecate the key*/
  for (i = 0; i < 8; i++) {
      if (i & 1) {
          enc_src[i] = (enc_src[i] ^ enc_dest[i]) & 0xfe;
      } else {
          enc_src[i] = (enc_src[i] ^ enc_dest[i]) & 0x0e;
      }
  }

  /* encrypt with key 2 */
  descx = DES_CreateContext(key2, NULL((void*)0), NSS_DES0, PR_TRUE1);
  if (descx == NULL((void*)0)) {
      crv = CKR_HOST_MEMORY0x00000002UL;
      goto done;
  }
  rv = DES_Encrypt(descx, deskey, &leng, 8, enc_src, 8);
  DES_DestroyContext(descx, PR_TRUE1);
  if (rv != SECSuccess) {
      crv = sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
      goto done;
  }

  /* set the corret parity on our new des key */
  sftk_FormatDESKey(deskey, 8);
176done:
  PORT_Memsetmemset(enc_src, 0, sizeof enc_src);
  PORT_Memsetmemset(enc_dest, 0, sizeof enc_dest);
  return crv;
180}

182/* NSC_DestroyObject destroys an object. */
183CK_RV
184NSC_DestroyObject(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject)
185{
  SFTKSlot *slot = sftk_SlotFromSessionHandle(hSession);
  SFTKSession *session;
  SFTKObject *object;
  SFTKFreeStatus status;

  CHECK_FORK();

  if (slot == NULL((void*)0)) {
      return CKR_SESSION_HANDLE_INVALID0x000000B3UL;
  }
  /*
   * This whole block just makes sure we really can destroy the
   * requested object.
   */
  session = sftk_SessionFromHandle(hSession);
  if (session == NULL((void*)0)) {
      return CKR_SESSION_HANDLE_INVALID0x000000B3UL;
  }

  object = sftk_ObjectFromHandle(hObject, session);
  if (object == NULL((void*)0)) {
      sftk_FreeSession(session);
      return CKR_OBJECT_HANDLE_INVALID0x00000082UL;
  }

  /* don't destroy a private object if we aren't logged in */
  if ((!slot->isLoggedIn) && (slot->needLogin) &&
      (sftk_isTrue(object, CKA_PRIVATE0x00000002UL))) {
      sftk_FreeSession(session);
      sftk_FreeObject(object);
      return CKR_USER_NOT_LOGGED_IN0x00000101UL;
  }

  /* don't destroy a token object if we aren't in a rw session */

  if (((session->info.flags & CKF_RW_SESSION0x00000002UL) == 0) &&
      (sftk_isTrue(object, CKA_TOKEN0x00000001UL))) {
      sftk_FreeSession(session);
      sftk_FreeObject(object);
      return CKR_SESSION_READ_ONLY0x000000B5UL;
  }

  sftk_DeleteObject(session, object);

  sftk_FreeSession(session);

  /*
   * get some indication if the object is destroyed. Note: this is not
   * 100%. Someone may have an object reference outstanding (though that
   * should not be the case by here. Also note that the object is "half"
   * destroyed. Our internal representation is destroyed, but it may still
   * be in the data base.
   */
  status = sftk_FreeObject(object);

  return (status != SFTK_DestroyFailure) ? CKR_OK0x00000000UL : CKR_DEVICE_ERROR0x00000030UL;
242}

244/*
* Returns true if "params" contains a valid set of PSS parameters
*/
247static PRBool
248sftk_ValidatePssParams(const CK_RSA_PKCS_PSS_PARAMS *params)
249{
  if (!params) {
      return PR_FALSE0;
  }
  if (sftk_GetHashTypeFromMechanism(params->hashAlg) == HASH_AlgNULL ||
      sftk_GetHashTypeFromMechanism(params->mgf) == HASH_AlgNULL) {
      return PR_FALSE0;
  }
  return PR_TRUE1;
258}

260/*
* Returns true if "params" contains a valid set of OAEP parameters
*/
263static PRBool
264sftk_ValidateOaepParams(const CK_RSA_PKCS_OAEP_PARAMS *params)
265{
  if (!params) {
      return PR_FALSE0;
  }
  /* The requirements of ulSourceLen/pSourceData come from PKCS #11, which
   * state:
   *   If the parameter is empty, pSourceData must be NULL and
   *   ulSourceDataLen must be zero.
   */
  if (params->source != CKZ_DATA_SPECIFIED0x00000001UL ||
      (sftk_GetHashTypeFromMechanism(params->hashAlg) == HASH_AlgNULL) ||
      (sftk_GetHashTypeFromMechanism(params->mgf) == HASH_AlgNULL) ||
      (params->ulSourceDataLen == 0 && params->pSourceData != NULL((void*)0)) ||
      (params->ulSourceDataLen != 0 && params->pSourceData == NULL((void*)0))) {
      return PR_FALSE0;
  }
  return PR_TRUE1;
282}

284/*
* return a context based on the SFTKContext type.
*/
287SFTKSessionContext *
288sftk_ReturnContextByType(SFTKSession *session, SFTKContextType type)
289{
  switch (type) {
      case SFTK_ENCRYPT:
      case SFTK_DECRYPT:
      case SFTK_MESSAGE_ENCRYPT:
      case SFTK_MESSAGE_DECRYPT:
          return session->enc_context;
      case SFTK_HASH:
          return session->hash_context;
      case SFTK_SIGN:
      case SFTK_SIGN_RECOVER:
      case SFTK_VERIFY:
      case SFTK_VERIFY_RECOVER:
      case SFTK_MESSAGE_SIGN:
      case SFTK_MESSAGE_VERIFY:
          return session->hash_context;
  }
  return NULL((void*)0);
307}

309/*
* change a context based on the SFTKContext type.
*/
312void
313sftk_SetContextByType(SFTKSession *session, SFTKContextType type,
                    SFTKSessionContext *context)
315{
  switch (type) {
      case SFTK_ENCRYPT:
      case SFTK_DECRYPT:
      case SFTK_MESSAGE_ENCRYPT:
      case SFTK_MESSAGE_DECRYPT:
          session->enc_context = context;
          break;
      case SFTK_HASH:
          session->hash_context = context;
          break;
      case SFTK_SIGN:
      case SFTK_SIGN_RECOVER:
      case SFTK_VERIFY:
      case SFTK_VERIFY_RECOVER:
      case SFTK_MESSAGE_SIGN:
      case SFTK_MESSAGE_VERIFY:
          session->hash_context = context;
          break;
  }
  return;
336}

338/*
* code to grab the context. Needed by every C_XXXUpdate, C_XXXFinal,
* and C_XXX function. The function takes a session handle, the context type,
* and wether or not the session needs to be multipart. It returns the context,
* and optionally returns the session pointer (if sessionPtr != NULL) if session
* pointer is returned, the caller is responsible for freeing it.
*/
345CK_RV
346sftk_GetContext(CK_SESSION_HANDLE handle, SFTKSessionContext **contextPtr,
              SFTKContextType type, PRBool needMulti, SFTKSession **sessionPtr)
348{
  SFTKSession *session;
  SFTKSessionContext *context;

  session = sftk_SessionFromHandle(handle);
  if (session == NULL((void*)0))
      return CKR_SESSION_HANDLE_INVALID0x000000B3UL;
  context = sftk_ReturnContextByType(session, type);
  /* make sure the context is valid */
  if ((context == NULL((void*)0)) || (context->type != type) || (needMulti && !(context->multi))) {
      sftk_FreeSession(session);
      return CKR_OPERATION_NOT_INITIALIZED0x00000091UL;
  }
  *contextPtr = context;
  if (sessionPtr != NULL((void*)0)) {
      *sessionPtr = session;
  } else {
      sftk_FreeSession(session);
  }
  return CKR_OK0x00000000UL;
368}

370/** Terminate operation (in the PKCS#11 spec sense).
*  Intuitive name for FreeContext/SetNullContext pair.
*/
373void
374sftk_TerminateOp(SFTKSession *session, SFTKContextType ctype,
               SFTKSessionContext *context)
376{
  session->lastOpWasFIPS = context->isFIPS;
  sftk_FreeContext(context);
  sftk_SetContextByType(session, ctype, NULL((void*)0));
380}

382/*
************** Crypto Functions:     Encrypt ************************
*/

386/*
* All the NSC_InitXXX functions have a set of common checks and processing they
* all need to do at the beginning. This is done here.
*/
390CK_RV
391sftk_InitGeneric(SFTKSession *session, CK_MECHANISM *pMechanism,
               SFTKSessionContext **contextPtr,
               SFTKContextType ctype, SFTKObject **keyPtr,
               CK_OBJECT_HANDLE hKey, CK_KEY_TYPE *keyTypePtr,
               CK_OBJECT_CLASS pubKeyType, CK_ATTRIBUTE_TYPE operation)
396{
  SFTKObject *key = NULL((void*)0);
  SFTKAttribute *att;
  SFTKSessionContext *context;

  /* We can only init if there is not current context active */
  if (sftk_ReturnContextByType(session, ctype) != NULL((void*)0)) {
      return CKR_OPERATION_ACTIVE0x00000090UL;
  }

  /* find the key */
  if (keyPtr) {
      key = sftk_ObjectFromHandle(hKey, session);
      if (key == NULL((void*)0)) {
          return CKR_KEY_HANDLE_INVALID0x00000060UL;
      }

      /* make sure it's a valid  key for this operation */
      if (((key->objclass != CKO_SECRET_KEY0x00000004UL) &&
           (key->objclass != pubKeyType)) ||
          !sftk_isTrue(key, operation)) {
          sftk_FreeObject(key);
          return CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
      }
      /* get the key type */
      att = sftk_FindAttribute(key, CKA_KEY_TYPE0x00000100UL);
      if (att == NULL((void*)0)) {
          sftk_FreeObject(key);
          return CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
      }
      PORT_Assert(att->attrib.ulValueLen == sizeof(CK_KEY_TYPE))((att->attrib.ulValueLen == sizeof(CK_KEY_TYPE))?((void)0)
:PR_Assert("att->attrib.ulValueLen == sizeof(CK_KEY_TYPE)"
,"pkcs11c.c",426));
      if (att->attrib.ulValueLen != sizeof(CK_KEY_TYPE)) {
          sftk_FreeAttribute(att);
          sftk_FreeObject(key);
          return CKR_ATTRIBUTE_VALUE_INVALID0x00000013UL;
      }
      PORT_Memcpymemcpy(keyTypePtr, att->attrib.pValue, sizeof(CK_KEY_TYPE));
      sftk_FreeAttribute(att);
      *keyPtr = key;
  }

  /* allocate the context structure */
  context = (SFTKSessionContext *)PORT_AllocPORT_Alloc_Util(sizeof(SFTKSessionContext));
  if (context == NULL((void*)0)) {
      if (key)
          sftk_FreeObject(key);
      return CKR_HOST_MEMORY0x00000002UL;
  }
  context->type = ctype;
  context->multi = PR_TRUE1;
  context->rsa = PR_FALSE0;
  context->cipherInfo = NULL((void*)0);
  context->hashInfo = NULL((void*)0);
  context->doPad = PR_FALSE0;
  context->padDataLength = 0;
  context->key = key;
  context->blockSize = 0;
  context->maxLen = 0;
  context->isFIPS = sftk_operationIsFIPS(session->slot, pMechanism,
                                         operation, key);
  *contextPtr = context;
  return CKR_OK0x00000000UL;
458}

460static int
461sftk_aes_mode(CK_MECHANISM_TYPE mechanism)
462{
  switch (mechanism) {
      case CKM_AES_CBC_PAD0x00001085UL:
      case CKM_AES_CBC0x00001082UL:
          return NSS_AES_CBC1;
      case CKM_AES_ECB0x00001081UL:
          return NSS_AES0;
      case CKM_AES_CTS0x00001089UL:
          return NSS_AES_CTS2;
      case CKM_AES_CTR0x00001086UL:
          return NSS_AES_CTR3;
      case CKM_AES_GCM0x00001087UL:
          return NSS_AES_GCM4;
  }
  return -1;
477}

479static SECStatus
480sftk_RSAEncryptRaw(NSSLOWKEYPublicKey *key, unsigned char *output,
                 unsigned int *outputLen, unsigned int maxLen,
                 const unsigned char *input, unsigned int inputLen)
483{
  SECStatus rv = SECFailure;

  PORT_Assert(key->keyType == NSSLOWKEYRSAKey)((key->keyType == NSSLOWKEYRSAKey)?((void)0):PR_Assert("key->keyType == NSSLOWKEYRSAKey"
,"pkcs11c.c",486));
  if (key->keyType != NSSLOWKEYRSAKey) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_KEY);
      return SECFailure;
  }

  rv = RSA_EncryptRaw(&key->u.rsa, output, outputLen, maxLen, input,
                      inputLen);
  if (rv != SECSuccess && PORT_GetErrorPORT_GetError_Util() == SEC_ERROR_LIBRARY_FAILURE) {
      sftk_fatalError = PR_TRUE1;
  }

  return rv;
499}

501static SECStatus
502sftk_RSADecryptRaw(NSSLOWKEYPrivateKey *key, unsigned char *output,
                 unsigned int *outputLen, unsigned int maxLen,
                 const unsigned char *input, unsigned int inputLen)
505{
  SECStatus rv = SECFailure;

  PORT_Assert(key->keyType == NSSLOWKEYRSAKey)((key->keyType == NSSLOWKEYRSAKey)?((void)0):PR_Assert("key->keyType == NSSLOWKEYRSAKey"
,"pkcs11c.c",508));
  if (key->keyType != NSSLOWKEYRSAKey) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_KEY);
      return SECFailure;
  }

  rv = RSA_DecryptRaw(&key->u.rsa, output, outputLen, maxLen, input,
                      inputLen);
  if (rv != SECSuccess && PORT_GetErrorPORT_GetError_Util() == SEC_ERROR_LIBRARY_FAILURE) {
      sftk_fatalError = PR_TRUE1;
  }

  return rv;
521}

523static SECStatus
524sftk_RSAEncrypt(NSSLOWKEYPublicKey *key, unsigned char *output,
              unsigned int *outputLen, unsigned int maxLen,
              const unsigned char *input, unsigned int inputLen)
527{
  SECStatus rv = SECFailure;

  PORT_Assert(key->keyType == NSSLOWKEYRSAKey)((key->keyType == NSSLOWKEYRSAKey)?((void)0):PR_Assert("key->keyType == NSSLOWKEYRSAKey"
,"pkcs11c.c",530));
  if (key->keyType != NSSLOWKEYRSAKey) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_KEY);
      return SECFailure;
  }

  rv = RSA_EncryptBlock(&key->u.rsa, output, outputLen, maxLen, input,
                        inputLen);
  if (rv != SECSuccess && PORT_GetErrorPORT_GetError_Util() == SEC_ERROR_LIBRARY_FAILURE) {
      sftk_fatalError = PR_TRUE1;
  }

  return rv;
543}

545static SECStatus
546sftk_RSADecrypt(NSSLOWKEYPrivateKey *key, unsigned char *output,
              unsigned int *outputLen, unsigned int maxLen,
              const unsigned char *input, unsigned int inputLen)
549{
  SECStatus rv = SECFailure;

  PORT_Assert(key->keyType == NSSLOWKEYRSAKey)((key->keyType == NSSLOWKEYRSAKey)?((void)0):PR_Assert("key->keyType == NSSLOWKEYRSAKey"
,"pkcs11c.c",552));
  if (key->keyType != NSSLOWKEYRSAKey) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_KEY);
      return SECFailure;
  }

  rv = RSA_DecryptBlock(&key->u.rsa, output, outputLen, maxLen, input,
                        inputLen);
  if (rv != SECSuccess && PORT_GetErrorPORT_GetError_Util() == SEC_ERROR_LIBRARY_FAILURE) {
      sftk_fatalError = PR_TRUE1;
  }

  return rv;
565}

567static void
568sftk_freeRSAOAEPInfo(SFTKOAEPInfo *info, PRBool freeit)
569{
  PORT_ZFreePORT_ZFree_Util(info->params.pSourceData, info->params.ulSourceDataLen);
  PORT_ZFreePORT_ZFree_Util(info, sizeof(SFTKOAEPInfo));
572}

574static SECStatus
575sftk_RSAEncryptOAEP(SFTKOAEPInfo *info, unsigned char *output,
                  unsigned int *outputLen, unsigned int maxLen,
                  const unsigned char *input, unsigned int inputLen)
578{
  HASH_HashType hashAlg;
  HASH_HashType maskHashAlg;

  PORT_Assert(info->key.pub->keyType == NSSLOWKEYRSAKey)((info->key.pub->keyType == NSSLOWKEYRSAKey)?((void)0):
PR_Assert("info->key.pub->keyType == NSSLOWKEYRSAKey","pkcs11c.c"
,582));
  if (info->key.pub->keyType != NSSLOWKEYRSAKey) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_KEY);
      return SECFailure;
  }

  hashAlg = sftk_GetHashTypeFromMechanism(info->params.hashAlg);
  maskHashAlg = sftk_GetHashTypeFromMechanism(info->params.mgf);

  return RSA_EncryptOAEP(&info->key.pub->u.rsa, hashAlg, maskHashAlg,
                         (const unsigned char *)info->params.pSourceData,
                         info->params.ulSourceDataLen, NULL((void*)0), 0,
                         output, outputLen, maxLen, input, inputLen);
595}

597static SECStatus
598sftk_RSADecryptOAEP(SFTKOAEPInfo *info, unsigned char *output,
                  unsigned int *outputLen, unsigned int maxLen,
                  const unsigned char *input, unsigned int inputLen)
601{
  SECStatus rv = SECFailure;
  HASH_HashType hashAlg;
  HASH_HashType maskHashAlg;

  PORT_Assert(info->key.priv->keyType == NSSLOWKEYRSAKey)((info->key.priv->keyType == NSSLOWKEYRSAKey)?((void)0)
:PR_Assert("info->key.priv->keyType == NSSLOWKEYRSAKey"
,"pkcs11c.c",606));
  if (info->key.priv->keyType != NSSLOWKEYRSAKey) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_KEY);
      return SECFailure;
  }

  hashAlg = sftk_GetHashTypeFromMechanism(info->params.hashAlg);
  maskHashAlg = sftk_GetHashTypeFromMechanism(info->params.mgf);

  rv = RSA_DecryptOAEP(&info->key.priv->u.rsa, hashAlg, maskHashAlg,
                       (const unsigned char *)info->params.pSourceData,
                       info->params.ulSourceDataLen,
                       output, outputLen, maxLen, input, inputLen);
  if (rv != SECSuccess && PORT_GetErrorPORT_GetError_Util() == SEC_ERROR_LIBRARY_FAILURE) {
      sftk_fatalError = PR_TRUE1;
  }
  return rv;
623}

625static SFTKChaCha20Poly1305Info *
626sftk_ChaCha20Poly1305_CreateContext(const unsigned char *key,
                                  unsigned int keyLen,
                                  const CK_NSS_AEAD_PARAMS *params)
629{
  SFTKChaCha20Poly1305Info *ctx;

  if (params->ulNonceLen != sizeof(ctx->nonce)) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INPUT_LEN);
      return NULL((void*)0);
  }

  ctx = PORT_New(SFTKChaCha20Poly1305Info)(SFTKChaCha20Poly1305Info *)PORT_Alloc_Util(sizeof(SFTKChaCha20Poly1305Info
));
  if (ctx == NULL((void*)0)) {
      return NULL((void*)0);
  }

  if (ChaCha20Poly1305_InitContext(&ctx->freeblCtx, key, keyLen,
                                   params->ulTagLen) != SECSuccess) {
      PORT_FreePORT_Free_Util(ctx);
      return NULL((void*)0);
  }

  PORT_Memcpymemcpy(ctx->nonce, params->pNonce, sizeof(ctx->nonce));

  /* AAD data and length must both be null, or both non-null. */
  PORT_Assert((params->pAAD == NULL) == (params->ulAADLen == 0))(((params->pAAD == ((void*)0)) == (params->ulAADLen == 0
))?((void)0):PR_Assert("(params->pAAD == NULL) == (params->ulAADLen == 0)"
,"pkcs11c.c",651));

  if (params->ulAADLen > sizeof(ctx->ad)) {
      /* Need to allocate an overflow buffer for the additional data. */
      ctx->adOverflow = (unsigned char *)PORT_AllocPORT_Alloc_Util(params->ulAADLen);
      if (!ctx->adOverflow) {
          PORT_FreePORT_Free_Util(ctx);
          return NULL((void*)0);
      }
      PORT_Memcpymemcpy(ctx->adOverflow, params->pAAD, params->ulAADLen);
  } else {
      ctx->adOverflow = NULL((void*)0);
      if (params->pAAD) {
          PORT_Memcpymemcpy(ctx->ad, params->pAAD, params->ulAADLen);
      }
  }
  ctx->adLen = params->ulAADLen;

  return ctx;
670}

672static void
673sftk_ChaCha20Poly1305_DestroyContext(SFTKChaCha20Poly1305Info *ctx,
                                   PRBool freeit)
675{
  ChaCha20Poly1305_DestroyContext(&ctx->freeblCtx, PR_FALSE0);
  if (ctx->adOverflow != NULL((void*)0)) {
      PORT_ZFreePORT_ZFree_Util(ctx->adOverflow, ctx->adLen);
      ctx->adOverflow = NULL((void*)0);
  } else {
      PORT_Memsetmemset(ctx->ad, 0, ctx->adLen);
  }
  ctx->adLen = 0;
  if (freeit) {
      PORT_FreePORT_Free_Util(ctx);
  }
687}

689static SECStatus
690sftk_ChaCha20Poly1305_Encrypt(const SFTKChaCha20Poly1305Info *ctx,
                            unsigned char *output, unsigned int *outputLen,
                            unsigned int maxOutputLen,
                            const unsigned char *input, unsigned int inputLen)
694{
  const unsigned char *ad = ctx->adOverflow;

  if (ad == NULL((void*)0)) {
      ad = ctx->ad;
  }

  return ChaCha20Poly1305_Seal(&ctx->freeblCtx, output, outputLen,
                               maxOutputLen, input, inputLen, ctx->nonce,
                               sizeof(ctx->nonce), ad, ctx->adLen);
704}

706static SECStatus
707sftk_ChaCha20Poly1305_Decrypt(const SFTKChaCha20Poly1305Info *ctx,
                            unsigned char *output, unsigned int *outputLen,
                            unsigned int maxOutputLen,
                            const unsigned char *input, unsigned int inputLen)
711{
  const unsigned char *ad = ctx->adOverflow;

  if (ad == NULL((void*)0)) {
      ad = ctx->ad;
  }

  return ChaCha20Poly1305_Open(&ctx->freeblCtx, output, outputLen,
                               maxOutputLen, input, inputLen, ctx->nonce,
                               sizeof(ctx->nonce), ad, ctx->adLen);
721}

723static SECStatus
724sftk_ChaCha20Ctr(const SFTKChaCha20CtrInfo *ctx,
               unsigned char *output, unsigned int *outputLen,
               unsigned int maxOutputLen,
               const unsigned char *input, unsigned int inputLen)
728{
  if (maxOutputLen < inputLen) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_OUTPUT_LEN);
      return SECFailure;
  }
  ChaCha20_Xor(output, input, inputLen, ctx->key,
               ctx->nonce, ctx->counter);
  *outputLen = inputLen;
  return SECSuccess;
737}

739static void
740sftk_ChaCha20Ctr_DestroyContext(SFTKChaCha20CtrInfo *ctx,
                              PRBool freeit)
742{
  memset(ctx, 0, sizeof(*ctx));
  if (freeit) {
      PORT_FreePORT_Free_Util(ctx);
  }
747}

749/** NSC_CryptInit initializes an encryption/Decryption operation.
*
* Always called by NSC_EncryptInit, NSC_DecryptInit, NSC_WrapKey,NSC_UnwrapKey.
* Called by NSC_SignInit, NSC_VerifyInit (via sftk_InitCBCMac) only for block
*  ciphers MAC'ing.
*/
755CK_RV
756sftk_CryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
             CK_OBJECT_HANDLE hKey,
             CK_ATTRIBUTE_TYPE mechUsage, CK_ATTRIBUTE_TYPE keyUsage,
             SFTKContextType contextType, PRBool isEncrypt)
760{
  SFTKSession *session;
  SFTKObject *key;
  SFTKSessionContext *context;
  SFTKAttribute *att;
765#ifndef NSS_DISABLE_DEPRECATED_RC2
  CK_RC2_CBC_PARAMS *rc2_param;
  unsigned effectiveKeyLength;
768#endif
769#if NSS_SOFTOKEN_DOES_RC5
  CK_RC5_CBC_PARAMS *rc5_param;
  SECItem rc5Key;
772#endif
  CK_NSS_GCM_PARAMS nss_gcm_param;
  void *aes_param;
  CK_NSS_AEAD_PARAMS nss_aead_params;
  CK_NSS_AEAD_PARAMS *nss_aead_params_ptr = NULL((void*)0);
  CK_KEY_TYPE key_type;
  CK_RV crv = CKR_OK0x00000000UL;
  unsigned char newdeskey[24];
  PRBool useNewKey = PR_FALSE0;
  int t;

  if (!pMechanism) {
      return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
  }

  crv = sftk_MechAllowsOperation(pMechanism->mechanism, mechUsage);
  if (crv != CKR_OK0x00000000UL)
      return crv;

  session = sftk_SessionFromHandle(hSession);
  if (session == NULL((void*)0))
      return CKR_SESSION_HANDLE_INVALID0x000000B3UL;

  crv = sftk_InitGeneric(session, pMechanism, &context, contextType, &key,
                         hKey, &key_type,
                         isEncrypt ? CKO_PUBLIC_KEY0x00000002UL : CKO_PRIVATE_KEY0x00000003UL,
                         keyUsage);

  if (crv != CKR_OK0x00000000UL) {
      sftk_FreeSession(session);
      return crv;
  }

  context->doPad = PR_FALSE0;
  switch (pMechanism->mechanism) {
      case CKM_RSA_PKCS0x00000001UL:
      case CKM_RSA_X_5090x00000003UL:
          if (key_type != CKK_RSA0x00000000UL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          context->multi = PR_FALSE0;
          context->rsa = PR_TRUE1;
          if (isEncrypt) {
              NSSLOWKEYPublicKey *pubKey = sftk_GetPubKey(key, CKK_RSA0x00000000UL, &crv);
              if (pubKey == NULL((void*)0)) {
                  crv = CKR_KEY_HANDLE_INVALID0x00000060UL;
                  break;
              }
              context->maxLen = nsslowkey_PublicModulusLen(pubKey);
              context->cipherInfo = (void *)pubKey;
              context->update = (SFTKCipher)(pMechanism->mechanism == CKM_RSA_X_5090x00000003UL
                                                 ? sftk_RSAEncryptRaw
                                                 : sftk_RSAEncrypt);
          } else {
              NSSLOWKEYPrivateKey *privKey = sftk_GetPrivKey(key, CKK_RSA0x00000000UL, &crv);
              if (privKey == NULL((void*)0)) {
                  crv = CKR_KEY_HANDLE_INVALID0x00000060UL;
                  break;
              }
              context->maxLen = nsslowkey_PrivateModulusLen(privKey);
              context->cipherInfo = (void *)privKey;
              context->update = (SFTKCipher)(pMechanism->mechanism == CKM_RSA_X_5090x00000003UL
                                                 ? sftk_RSADecryptRaw
                                                 : sftk_RSADecrypt);
          }
          context->destroy = sftk_Null;
          break;
      case CKM_RSA_PKCS_OAEP0x00000009UL:
          if (key_type != CKK_RSA0x00000000UL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          if (pMechanism->ulParameterLen != sizeof(CK_RSA_PKCS_OAEP_PARAMS) ||
              !sftk_ValidateOaepParams((CK_RSA_PKCS_OAEP_PARAMS *)pMechanism->pParameter)) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          context->multi = PR_FALSE0;
          context->rsa = PR_TRUE1;
          {
              SFTKOAEPInfo *info;
              CK_RSA_PKCS_OAEP_PARAMS *params =
                  (CK_RSA_PKCS_OAEP_PARAMS *)pMechanism->pParameter;
              /* make a copy of the source data value for future
               * use (once the user has reclaimed his data in pParameter)*/
              void *newSource = NULL((void*)0);
              if (params->pSourceData) {
                  newSource = PORT_AllocPORT_Alloc_Util(params->ulSourceDataLen);
                  if (newSource == NULL((void*)0)) {
                      crv = CKR_HOST_MEMORY0x00000002UL;
                      break;
                  }
                  PORT_Memcpymemcpy(newSource, params->pSourceData, params->ulSourceDataLen);
              }
              info = PORT_New(SFTKOAEPInfo)(SFTKOAEPInfo *)PORT_Alloc_Util(sizeof(SFTKOAEPInfo));
              if (info == NULL((void*)0)) {
                  PORT_ZFreePORT_ZFree_Util(newSource, params->ulSourceDataLen);
                  crv = CKR_HOST_MEMORY0x00000002UL;
                  break;
              }
              info->params = *params;
              info->params.pSourceData = newSource;
              info->isEncrypt = isEncrypt;

              /* now setup encryption and decryption contexts */
              if (isEncrypt) {
                  info->key.pub = sftk_GetPubKey(key, CKK_RSA0x00000000UL, &crv);
                  if (info->key.pub == NULL((void*)0)) {
                      sftk_freeRSAOAEPInfo(info, PR_TRUE1);
                      crv = CKR_KEY_HANDLE_INVALID0x00000060UL;
                      break;
                  }
                  context->update = (SFTKCipher)sftk_RSAEncryptOAEP;
                  context->maxLen = nsslowkey_PublicModulusLen(info->key.pub);
              } else {
                  info->key.priv = sftk_GetPrivKey(key, CKK_RSA0x00000000UL, &crv);
                  if (info->key.priv == NULL((void*)0)) {
                      sftk_freeRSAOAEPInfo(info, PR_TRUE1);
                      crv = CKR_KEY_HANDLE_INVALID0x00000060UL;
                      break;
                  }
                  context->update = (SFTKCipher)sftk_RSADecryptOAEP;
                  context->maxLen = nsslowkey_PrivateModulusLen(info->key.priv);
              }
              context->cipherInfo = info;
          }
          context->destroy = (SFTKDestroy)sftk_freeRSAOAEPInfo;
          break;
901#ifndef NSS_DISABLE_DEPRECATED_RC2
      case CKM_RC2_CBC_PAD0x00000105UL:
          context->doPad = PR_TRUE1;
      /* fall thru */
      case CKM_RC2_ECB0x00000101UL:
      case CKM_RC2_CBC0x00000102UL:
          context->blockSize = 8;
          if (key_type != CKK_RC20x00000011UL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          att = sftk_FindAttribute(key, CKA_VALUE0x00000011UL);
          if (att == NULL((void*)0)) {
              crv = CKR_KEY_HANDLE_INVALID0x00000060UL;
              break;
          }

          if (BAD_PARAM_CAST(pMechanism, sizeof(CK_RC2_CBC_PARAMS))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_RC2_CBC_PARAMS))) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          rc2_param = (CK_RC2_CBC_PARAMS *)pMechanism->pParameter;
          effectiveKeyLength = (rc2_param->ulEffectiveBits + 7) / 8;
          context->cipherInfo =
              RC2_CreateContext((unsigned char *)att->attrib.pValue,
                                att->attrib.ulValueLen, rc2_param->iv,
                                pMechanism->mechanism == CKM_RC2_ECB0x00000101UL ? NSS_RC20 : NSS_RC2_CBC1, effectiveKeyLength);
          sftk_FreeAttribute(att);
          if (context->cipherInfo == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          context->update = (SFTKCipher)(isEncrypt ? RC2_Encrypt : RC2_Decrypt);
          context->destroy = (SFTKDestroy)RC2_DestroyContext;
          break;
936#endif /* NSS_DISABLE_DEPRECATED_RC2 */

938#if NSS_SOFTOKEN_DOES_RC5
      case CKM_RC5_CBC_PAD0x00000335UL:
          context->doPad = PR_TRUE1;
      /* fall thru */
      case CKM_RC5_ECB0x00000331UL:
      case CKM_RC5_CBC0x00000332UL:
          if (key_type != CKK_RC50x00000019UL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          att = sftk_FindAttribute(key, CKA_VALUE0x00000011UL);
          if (att == NULL((void*)0)) {
              crv = CKR_KEY_HANDLE_INVALID0x00000060UL;
              break;
          }

          if (BAD_PARAM_CAST(pMechanism, sizeof(CK_RC5_CBC_PARAMS))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_RC5_CBC_PARAMS))) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          rc5_param = (CK_RC5_CBC_PARAMS *)pMechanism->pParameter;
          context->blockSize = rc5_param->ulWordsize * 2;
          rc5Key.data = (unsigned char *)att->attrib.pValue;
          rc5Key.len = att->attrib.ulValueLen;
          context->cipherInfo = RC5_CreateContext(&rc5Key, rc5_param->ulRounds,
                                                  rc5_param->ulWordsize, rc5_param->pIv,
                                                  pMechanism->mechanism == CKM_RC5_ECB0x00000331UL ? NSS_RC50 : NSS_RC5_CBC1);
          sftk_FreeAttribute(att);
          if (context->cipherInfo == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          context->update = (SFTKCipher)(isEncrypt ? RC5_Encrypt : RC5_Decrypt);
          context->destroy = (SFTKDestroy)RC5_DestroyContext;
          break;
973#endif
      case CKM_RC40x00000111UL:
          if (key_type != CKK_RC40x00000012UL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          att = sftk_FindAttribute(key, CKA_VALUE0x00000011UL);
          if (att == NULL((void*)0)) {
              crv = CKR_KEY_HANDLE_INVALID0x00000060UL;
              break;
          }
          context->cipherInfo =
              RC4_CreateContext((unsigned char *)att->attrib.pValue,
                                att->attrib.ulValueLen);
          sftk_FreeAttribute(att);
          if (context->cipherInfo == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL; /* WRONG !!! */
              break;
          }
          context->update = (SFTKCipher)(isEncrypt ? RC4_Encrypt : RC4_Decrypt);
          context->destroy = (SFTKDestroy)RC4_DestroyContext;
          break;
      case CKM_CDMF_CBC_PAD0x00000145UL:
          context->doPad = PR_TRUE1;
      /* fall thru */
      case CKM_CDMF_ECB0x00000141UL:
      case CKM_CDMF_CBC0x00000142UL:
          if (key_type != CKK_CDMF0x0000001EUL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          t = (pMechanism->mechanism == CKM_CDMF_ECB0x00000141UL) ? NSS_DES0 : NSS_DES_CBC1;
          goto finish_des;
      case CKM_DES_ECB0x00000121UL:
          if (key_type != CKK_DES0x00000013UL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          t = NSS_DES0;
          goto finish_des;
      case CKM_DES_CBC_PAD0x00000125UL:
          context->doPad = PR_TRUE1;
      /* fall thru */
      case CKM_DES_CBC0x00000122UL:
          if (key_type != CKK_DES0x00000013UL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          t = NSS_DES_CBC1;
          goto finish_des;
      case CKM_DES3_ECB0x00000132UL:
          if ((key_type != CKK_DES20x00000014UL) && (key_type != CKK_DES30x00000015UL)) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          t = NSS_DES_EDE32;
          goto finish_des;
      case CKM_DES3_CBC_PAD0x00000136UL:
          context->doPad = PR_TRUE1;
      /* fall thru */
      case CKM_DES3_CBC0x00000133UL:
          if ((key_type != CKK_DES20x00000014UL) && (key_type != CKK_DES30x00000015UL)) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          t = NSS_DES_EDE3_CBC3;
      finish_des:
          if ((t != NSS_DES0 && t != NSS_DES_EDE32) && (pMechanism->pParameter == NULL((void*)0) ||
                                                      pMechanism->ulParameterLen < 8)) {
              crv = CKR_DOMAIN_PARAMS_INVALID0x00000130UL;
              break;
          }
          context->blockSize = 8;
          att = sftk_FindAttribute(key, CKA_VALUE0x00000011UL);
          if (att == NULL((void*)0)) {
              crv = CKR_KEY_HANDLE_INVALID0x00000060UL;
              break;
          }
          if (key_type == CKK_DES20x00000014UL &&
              (t == NSS_DES_EDE3_CBC3 || t == NSS_DES_EDE32)) {
              /* extend DES2 key to DES3 key. */
              memcpy(newdeskey, att->attrib.pValue, 16);
              memcpy(newdeskey + 16, newdeskey, 8);
              useNewKey = PR_TRUE1;
          } else if (key_type == CKK_CDMF0x0000001EUL) {
              crv = sftk_cdmf2des((unsigned char *)att->attrib.pValue, newdeskey);
              if (crv != CKR_OK0x00000000UL) {
                  sftk_FreeAttribute(att);
                  break;
              }
              useNewKey = PR_TRUE1;
          }
          context->cipherInfo = DES_CreateContext(
              useNewKey ? newdeskey : (unsigned char *)att->attrib.pValue,
              (unsigned char *)pMechanism->pParameter, t, isEncrypt);
          if (useNewKey)
              memset(newdeskey, 0, sizeof newdeskey);
          sftk_FreeAttribute(att);
          if (context->cipherInfo == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          context->update = (SFTKCipher)(isEncrypt ? DES_Encrypt : DES_Decrypt);
          context->destroy = (SFTKDestroy)DES_DestroyContext;
          break;
1078#ifndef NSS_DISABLE_DEPRECATED_SEED
      case CKM_SEED_CBC_PAD0x00000655UL:
          context->doPad = PR_TRUE1;
      /* fall thru */
      case CKM_SEED_CBC0x00000652UL:
          if (!pMechanism->pParameter ||
              pMechanism->ulParameterLen != 16) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
      /* fall thru */
      case CKM_SEED_ECB0x00000651UL:
          context->blockSize = 16;
          if (key_type != CKK_SEED0x0000002FUL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          att = sftk_FindAttribute(key, CKA_VALUE0x00000011UL);
          if (att == NULL((void*)0)) {
              crv = CKR_KEY_HANDLE_INVALID0x00000060UL;
              break;
          }
          context->cipherInfo = SEED_CreateContext(
              (unsigned char *)att->attrib.pValue,
              (unsigned char *)pMechanism->pParameter,
              pMechanism->mechanism == CKM_SEED_ECB0x00000651UL ? NSS_SEED0 : NSS_SEED_CBC1,
              isEncrypt);
          sftk_FreeAttribute(att);
          if (context->cipherInfo == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          context->update = (SFTKCipher)(isEncrypt ? SEED_Encrypt : SEED_Decrypt);
          context->destroy = (SFTKDestroy)SEED_DestroyContext;
          break;
1113#endif /* NSS_DISABLE_DEPRECATED_SEED */
      case CKM_CAMELLIA_CBC_PAD0x00000555UL:
          context->doPad = PR_TRUE1;
      /* fall thru */
      case CKM_CAMELLIA_CBC0x00000552UL:
          if (!pMechanism->pParameter ||
              pMechanism->ulParameterLen != 16) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
      /* fall thru */
      case CKM_CAMELLIA_ECB0x00000551UL:
          context->blockSize = 16;
          if (key_type != CKK_CAMELLIA0x00000025UL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          att = sftk_FindAttribute(key, CKA_VALUE0x00000011UL);
          if (att == NULL((void*)0)) {
              crv = CKR_KEY_HANDLE_INVALID0x00000060UL;
              break;
          }
          context->cipherInfo = Camellia_CreateContext(
              (unsigned char *)att->attrib.pValue,
              (unsigned char *)pMechanism->pParameter,
              pMechanism->mechanism ==
                      CKM_CAMELLIA_ECB0x00000551UL
                  ? NSS_CAMELLIA0
                  : NSS_CAMELLIA_CBC1,
              isEncrypt, att->attrib.ulValueLen);
          sftk_FreeAttribute(att);
          if (context->cipherInfo == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          context->update = (SFTKCipher)(isEncrypt ? Camellia_Encrypt : Camellia_Decrypt);
          context->destroy = (SFTKDestroy)Camellia_DestroyContext;
          break;

      case CKM_AES_CBC_PAD0x00001085UL:
          context->doPad = PR_TRUE1;
      /* fall thru */
      case CKM_AES_ECB0x00001081UL:
      case CKM_AES_CBC0x00001082UL:
          context->blockSize = 16;
      case CKM_AES_CTS0x00001089UL:
      case CKM_AES_CTR0x00001086UL:
      case CKM_AES_GCM0x00001087UL:
          aes_param = pMechanism->pParameter;
          /*
           *  Due to a mismatch between the documentation and the header
           *  file, two different definitions for CK_GCM_PARAMS exist.
           *  The header file is normative according to Oasis, but NSS used
           *  the documentation. In PKCS #11 v3.0, this was reconciled in
           *  favor of the header file definition. To maintain binary
           *  compatibility, NSS now defines CK_GCM_PARAMS_V3 as the official
           *  version v3 (V2.4 header file) and CK_NSS_GCM_PARAMS as the
           *  legacy (V2.4 documentation, NSS version). CK_GCM_PARAMS
           *  is defined as CK_GCM_PARAMS_V3 if NSS_PKCS11_2_0_COMPAT is not
           *  defined and CK_NSS_GCM_PARAMS if it is. Internally
           *  softoken continues to use the legacy version. The code below
           *  automatically detects which parameter was passed in and
           *  converts CK_GCM_PARAMS_V3 to the CK_NSS_GCM_PARAMS (legacy
           *  version) on the fly. NSS proper will eventually start
           *  using the CK_GCM_PARAMS_V3 version and fall back to the
           *  CK_NSS_GCM_PARAMS if the CK_GCM_PARAMS_V3 version fails with
           *  CKR_MECHANISM_PARAM_INVALID.
           */
          if (pMechanism->mechanism == CKM_AES_GCM0x00001087UL) {
              if (!aes_param) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
              if (pMechanism->ulParameterLen == sizeof(CK_GCM_PARAMS_V3)) {
                  /* convert the true V3 parameters into the old NSS parameters */
                  CK_GCM_PARAMS_V3 *gcm_params = (CK_GCM_PARAMS_V3 *)aes_param;
                  if (gcm_params->ulIvLen * 8 != gcm_params->ulIvBits) {
                      /* only support byte aligned IV lengths */
                      crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                      break;
                  }
                  aes_param = (void *)&nss_gcm_param;
                  nss_gcm_param.pIv = gcm_params->pIv;
                  nss_gcm_param.ulIvLen = gcm_params->ulIvLen;
                  nss_gcm_param.pAAD = gcm_params->pAAD;
                  nss_gcm_param.ulAADLen = gcm_params->ulAADLen;
                  nss_gcm_param.ulTagBits = gcm_params->ulTagBits;
              } else if (pMechanism->ulParameterLen != sizeof(CK_NSS_GCM_PARAMS)) {
                  /* neither old nor new style params, must be invalid */
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
          } else if ((pMechanism->mechanism == CKM_AES_CTR0x00001086UL && BAD_PARAM_CAST(pMechanism, sizeof(CK_AES_CTR_PARAMS))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_AES_CTR_PARAMS))) ||
                     ((pMechanism->mechanism == CKM_AES_CBC0x00001082UL || pMechanism->mechanism == CKM_AES_CTS0x00001089UL) && BAD_PARAM_CAST(pMechanism, AES_BLOCK_SIZE)(!pMechanism->pParameter || pMechanism->ulParameterLen <
 16))) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }

          if (pMechanism->mechanism == CKM_AES_GCM0x00001087UL) {
              context->multi = PR_FALSE0;
          }
          if (key_type != CKK_AES0x0000001FUL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          att = sftk_FindAttribute(key, CKA_VALUE0x00000011UL);
          if (att == NULL((void*)0)) {
              crv = CKR_KEY_HANDLE_INVALID0x00000060UL;
              break;
          }
          context->cipherInfo = AES_CreateContext(
              (unsigned char *)att->attrib.pValue,
              (unsigned char *)aes_param,
              sftk_aes_mode(pMechanism->mechanism),
              isEncrypt, att->attrib.ulValueLen, 16);
          sftk_FreeAttribute(att);
          if (context->cipherInfo == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          context->update = (SFTKCipher)(isEncrypt ? AES_Encrypt : AES_Decrypt);
          context->destroy = (SFTKDestroy)AES_DestroyContext;
          break;

      case CKM_NSS_CHACHA20_POLY1305((0x80000000UL | 0x4E534350) + 28):
      case CKM_CHACHA20_POLY13050x00004021UL:
          if (pMechanism->mechanism == CKM_NSS_CHACHA20_POLY1305((0x80000000UL | 0x4E534350) + 28)) {
              if (key_type != CKK_NSS_CHACHA20((0x80000000UL | 0x4E534350) + 4)) {
                  crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
                  break;
              }
              if ((pMechanism->pParameter == NULL((void*)0)) ||
                  (pMechanism->ulParameterLen != sizeof(CK_NSS_AEAD_PARAMS))) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
              nss_aead_params_ptr = (CK_NSS_AEAD_PARAMS *)pMechanism->pParameter;
          } else {
              CK_SALSA20_CHACHA20_POLY1305_PARAMS_PTR chacha_poly_params;
              if (key_type != CKK_CHACHA200x00000033UL) {
                  crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
                  break;
              }
              if ((pMechanism->pParameter == NULL((void*)0)) ||
                  (pMechanism->ulParameterLen !=
                   sizeof(CK_SALSA20_CHACHA20_POLY1305_PARAMS))) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
              chacha_poly_params = (CK_SALSA20_CHACHA20_POLY1305_PARAMS_PTR)
                                       pMechanism->pParameter;
              nss_aead_params_ptr = &nss_aead_params;
              nss_aead_params.pNonce = chacha_poly_params->pNonce;
              nss_aead_params.ulNonceLen = chacha_poly_params->ulNonceLen;
              nss_aead_params.pAAD = chacha_poly_params->pAAD;
              nss_aead_params.ulAADLen = chacha_poly_params->ulAADLen;
              nss_aead_params.ulTagLen = 16; /* Poly1305 is always 16 */
          }

          context->multi = PR_FALSE0;
          att = sftk_FindAttribute(key, CKA_VALUE0x00000011UL);
          if (att == NULL((void*)0)) {
              crv = CKR_KEY_HANDLE_INVALID0x00000060UL;
              break;
          }
          context->cipherInfo = sftk_ChaCha20Poly1305_CreateContext(
              (unsigned char *)att->attrib.pValue, att->attrib.ulValueLen,
              nss_aead_params_ptr);
          sftk_FreeAttribute(att);
          if (context->cipherInfo == NULL((void*)0)) {
              crv = sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
              break;
          }
          context->update = (SFTKCipher)(isEncrypt ? sftk_ChaCha20Poly1305_Encrypt : sftk_ChaCha20Poly1305_Decrypt);
          context->destroy = (SFTKDestroy)sftk_ChaCha20Poly1305_DestroyContext;
          break;

      case CKM_NSS_CHACHA20_CTR((0x80000000UL | 0x4E534350) + 33): /* old NSS private version */
      case CKM_CHACHA200x00001226UL:         /* PKCS #11 v3 version */
      {
          unsigned char *counter;
          unsigned char *nonce;
          unsigned long counter_len;
          unsigned long nonce_len;
          context->multi = PR_FALSE0;
          if (pMechanism->mechanism == CKM_NSS_CHACHA20_CTR((0x80000000UL | 0x4E534350) + 33)) {
              if (key_type != CKK_NSS_CHACHA20((0x80000000UL | 0x4E534350) + 4)) {
                  crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
                  break;
              }
              if (pMechanism->pParameter == NULL((void*)0) || pMechanism->ulParameterLen != 16) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
              counter_len = 4;
              counter = pMechanism->pParameter;
              nonce = counter + 4;
              nonce_len = 12;
          } else {
              CK_CHACHA20_PARAMS_PTR chacha20_param_ptr;
              if (key_type != CKK_CHACHA200x00000033UL) {
                  crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
                  break;
              }
              if (pMechanism->pParameter == NULL((void*)0) || pMechanism->ulParameterLen != sizeof(CK_CHACHA20_PARAMS)) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
              chacha20_param_ptr = (CK_CHACHA20_PARAMS_PTR)pMechanism->pParameter;
              if ((chacha20_param_ptr->blockCounterBits != 32) &&
                  (chacha20_param_ptr->blockCounterBits != 64)) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
              counter_len = chacha20_param_ptr->blockCounterBits / PR_BITS_PER_BYTE8;
              counter = chacha20_param_ptr->pBlockCounter;
              nonce = chacha20_param_ptr->pNonce;
              nonce_len = chacha20_param_ptr->ulNonceBits / PR_BITS_PER_BYTE8;
          }

          att = sftk_FindAttribute(key, CKA_VALUE0x00000011UL);
          if (att == NULL((void*)0)) {
              crv = CKR_KEY_HANDLE_INVALID0x00000060UL;
              break;
          }
          SFTKChaCha20CtrInfo *ctx = PORT_ZNew(SFTKChaCha20CtrInfo)(SFTKChaCha20CtrInfo *)PORT_ZAlloc_Util(sizeof(SFTKChaCha20CtrInfo
));
          if (!ctx) {
              sftk_FreeAttribute(att);
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          if (att->attrib.ulValueLen != sizeof(ctx->key)) {
              sftk_FreeAttribute(att);
              PORT_FreePORT_Free_Util(ctx);
              crv = CKR_KEY_HANDLE_INVALID0x00000060UL;
              break;
          }
          memcpy(ctx->key, att->attrib.pValue, att->attrib.ulValueLen);
          sftk_FreeAttribute(att);

          /* make sure we don't overflow our parameters */
          if ((sizeof(ctx->counter) < counter_len) ||
              (sizeof(ctx->nonce) < nonce_len)) {
              PORT_FreePORT_Free_Util(ctx);
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }

          /* The counter is little endian. */
          int i = 0;
          for (; i < counter_len; ++i) {
              ctx->counter |= (PRUint32)counter[i] << (i * 8);
          }
          memcpy(ctx->nonce, nonce, nonce_len);
          context->cipherInfo = ctx;
          context->update = (SFTKCipher)sftk_ChaCha20Ctr;
          context->destroy = (SFTKDestroy)sftk_ChaCha20Ctr_DestroyContext;
          break;
      }

      case CKM_NSS_AES_KEY_WRAP_PAD((0x80000000UL | 0x4E534350) + 2):
      case CKM_AES_KEY_WRAP_PAD0x0000210AUL:
          context->doPad = PR_TRUE1;
      /* fall thru */
      case CKM_NSS_AES_KEY_WRAP((0x80000000UL | 0x4E534350) + 1):
      case CKM_AES_KEY_WRAP0x00002109UL:
          context->blockSize = 8;
      case CKM_AES_KEY_WRAP_KWP0x0000210BUL:
          context->multi = PR_FALSE0;
          if (key_type != CKK_AES0x0000001FUL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          att = sftk_FindAttribute(key, CKA_VALUE0x00000011UL);
          if (att == NULL((void*)0)) {
              crv = CKR_KEY_HANDLE_INVALID0x00000060UL;
              break;
          }
          context->cipherInfo = AESKeyWrap_CreateContext(
              (unsigned char *)att->attrib.pValue,
              (unsigned char *)pMechanism->pParameter,
              isEncrypt, att->attrib.ulValueLen);
          sftk_FreeAttribute(att);
          if (context->cipherInfo == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          if (pMechanism->mechanism == CKM_AES_KEY_WRAP_KWP0x0000210BUL) {
              context->update = (SFTKCipher)(isEncrypt ? AESKeyWrap_EncryptKWP
                                                       : AESKeyWrap_DecryptKWP);
          } else {
              context->update = (SFTKCipher)(isEncrypt ? AESKeyWrap_Encrypt
                                                       : AESKeyWrap_Decrypt);
          }
          context->destroy = (SFTKDestroy)AESKeyWrap_DestroyContext;
          break;

      default:
          crv = CKR_MECHANISM_INVALID0x00000070UL;
          break;
  }

  if (crv != CKR_OK0x00000000UL) {
      sftk_FreeContext(context);
      sftk_FreeSession(session);
      return crv;
  }
  sftk_SetContextByType(session, contextType, context);
  sftk_FreeSession(session);
  return CKR_OK0x00000000UL;
1423}

1425/* NSC_EncryptInit initializes an encryption operation. */
1426CK_RV
1427NSC_EncryptInit(CK_SESSION_HANDLE hSession,
              CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey)
1429{
  CHECK_FORK();
  return sftk_CryptInit(hSession, pMechanism, hKey, CKA_ENCRYPT0x00000104UL, CKA_ENCRYPT0x00000104UL,
                        SFTK_ENCRYPT, PR_TRUE1);
1433}

1435/* NSC_EncryptUpdate continues a multiple-part encryption operation. */
1436CK_RV
1437NSC_EncryptUpdate(CK_SESSION_HANDLE hSession,
                CK_BYTE_PTR pPart, CK_ULONG ulPartLen, CK_BYTE_PTR pEncryptedPart,
                CK_ULONG_PTR pulEncryptedPartLen)
1440{
  SFTKSessionContext *context;
  unsigned int outlen, i;
  unsigned int padoutlen = 0;
  unsigned int maxout = *pulEncryptedPartLen;
  CK_RV crv;
  SECStatus rv;

  CHECK_FORK();

  /* make sure we're legal */
  crv = sftk_GetContext(hSession, &context, SFTK_ENCRYPT, PR_TRUE1, NULL((void*)0));
  if (crv != CKR_OK0x00000000UL)
      return crv;

  if (!pEncryptedPart) {
      if (context->doPad) {
          CK_ULONG totalDataAvailable = ulPartLen + context->padDataLength;
          CK_ULONG blocksToSend = totalDataAvailable / context->blockSize;

          *pulEncryptedPartLen = blocksToSend * context->blockSize;
          return CKR_OK0x00000000UL;
      }
      *pulEncryptedPartLen = ulPartLen;
      return CKR_OK0x00000000UL;
  }

  /* do padding */
  if (context->doPad) {
      /* deal with previous buffered data */
      if (context->padDataLength != 0) {
          /* fill in the padded to a full block size */
          for (i = context->padDataLength;
               (ulPartLen != 0) && i < context->blockSize; i++) {
              context->padBuf[i] = *pPart++;
              ulPartLen--;
              context->padDataLength++;
          }

          /* not enough data to encrypt yet? then return */
          if (context->padDataLength != context->blockSize) {
              *pulEncryptedPartLen = 0;
              return CKR_OK0x00000000UL;
          }
          /* encrypt the current padded data */
          rv = (*context->update)(context->cipherInfo, pEncryptedPart,
                                  &padoutlen, maxout, context->padBuf,
                                  context->blockSize);
          if (rv != SECSuccess) {
              return sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
          }
          pEncryptedPart += padoutlen;
          maxout -= padoutlen;
      }
      /* save the residual */
      context->padDataLength = ulPartLen % context->blockSize;
      if (context->padDataLength) {
          PORT_Memcpymemcpy(context->padBuf,
                      &pPart[ulPartLen - context->padDataLength],
                      context->padDataLength);
          ulPartLen -= context->padDataLength;
      }
      /* if we've exhausted our new buffer, we're done */
      if (ulPartLen == 0) {
          *pulEncryptedPartLen = padoutlen;
          return CKR_OK0x00000000UL;
      }
  }

  /* do it: NOTE: this assumes buf size in is >= buf size out! */
  rv = (*context->update)(context->cipherInfo, pEncryptedPart,
                          &outlen, maxout, pPart, ulPartLen);
  if (rv != SECSuccess) {
      return sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
  }
  *pulEncryptedPartLen = (CK_ULONG)(outlen + padoutlen);
  return CKR_OK0x00000000UL;
1517}

1519/* NSC_EncryptFinal finishes a multiple-part encryption operation. */
1520CK_RV
1521NSC_EncryptFinal(CK_SESSION_HANDLE hSession,
               CK_BYTE_PTR pLastEncryptedPart, CK_ULONG_PTR pulLastEncryptedPartLen)
1523{
  SFTKSession *session;
  SFTKSessionContext *context;
  unsigned int outlen, i;
  unsigned int maxout = *pulLastEncryptedPartLen;
  CK_RV crv;
  SECStatus rv = SECSuccess;
  PRBool contextFinished = PR_TRUE1;

  CHECK_FORK();

  /* make sure we're legal */
  crv = sftk_GetContext(hSession, &context, SFTK_ENCRYPT, PR_TRUE1, &session);
  if (crv != CKR_OK0x00000000UL)
      return crv;

  *pulLastEncryptedPartLen = 0;
  if (!pLastEncryptedPart) {
      /* caller is checking the amount of remaining data */
      if (context->blockSize > 0 && context->doPad) {
          *pulLastEncryptedPartLen = context->blockSize;
          contextFinished = PR_FALSE0; /* still have padding to go */
      }
      goto finish;
  }

  /* do padding */
  if (context->doPad) {
      unsigned char padbyte = (unsigned char)(context->blockSize - context->padDataLength);
      /* fill out rest of pad buffer with pad magic*/
      for (i = context->padDataLength; i < context->blockSize; i++) {
          context->padBuf[i] = padbyte;
      }
      rv = (*context->update)(context->cipherInfo, pLastEncryptedPart,
                              &outlen, maxout, context->padBuf, context->blockSize);
      if (rv == SECSuccess)
          *pulLastEncryptedPartLen = (CK_ULONG)outlen;
  }

1562finish:
  if (contextFinished)
      sftk_TerminateOp(session, SFTK_ENCRYPT, context);
  sftk_FreeSession(session);
  return (rv == SECSuccess) ? CKR_OK0x00000000UL : sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
1567}

1569/* NSC_Encrypt encrypts single-part data. */
1570CK_RV
1571NSC_Encrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData,
          CK_ULONG ulDataLen, CK_BYTE_PTR pEncryptedData,
          CK_ULONG_PTR pulEncryptedDataLen)
1574{
  SFTKSession *session;
  SFTKSessionContext *context;
  unsigned int outlen;
  unsigned int maxoutlen = *pulEncryptedDataLen;
  CK_RV crv;
  CK_RV crv2;
  SECStatus rv = SECSuccess;
  SECItem pText;

  pText.type = siBuffer;
  pText.data = pData;
  pText.len = ulDataLen;

  CHECK_FORK();

  /* make sure we're legal */
  crv = sftk_GetContext(hSession, &context, SFTK_ENCRYPT, PR_FALSE0, &session);
  if (crv != CKR_OK0x00000000UL)
      return crv;

  if (!pEncryptedData) {
      outlen = context->rsa ? context->maxLen : ulDataLen + 2 * context->blockSize;
      goto done;
  }

  if (context->doPad) {
      if (context->multi) {
          CK_ULONG updateLen = maxoutlen;
          CK_ULONG finalLen;
          /* padding is fairly complicated, have the update and final
           * code deal with it */
          sftk_FreeSession(session);
          crv = NSC_EncryptUpdate(hSession, pData, ulDataLen, pEncryptedData,
                                  &updateLen);
          if (crv != CKR_OK0x00000000UL) {
              updateLen = 0;
          }
          maxoutlen -= updateLen;
          pEncryptedData += updateLen;
          finalLen = maxoutlen;
          crv2 = NSC_EncryptFinal(hSession, pEncryptedData, &finalLen);
          if (crv == CKR_OK0x00000000UL && crv2 == CKR_OK0x00000000UL) {
              *pulEncryptedDataLen = updateLen + finalLen;
          }
          return crv == CKR_OK0x00000000UL ? crv2 : crv;
      }
      /* doPad without multi means that padding must be done on the first
      ** and only update.  There will be no final.
      */
      PORT_Assert(context->blockSize > 1)((context->blockSize > 1)?((void)0):PR_Assert("context->blockSize > 1"
,"pkcs11c.c",1624));
      if (context->blockSize > 1) {
          CK_ULONG remainder = ulDataLen % context->blockSize;
          CK_ULONG padding = context->blockSize - remainder;
          pText.len += padding;
          pText.data = PORT_ZAllocPORT_ZAlloc_Util(pText.len);
          if (pText.data) {
              memcpy(pText.data, pData, ulDataLen);
              memset(pText.data + ulDataLen, padding, padding);
          } else {
              crv = CKR_HOST_MEMORY0x00000002UL;
              goto fail;
          }
      }
  }

  /* do it: NOTE: this assumes buf size is big enough. */
  rv = (*context->update)(context->cipherInfo, pEncryptedData,
                          &outlen, maxoutlen, pText.data, pText.len);
  crv = (rv == SECSuccess) ? CKR_OK0x00000000UL : sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
  if (pText.data != pData)
      PORT_ZFreePORT_ZFree_Util(pText.data, pText.len);
1646fail:
  sftk_TerminateOp(session, SFTK_ENCRYPT, context);
1648done:
  sftk_FreeSession(session);
  if (crv == CKR_OK0x00000000UL) {
      *pulEncryptedDataLen = (CK_ULONG)outlen;
  }
  return crv;
1654}

1656/*
************** Crypto Functions:     Decrypt ************************
*/

1660/* NSC_DecryptInit initializes a decryption operation. */
1661CK_RV
1662NSC_DecryptInit(CK_SESSION_HANDLE hSession,
              CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey)
1664{
  CHECK_FORK();
  return sftk_CryptInit(hSession, pMechanism, hKey, CKA_DECRYPT0x00000105UL, CKA_DECRYPT0x00000105UL,
                        SFTK_DECRYPT, PR_FALSE0);
1668}

1670/* NSC_DecryptUpdate continues a multiple-part decryption operation. */
1671CK_RV
1672NSC_DecryptUpdate(CK_SESSION_HANDLE hSession,
                CK_BYTE_PTR pEncryptedPart, CK_ULONG ulEncryptedPartLen,
                CK_BYTE_PTR pPart, CK_ULONG_PTR pulPartLen)
1675{
  SFTKSessionContext *context;
  unsigned int padoutlen = 0;
  unsigned int outlen;
  unsigned int maxout = *pulPartLen;
  CK_RV crv;
  SECStatus rv;

  CHECK_FORK();

  /* make sure we're legal */
  crv = sftk_GetContext(hSession, &context, SFTK_DECRYPT, PR_TRUE1, NULL((void*)0));
  if (crv != CKR_OK0x00000000UL)
      return crv;

  /* this can only happen on an NSS programming error */
  PORT_Assert((context->padDataLength == 0) || context->padDataLength == context->blockSize)(((context->padDataLength == 0) || context->padDataLength
 == context->blockSize)?((void)0):PR_Assert("(context->padDataLength == 0) || context->padDataLength == context->blockSize"
,"pkcs11c.c",1691));

  if (context->doPad) {
      /* Check the data length for block ciphers. If we are padding,
       * then we must be using a block cipher. In the non-padding case
       * the error will be returned by the underlying decryption
       * function when we do the actual decrypt. We need to do the
       * check here to avoid returning a negative length to the caller
       * or reading before the beginning of the pEncryptedPart buffer.
       */
      if ((ulEncryptedPartLen == 0) ||
          (ulEncryptedPartLen % context->blockSize) != 0) {
          return CKR_ENCRYPTED_DATA_LEN_RANGE0x00000041UL;
      }
  }

  if (!pPart) {
      if (context->doPad) {
          *pulPartLen =
              ulEncryptedPartLen + context->padDataLength - context->blockSize;
          return CKR_OK0x00000000UL;
      }
      /* for stream ciphers there is are no constraints on ulEncryptedPartLen.
       * for block ciphers, it must be a multiple of blockSize. The error is
       * detected when this function is called again do decrypt the output.
       */
      *pulPartLen = ulEncryptedPartLen;
      return CKR_OK0x00000000UL;
  }

  if (context->doPad) {
      /* first decrypt our saved buffer */
      if (context->padDataLength != 0) {
          rv = (*context->update)(context->cipherInfo, pPart, &padoutlen,
                                  maxout, context->padBuf, context->blockSize);
          if (rv != SECSuccess)
              return sftk_MapDecryptError(PORT_GetErrorPORT_GetError_Util());
          pPart += padoutlen;
          maxout -= padoutlen;
      }
      /* now save the final block for the next decrypt or the final */
      PORT_Memcpymemcpy(context->padBuf, &pEncryptedPart[ulEncryptedPartLen - context->blockSize],
                  context->blockSize);
      context->padDataLength = context->blockSize;
      ulEncryptedPartLen -= context->padDataLength;
  }

  /* do it: NOTE: this assumes buf size in is >= buf size out! */
  rv = (*context->update)(context->cipherInfo, pPart, &outlen,
                          maxout, pEncryptedPart, ulEncryptedPartLen);
  if (rv != SECSuccess) {
      return sftk_MapDecryptError(PORT_GetErrorPORT_GetError_Util());
  }
  *pulPartLen = (CK_ULONG)(outlen + padoutlen);
  return CKR_OK0x00000000UL;
1746}

1748/* NSC_DecryptFinal finishes a multiple-part decryption operation. */
1749CK_RV
1750NSC_DecryptFinal(CK_SESSION_HANDLE hSession,
               CK_BYTE_PTR pLastPart, CK_ULONG_PTR pulLastPartLen)
1752{
  SFTKSession *session;
  SFTKSessionContext *context;
  unsigned int outlen;
  unsigned int maxout = *pulLastPartLen;
  CK_RV crv;
  SECStatus rv = SECSuccess;

  CHECK_FORK();

  /* make sure we're legal */
  crv = sftk_GetContext(hSession, &context, SFTK_DECRYPT, PR_TRUE1, &session);
  if (crv != CKR_OK0x00000000UL)
      return crv;

  *pulLastPartLen = 0;
  if (!pLastPart) {
      /* caller is checking the amount of remaining data */
      if (context->padDataLength > 0) {
          *pulLastPartLen = context->padDataLength;
      }
      goto finish;
  }

  if (context->doPad) {
      /* decrypt our saved buffer */
      if (context->padDataLength != 0) {
          /* this assumes that pLastPart is big enough to hold the *whole*
           * buffer!!! */
          rv = (*context->update)(context->cipherInfo, pLastPart, &outlen,
                                  maxout, context->padBuf, context->blockSize);
          if (rv != SECSuccess) {
              crv = sftk_MapDecryptError(PORT_GetErrorPORT_GetError_Util());
          } else {
              unsigned int padSize = 0;
              crv = sftk_CheckCBCPadding(pLastPart, outlen,
                                         context->blockSize, &padSize);
              /* Update pulLastPartLen, in constant time, if crv is OK */
              *pulLastPartLen = PORT_CT_SEL(sftk_CKRVToMask(crv), outlen - padSize, *pulLastPartLen)(((sftk_CKRVToMask(crv)) & (outlen - padSize)) | (~(sftk_CKRVToMask
(crv)) & (*pulLastPartLen)));
          }
      }
  }

  sftk_TerminateOp(session, SFTK_DECRYPT, context);
1796finish:
  sftk_FreeSession(session);
  return crv;
1799}

1801/* NSC_Decrypt decrypts encrypted data in a single part. */
1802CK_RV
1803NSC_Decrypt(CK_SESSION_HANDLE hSession,
          CK_BYTE_PTR pEncryptedData, CK_ULONG ulEncryptedDataLen, CK_BYTE_PTR pData,
          CK_ULONG_PTR pulDataLen)
1806{
  SFTKSession *session;
  SFTKSessionContext *context;
  unsigned int outlen;
  unsigned int maxoutlen = *pulDataLen;
  CK_RV crv;
  CK_RV crv2;
  SECStatus rv = SECSuccess;

  CHECK_FORK();

  /* make sure we're legal */
  crv = sftk_GetContext(hSession, &context, SFTK_DECRYPT, PR_FALSE0, &session);
  if (crv != CKR_OK0x00000000UL)
      return crv;

  if (!pData) {
      *pulDataLen = (CK_ULONG)(ulEncryptedDataLen + context->blockSize);
      goto done;
  }

  if (context->doPad && context->multi) {
      CK_ULONG updateLen = maxoutlen;
      CK_ULONG finalLen;
      /* padding is fairly complicated, have the update and final
       * code deal with it */
      sftk_FreeSession(session);
      crv = NSC_DecryptUpdate(hSession, pEncryptedData, ulEncryptedDataLen,
                              pData, &updateLen);
      if (crv == CKR_OK0x00000000UL) {
          maxoutlen -= updateLen;
          pData += updateLen;
      }
      finalLen = maxoutlen;
      crv2 = NSC_DecryptFinal(hSession, pData, &finalLen);
      if (crv == CKR_OK0x00000000UL) {
          *pulDataLen = PORT_CT_SEL(sftk_CKRVToMask(crv2), updateLen + finalLen, *pulDataLen)(((sftk_CKRVToMask(crv2)) & (updateLen + finalLen)) | (~(
sftk_CKRVToMask(crv2)) & (*pulDataLen)));
          return crv2;
      } else {
          return crv;
      }
  }

  rv = (*context->update)(context->cipherInfo, pData, &outlen, maxoutlen,
                          pEncryptedData, ulEncryptedDataLen);
  /* XXX need to do MUCH better error mapping than this. */
  crv = (rv == SECSuccess) ? CKR_OK0x00000000UL : sftk_MapDecryptError(PORT_GetErrorPORT_GetError_Util());
  if (rv == SECSuccess) {
      if (context->doPad) {
          unsigned int padSize = 0;
          crv = sftk_CheckCBCPadding(pData, outlen, context->blockSize,
                                     &padSize);
          /* Update pulDataLen, in constant time, if crv is OK */
          *pulDataLen = PORT_CT_SEL(sftk_CKRVToMask(crv), outlen - padSize, *pulDataLen)(((sftk_CKRVToMask(crv)) & (outlen - padSize)) | (~(sftk_CKRVToMask
(crv)) & (*pulDataLen)));
      } else {
          *pulDataLen = (CK_ULONG)outlen;
      }
  }
  sftk_TerminateOp(session, SFTK_DECRYPT, context);
1865done:
  sftk_FreeSession(session);
  return crv;
1868}

1870/*
************** Crypto Functions:     Digest (HASH)  ************************
*/

1874/* NSC_DigestInit initializes a message-digesting operation. */
1875CK_RV
1876NSC_DigestInit(CK_SESSION_HANDLE hSession,
             CK_MECHANISM_PTR pMechanism)
1878{
  SFTKSession *session;
  SFTKSessionContext *context;
  CK_RV crv = CKR_OK0x00000000UL;

  CHECK_FORK();

  session = sftk_SessionFromHandle(hSession);
  if (session == NULL((void*)0))
      return CKR_SESSION_HANDLE_INVALID0x000000B3UL;
  crv = sftk_InitGeneric(session, pMechanism, &context, SFTK_HASH,
                         NULL((void*)0), 0, NULL((void*)0), 0, CKA_DIGEST0x81000000L);
  if (crv != CKR_OK0x00000000UL) {
      sftk_FreeSession(session);
      return crv;
  }

1895#define INIT_MECH(mmm)case CKM_mmm: { mmmContext *mmm_ctx = mmm_NewContext(); context
->cipherInfo = (void *)mmm_ctx; context->cipherInfoLen =
 mmm_FlattenSize(mmm_ctx); context->currentMech = CKM_mmm;
 context->hashUpdate = (SFTKHash)mmm_Update; context->end
 = (SFTKEnd)mmm_End; context->destroy = (SFTKDestroy)mmm_DestroyContext
; context->maxLen = mmm_LENGTH; if (mmm_ctx) mmm_Begin(mmm_ctx
); else crv = 0x00000002UL; break; }                                         \
  case CKM_##mmm: {                                          \
      mmm##Context *mmm##_ctx = mmm##_NewContext();          \
      context->cipherInfo = (void *)mmm##_ctx;               \
      context->cipherInfoLen = mmm##_FlattenSize(mmm##_ctx); \
      context->currentMech = CKM_##mmm;                      \
      context->hashUpdate = (SFTKHash)mmm##_Update;          \
      context->end = (SFTKEnd)mmm##_End;                     \
      context->destroy = (SFTKDestroy)mmm##_DestroyContext;  \
      context->maxLen = mmm##_LENGTH;                        \
      if (mmm##_ctx)                                         \
          mmm##_Begin(mmm##_ctx);                            \
      else                                                   \
          crv = CKR_HOST_MEMORY0x00000002UL;                             \
      break;                                                 \
  }

  switch (pMechanism->mechanism) {
      INIT_MECH(MD2)case 0x00000200UL: { MD2Context *MD2_ctx = MD2_NewContext(); context
->cipherInfo = (void *)MD2_ctx; context->cipherInfoLen =
 MD2_FlattenSize(MD2_ctx); context->currentMech = 0x00000200UL
; context->hashUpdate = (SFTKHash)MD2_Update; context->
end = (SFTKEnd)MD2_End; context->destroy = (SFTKDestroy)MD2_DestroyContext
; context->maxLen = 16; if (MD2_ctx) MD2_Begin(MD2_ctx); else
 crv = 0x00000002UL; break; }
      INIT_MECH(MD5)case 0x00000210UL: { MD5Context *MD5_ctx = MD5_NewContext(); context
->cipherInfo = (void *)MD5_ctx; context->cipherInfoLen =
 MD5_FlattenSize(MD5_ctx); context->currentMech = 0x00000210UL
; context->hashUpdate = (SFTKHash)MD5_Update; context->
end = (SFTKEnd)MD5_End; context->destroy = (SFTKDestroy)MD5_DestroyContext
; context->maxLen = 16; if (MD5_ctx) MD5_Begin(MD5_ctx); else
 crv = 0x00000002UL; break; }
      INIT_MECH(SHA1)case 0x00000220UL: { SHA1Context *SHA1_ctx = SHA1_NewContext(
); context->cipherInfo = (void *)SHA1_ctx; context->cipherInfoLen
 = SHA1_FlattenSize(SHA1_ctx); context->currentMech = 0x00000220UL
; context->hashUpdate = (SFTKHash)SHA1_Update; context->
end = (SFTKEnd)SHA1_End; context->destroy = (SFTKDestroy)SHA1_DestroyContext
; context->maxLen = 20; if (SHA1_ctx) SHA1_Begin(SHA1_ctx)
; else crv = 0x00000002UL; break; }
      INIT_MECH(SHA224)case 0x00000255UL: { SHA224Context *SHA224_ctx = SHA224_NewContext
(); context->cipherInfo = (void *)SHA224_ctx; context->
cipherInfoLen = SHA224_FlattenSize(SHA224_ctx); context->currentMech
 = 0x00000255UL; context->hashUpdate = (SFTKHash)SHA224_Update
; context->end = (SFTKEnd)SHA224_End; context->destroy =
 (SFTKDestroy)SHA224_DestroyContext; context->maxLen = 28;
 if (SHA224_ctx) SHA224_Begin(SHA224_ctx); else crv = 0x00000002UL
; break; }
      INIT_MECH(SHA256)case 0x00000250UL: { SHA256Context *SHA256_ctx = SHA256_NewContext
(); context->cipherInfo = (void *)SHA256_ctx; context->
cipherInfoLen = SHA256_FlattenSize(SHA256_ctx); context->currentMech
 = 0x00000250UL; context->hashUpdate = (SFTKHash)SHA256_Update
; context->end = (SFTKEnd)SHA256_End; context->destroy =
 (SFTKDestroy)SHA256_DestroyContext; context->maxLen = 32;
 if (SHA256_ctx) SHA256_Begin(SHA256_ctx); else crv = 0x00000002UL
; break; }
      INIT_MECH(SHA384)case 0x00000260UL: { SHA384Context *SHA384_ctx = SHA384_NewContext
(); context->cipherInfo = (void *)SHA384_ctx; context->
cipherInfoLen = SHA384_FlattenSize(SHA384_ctx); context->currentMech
 = 0x00000260UL; context->hashUpdate = (SFTKHash)SHA384_Update
; context->end = (SFTKEnd)SHA384_End; context->destroy =
 (SFTKDestroy)SHA384_DestroyContext; context->maxLen = 48;
 if (SHA384_ctx) SHA384_Begin(SHA384_ctx); else crv = 0x00000002UL
; break; }
      INIT_MECH(SHA512)case 0x00000270UL: { SHA512Context *SHA512_ctx = SHA512_NewContext
(); context->cipherInfo = (void *)SHA512_ctx; context->
cipherInfoLen = SHA512_FlattenSize(SHA512_ctx); context->currentMech
 = 0x00000270UL; context->hashUpdate = (SFTKHash)SHA512_Update
; context->end = (SFTKEnd)SHA512_End; context->destroy =
 (SFTKDestroy)SHA512_DestroyContext; context->maxLen = 64;
 if (SHA512_ctx) SHA512_Begin(SHA512_ctx); else crv = 0x00000002UL
; break; }
      INIT_MECH(SHA3_224)case 0x000002B5UL: { SHA3_224Context *SHA3_224_ctx = SHA3_224_NewContext
(); context->cipherInfo = (void *)SHA3_224_ctx; context->
cipherInfoLen = SHA3_224_FlattenSize(SHA3_224_ctx); context->
currentMech = 0x000002B5UL; context->hashUpdate = (SFTKHash
)SHA3_224_Update; context->end = (SFTKEnd)SHA3_224_End; context
->destroy = (SFTKDestroy)SHA3_224_DestroyContext; context->
maxLen = 28; if (SHA3_224_ctx) SHA3_224_Begin(SHA3_224_ctx); else
 crv = 0x00000002UL; break; }
      INIT_MECH(SHA3_256)case 0x000002B0UL: { SHA3_256Context *SHA3_256_ctx = SHA3_256_NewContext
(); context->cipherInfo = (void *)SHA3_256_ctx; context->
cipherInfoLen = SHA3_256_FlattenSize(SHA3_256_ctx); context->
currentMech = 0x000002B0UL; context->hashUpdate = (SFTKHash
)SHA3_256_Update; context->end = (SFTKEnd)SHA3_256_End; context
->destroy = (SFTKDestroy)SHA3_256_DestroyContext; context->
maxLen = 32; if (SHA3_256_ctx) SHA3_256_Begin(SHA3_256_ctx); else
 crv = 0x00000002UL; break; }
      INIT_MECH(SHA3_384)case 0x000002C0UL: { SHA3_384Context *SHA3_384_ctx = SHA3_384_NewContext
(); context->cipherInfo = (void *)SHA3_384_ctx; context->
cipherInfoLen = SHA3_384_FlattenSize(SHA3_384_ctx); context->
currentMech = 0x000002C0UL; context->hashUpdate = (SFTKHash
)SHA3_384_Update; context->end = (SFTKEnd)SHA3_384_End; context
->destroy = (SFTKDestroy)SHA3_384_DestroyContext; context->
maxLen = 48; if (SHA3_384_ctx) SHA3_384_Begin(SHA3_384_ctx); else
 crv = 0x00000002UL; break; }
      INIT_MECH(SHA3_512)case 0x000002D0UL: { SHA3_512Context *SHA3_512_ctx = SHA3_512_NewContext
(); context->cipherInfo = (void *)SHA3_512_ctx; context->
cipherInfoLen = SHA3_512_FlattenSize(SHA3_512_ctx); context->
currentMech = 0x000002D0UL; context->hashUpdate = (SFTKHash
)SHA3_512_Update; context->end = (SFTKEnd)SHA3_512_End; context
->destroy = (SFTKDestroy)SHA3_512_DestroyContext; context->
maxLen = 64; if (SHA3_512_ctx) SHA3_512_Begin(SHA3_512_ctx); else
 crv = 0x00000002UL; break; }

      default:
          crv = CKR_MECHANISM_INVALID0x00000070UL;
          break;
  }

  if (crv != CKR_OK0x00000000UL) {
      sftk_FreeContext(context);
      sftk_FreeSession(session);
      return crv;
  }
  sftk_SetContextByType(session, SFTK_HASH, context);
  sftk_FreeSession(session);
  return CKR_OK0x00000000UL;
1938}

1940/* NSC_Digest digests data in a single part. */
1941CK_RV
1942NSC_Digest(CK_SESSION_HANDLE hSession,
         CK_BYTE_PTR pData, CK_ULONG ulDataLen, CK_BYTE_PTR pDigest,
         CK_ULONG_PTR pulDigestLen)
1945{
  SFTKSession *session;
  SFTKSessionContext *context;
  unsigned int digestLen;
  unsigned int maxout = *pulDigestLen;
  CK_RV crv;

  CHECK_FORK();

  /* make sure we're legal */
  crv = sftk_GetContext(hSession, &context, SFTK_HASH, PR_FALSE0, &session);
  if (crv != CKR_OK0x00000000UL)
      return crv;

  if (pDigest == NULL((void*)0)) {
      *pulDigestLen = context->maxLen;
      goto finish;
  }

1964#if (ULONG_MAX(9223372036854775807L *2UL+1UL) > UINT_MAX(2147483647 *2U +1U))
  /* The context->hashUpdate function takes an unsigned int for its data
   * length argument, but NSC_Digest takes an unsigned long. */
  while (ulDataLen > UINT_MAX(2147483647 *2U +1U)) {
      (*context->hashUpdate)(context->cipherInfo, pData, UINT_MAX(2147483647 *2U +1U));
      pData += UINT_MAX(2147483647 *2U +1U);
      ulDataLen -= UINT_MAX(2147483647 *2U +1U);
  }
1972#endif
  (*context->hashUpdate)(context->cipherInfo, pData, ulDataLen);

  /*  NOTE: this assumes buf size is bigenough for the algorithm */
  (*context->end)(context->cipherInfo, pDigest, &digestLen, maxout);
  *pulDigestLen = digestLen;

  sftk_TerminateOp(session, SFTK_HASH, context);
1980finish:
  sftk_FreeSession(session);
  return CKR_OK0x00000000UL;
1983}

1985/* NSC_DigestUpdate continues a multiple-part message-digesting operation. */
1986CK_RV
1987NSC_DigestUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
               CK_ULONG ulPartLen)
1989{
  SFTKSessionContext *context;
  CK_RV crv;

  CHECK_FORK();

  /* make sure we're legal */
  crv = sftk_GetContext(hSession, &context, SFTK_HASH, PR_TRUE1, NULL((void*)0));
  if (crv != CKR_OK0x00000000UL)
      return crv;

2000#if (ULONG_MAX(9223372036854775807L *2UL+1UL) > UINT_MAX(2147483647 *2U +1U))
  /* The context->hashUpdate function takes an unsigned int for its data
   * length argument, but NSC_DigestUpdate takes an unsigned long. */
  while (ulPartLen > UINT_MAX(2147483647 *2U +1U)) {
      (*context->hashUpdate)(context->cipherInfo, pPart, UINT_MAX(2147483647 *2U +1U));
      pPart += UINT_MAX(2147483647 *2U +1U);
      ulPartLen -= UINT_MAX(2147483647 *2U +1U);
  }
2008#endif
  (*context->hashUpdate)(context->cipherInfo, pPart, ulPartLen);

  return CKR_OK0x00000000UL;
2012}

2014/* NSC_DigestFinal finishes a multiple-part message-digesting operation. */
2015CK_RV
2016NSC_DigestFinal(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pDigest,
              CK_ULONG_PTR pulDigestLen)
2018{
  SFTKSession *session;
  SFTKSessionContext *context;
  unsigned int maxout = *pulDigestLen;
  unsigned int digestLen;
  CK_RV crv;

  CHECK_FORK();

  /* make sure we're legal */
  crv = sftk_GetContext(hSession, &context, SFTK_HASH, PR_TRUE1, &session);
  if (crv != CKR_OK0x00000000UL)
      return crv;

  if (pDigest != NULL((void*)0)) {
      (*context->end)(context->cipherInfo, pDigest, &digestLen, maxout);
      *pulDigestLen = digestLen;
      sftk_TerminateOp(session, SFTK_HASH, context);
  } else {
      *pulDigestLen = context->maxLen;
  }

  sftk_FreeSession(session);
  return CKR_OK0x00000000UL;
2042}

2044/*
* these helper functions are used by Generic Macing and Signing functions
* that use hashes as part of their operations.
*/
2048#define DOSUB(mmm)static CK_RV sftk_doSubmmm(SFTKSessionContext *context) { mmmContext
 *mmm_ctx = mmm_NewContext(); context->hashInfo = (void *)
mmm_ctx; context->hashUpdate = (SFTKHash)mmm_Update; context
->end = (SFTKEnd)mmm_End; context->hashdestroy = (SFTKDestroy
)mmm_DestroyContext; if (!context->hashInfo) { return 0x00000002UL
; } mmm_Begin(mmm_ctx); return 0x00000000UL; }                                                \
  static CK_RV                                                  \
      sftk_doSub##mmm(SFTKSessionContext *context)              \
  {                                                             \
      mmm##Context *mmm##_ctx = mmm##_NewContext();             \
      context->hashInfo = (void *)mmm##_ctx;                    \
      context->hashUpdate = (SFTKHash)mmm##_Update;             \
      context->end = (SFTKEnd)mmm##_End;                        \
      context->hashdestroy = (SFTKDestroy)mmm##_DestroyContext; \
      if (!context->hashInfo) {                                 \
          return CKR_HOST_MEMORY0x00000002UL;                               \
      }                                                         \
      mmm##_Begin(mmm##_ctx);                                   \
      return CKR_OK0x00000000UL;                                            \
  }

2064DOSUB(MD2)static CK_RV sftk_doSubMD2(SFTKSessionContext *context) { MD2Context
 *MD2_ctx = MD2_NewContext(); context->hashInfo = (void *)
MD2_ctx; context->hashUpdate = (SFTKHash)MD2_Update; context
->end = (SFTKEnd)MD2_End; context->hashdestroy = (SFTKDestroy
)MD2_DestroyContext; if (!context->hashInfo) { return 0x00000002UL
; } MD2_Begin(MD2_ctx); return 0x00000000UL; }
2065DOSUB(MD5)static CK_RV sftk_doSubMD5(SFTKSessionContext *context) { MD5Context
 *MD5_ctx = MD5_NewContext(); context->hashInfo = (void *)
MD5_ctx; context->hashUpdate = (SFTKHash)MD5_Update; context
->end = (SFTKEnd)MD5_End; context->hashdestroy = (SFTKDestroy
)MD5_DestroyContext; if (!context->hashInfo) { return 0x00000002UL
; } MD5_Begin(MD5_ctx); return 0x00000000UL; }
2066DOSUB(SHA1)static CK_RV sftk_doSubSHA1(SFTKSessionContext *context) { SHA1Context
 *SHA1_ctx = SHA1_NewContext(); context->hashInfo = (void *
)SHA1_ctx; context->hashUpdate = (SFTKHash)SHA1_Update; context
->end = (SFTKEnd)SHA1_End; context->hashdestroy = (SFTKDestroy
)SHA1_DestroyContext; if (!context->hashInfo) { return 0x00000002UL
; } SHA1_Begin(SHA1_ctx); return 0x00000000UL; }
2067DOSUB(SHA224)static CK_RV sftk_doSubSHA224(SFTKSessionContext *context) { SHA224Context
 *SHA224_ctx = SHA224_NewContext(); context->hashInfo = (void
 *)SHA224_ctx; context->hashUpdate = (SFTKHash)SHA224_Update
; context->end = (SFTKEnd)SHA224_End; context->hashdestroy
 = (SFTKDestroy)SHA224_DestroyContext; if (!context->hashInfo
) { return 0x00000002UL; } SHA224_Begin(SHA224_ctx); return 0x00000000UL
; }
2068DOSUB(SHA256)static CK_RV sftk_doSubSHA256(SFTKSessionContext *context) { SHA256Context
 *SHA256_ctx = SHA256_NewContext(); context->hashInfo = (void
 *)SHA256_ctx; context->hashUpdate = (SFTKHash)SHA256_Update
; context->end = (SFTKEnd)SHA256_End; context->hashdestroy
 = (SFTKDestroy)SHA256_DestroyContext; if (!context->hashInfo
) { return 0x00000002UL; } SHA256_Begin(SHA256_ctx); return 0x00000000UL
; }
2069DOSUB(SHA384)static CK_RV sftk_doSubSHA384(SFTKSessionContext *context) { SHA384Context
 *SHA384_ctx = SHA384_NewContext(); context->hashInfo = (void
 *)SHA384_ctx; context->hashUpdate = (SFTKHash)SHA384_Update
; context->end = (SFTKEnd)SHA384_End; context->hashdestroy
 = (SFTKDestroy)SHA384_DestroyContext; if (!context->hashInfo
) { return 0x00000002UL; } SHA384_Begin(SHA384_ctx); return 0x00000000UL
; }
2070DOSUB(SHA512)static CK_RV sftk_doSubSHA512(SFTKSessionContext *context) { SHA512Context
 *SHA512_ctx = SHA512_NewContext(); context->hashInfo = (void
 *)SHA512_ctx; context->hashUpdate = (SFTKHash)SHA512_Update
; context->end = (SFTKEnd)SHA512_End; context->hashdestroy
 = (SFTKDestroy)SHA512_DestroyContext; if (!context->hashInfo
) { return 0x00000002UL; } SHA512_Begin(SHA512_ctx); return 0x00000000UL
; }

2072static SECStatus
2073sftk_SignCopy(
  CK_ULONG *copyLen,
  void *out, unsigned int *outLength,
  unsigned int maxLength,
  const unsigned char *hashResult,
  unsigned int hashResultLength)
2079{
  unsigned int toCopy = *copyLen;
  if (toCopy > maxLength) {
      toCopy = maxLength;
  }
  if (toCopy > hashResultLength) {
      toCopy = hashResultLength;
  }
  memcpy(out, hashResult, toCopy);
  if (outLength) {
      *outLength = toCopy;
  }
  return SECSuccess;
2092}

2094/* Verify is just a compare for HMAC */
2095static SECStatus
2096sftk_HMACCmp(CK_ULONG *copyLen, unsigned char *sig, unsigned int sigLen,
           unsigned char *hash, unsigned int hashLen)
2098{
  if (NSS_SecureMemcmp(sig, hash, *copyLen) == 0) {
      return SECSuccess;
  }

  PORT_SetErrorPORT_SetError_Util(SEC_ERROR_BAD_SIGNATURE);
  return SECFailure;
2105}

2107/*
* common HMAC + CMAC initialization routine
*/
2110static CK_RV
2111sftk_doMACInit(CK_MECHANISM_TYPE mech, SFTKSessionContext *session,
             SFTKObject *key, CK_ULONG mac_size)
2113{
  CK_RV crv;
  sftk_MACCtx *context;
  CK_ULONG *intpointer;
  PRBool isFIPS = sftk_isFIPS(key->slot->slotID)(((key->slot->slotID) == 3) || ((key->slot->slotID
) >= 101));

  /* Set up the initial context. */
  crv = sftk_MAC_Create(mech, key, &context);
  if (crv != CKR_OK0x00000000UL) {
      return crv;
  }

  session->hashInfo = context;
  session->multi = PR_TRUE1;

  /* Required by FIPS 198 Section 4. Delay this check until after the MAC
   * has been initialized to steal the output size of the MAC. */
  if (isFIPS && (mac_size < 4 || mac_size < context->mac_size / 2)) {
      sftk_MAC_Destroy(context, PR_TRUE1);
      return CKR_BUFFER_TOO_SMALL0x00000150UL;
  }

  /* Configure our helper functions appropriately. Note that these casts
   * ignore the return values. */
  session->hashUpdate = (SFTKHash)sftk_MAC_Update;
  session->end = (SFTKEnd)sftk_MAC_Finish;
  session->hashdestroy = (SFTKDestroy)sftk_MAC_Destroy;

  intpointer = PORT_New(CK_ULONG)(CK_ULONG *)PORT_Alloc_Util(sizeof(CK_ULONG));
  if (intpointer == NULL((void*)0)) {
      sftk_MAC_Destroy(context, PR_TRUE1);
      return CKR_HOST_MEMORY0x00000002UL;
  }
  *intpointer = mac_size;
  session->cipherInfo = intpointer;

  /* Since we're only "hashing", copy the result from session->end to the
   * caller using sftk_SignCopy. */
  session->update = (SFTKCipher)sftk_SignCopy;
  session->verify = (SFTKVerify)sftk_HMACCmp;
  session->destroy = (SFTKDestroy)sftk_Space;

  session->maxLen = context->mac_size;

  return CKR_OK0x00000000UL;
2158}

2160/*
*  SSL Macing support. SSL Macs are inited, then update with the base
* hashing algorithm, then finalized in sign and verify
*/

2165/*
* FROM SSL:
* 60 bytes is 3 times the maximum length MAC size that is supported.
* We probably should have one copy of this table. We still need this table
* in ssl to 'sign' the handshake hashes.
*/
2171static unsigned char ssl_pad_1[60] = {
  0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
  0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
  0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
  0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
  0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
  0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
  0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
  0x36, 0x36, 0x36, 0x36
2180};
2181static unsigned char ssl_pad_2[60] = {
  0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
  0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
  0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
  0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
  0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
  0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
  0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
  0x5c, 0x5c, 0x5c, 0x5c
2190};

2192static SECStatus
2193sftk_SSLMACSign(SFTKSSLMACInfo *info, unsigned char *sig, unsigned int *sigLen,
              unsigned int maxLen, unsigned char *hash, unsigned int hashLen)
2195{
  unsigned char tmpBuf[SFTK_MAX_MAC_LENGTH64];
  unsigned int out;

  info->begin(info->hashContext);
  info->update(info->hashContext, info->key, info->keySize);
  info->update(info->hashContext, ssl_pad_2, info->padSize);
  info->update(info->hashContext, hash, hashLen);
  info->end(info->hashContext, tmpBuf, &out, SFTK_MAX_MAC_LENGTH64);
  PORT_Memcpymemcpy(sig, tmpBuf, info->macSize);
  PORT_Memsetmemset(tmpBuf, 0, info->macSize);
  *sigLen = info->macSize;
  return SECSuccess;
2208}

2210static SECStatus
2211sftk_SSLMACVerify(SFTKSSLMACInfo *info, unsigned char *sig, unsigned int sigLen,
                unsigned char *hash, unsigned int hashLen)
2213{
  unsigned char tmpBuf[SFTK_MAX_MAC_LENGTH64];
  unsigned int out;
  int cmp;

  info->begin(info->hashContext);
  info->update(info->hashContext, info->key, info->keySize);
  info->update(info->hashContext, ssl_pad_2, info->padSize);
  info->update(info->hashContext, hash, hashLen);
  info->end(info->hashContext, tmpBuf, &out, SFTK_MAX_MAC_LENGTH64);
  cmp = NSS_SecureMemcmp(sig, tmpBuf, info->macSize);
  PORT_Memsetmemset(tmpBuf, 0, info->macSize);
  return (cmp == 0) ? SECSuccess : SECFailure;
2226}

2228/*
* common HMAC initalization routine
*/
2231static CK_RV
2232sftk_doSSLMACInit(SFTKSessionContext *context, SECOidTag oid,
                SFTKObject *key, CK_ULONG mac_size)
2234{
  SFTKAttribute *keyval;
  SFTKBegin begin;
  int padSize;
  SFTKSSLMACInfo *sslmacinfo;
  CK_RV crv = CKR_MECHANISM_INVALID0x00000070UL;

  if (oid == SEC_OID_SHA1) {
      crv = sftk_doSubSHA1(context);
      if (crv != CKR_OK0x00000000UL)
          return crv;
      begin = (SFTKBegin)SHA1_Begin;
      padSize = 40;
  } else {
      crv = sftk_doSubMD5(context);
      if (crv != CKR_OK0x00000000UL)
          return crv;
      begin = (SFTKBegin)MD5_Begin;
      padSize = 48;
  }
  context->multi = PR_TRUE1;

  keyval = sftk_FindAttribute(key, CKA_VALUE0x00000011UL);
  if (keyval == NULL((void*)0))
      return CKR_KEY_SIZE_RANGE0x00000062UL;

  context->hashUpdate(context->hashInfo, keyval->attrib.pValue,
                      keyval->attrib.ulValueLen);
  context->hashUpdate(context->hashInfo, ssl_pad_1, padSize);
  sslmacinfo = (SFTKSSLMACInfo *)PORT_AllocPORT_Alloc_Util(sizeof(SFTKSSLMACInfo));
  if (sslmacinfo == NULL((void*)0)) {
      sftk_FreeAttribute(keyval);
      return CKR_HOST_MEMORY0x00000002UL;
  }
  sslmacinfo->size = sizeof(SFTKSSLMACInfo);
  sslmacinfo->macSize = mac_size;
  sslmacinfo->hashContext = context->hashInfo;
  PORT_Memcpymemcpy(sslmacinfo->key, keyval->attrib.pValue,
              keyval->attrib.ulValueLen);
  sslmacinfo->keySize = keyval->attrib.ulValueLen;
  sslmacinfo->begin = begin;
  sslmacinfo->end = context->end;
  sslmacinfo->update = context->hashUpdate;
  sslmacinfo->padSize = padSize;
  sftk_FreeAttribute(keyval);
  context->cipherInfo = (void *)sslmacinfo;
  context->destroy = (SFTKDestroy)sftk_ZSpace;
  context->update = (SFTKCipher)sftk_SSLMACSign;
  context->verify = (SFTKVerify)sftk_SSLMACVerify;
  context->maxLen = mac_size;
  return CKR_OK0x00000000UL;
2285}

2287/*
************** Crypto Functions:     Sign  ************************
*/

2291/**
* Check if We're using CBCMacing and initialize the session context if we are.
*  @param contextType SFTK_SIGN or SFTK_VERIFY
*  @param keyUsage    check whether key allows this usage
*/
2296static CK_RV
2297sftk_InitCBCMac(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
              CK_OBJECT_HANDLE hKey, CK_ATTRIBUTE_TYPE keyUsage,
              SFTKContextType contextType)

2301{
  CK_MECHANISM cbc_mechanism;
  CK_ULONG mac_bytes = SFTK_INVALID_MAC_SIZE0xffffffff;
2304#ifndef NSS_DISABLE_DEPRECATED_RC2
  CK_RC2_CBC_PARAMS rc2_params;
2306#endif
2307#if NSS_SOFTOKEN_DOES_RC5
  CK_RC5_CBC_PARAMS rc5_params;
  CK_RC5_MAC_GENERAL_PARAMS *rc5_mac;
2310#endif
  unsigned char ivBlock[SFTK_MAX_BLOCK_SIZE16];
  unsigned char k2[SFTK_MAX_BLOCK_SIZE16];
  unsigned char k3[SFTK_MAX_BLOCK_SIZE16];
  SFTKSessionContext *context;
  CK_RV crv;
  unsigned int blockSize;
  PRBool isXCBC = PR_FALSE0;

  if (!pMechanism) {
      return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
  }

  switch (pMechanism->mechanism) {
2324#ifndef NSS_DISABLE_DEPRECATED_RC2
      case CKM_RC2_MAC_GENERAL0x00000104UL:
          if (BAD_PARAM_CAST(pMechanism, sizeof(CK_RC2_MAC_GENERAL_PARAMS))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_RC2_MAC_GENERAL_PARAMS))) {
              return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
          }
          mac_bytes =
              ((CK_RC2_MAC_GENERAL_PARAMS *)pMechanism->pParameter)->ulMacLength;
      /* fall through */
      case CKM_RC2_MAC0x00000103UL:
          /* this works because ulEffectiveBits is in the same place in both the
           * CK_RC2_MAC_GENERAL_PARAMS and CK_RC2_CBC_PARAMS */
          rc2_params.ulEffectiveBits = ((CK_RC2_MAC_GENERAL_PARAMS *)
                                            pMechanism->pParameter)
                                           ->ulEffectiveBits;
          PORT_Memsetmemset(rc2_params.iv, 0, sizeof(rc2_params.iv));
          cbc_mechanism.mechanism = CKM_RC2_CBC0x00000102UL;
          cbc_mechanism.pParameter = &rc2_params;
          cbc_mechanism.ulParameterLen = sizeof(rc2_params);
          blockSize = 8;
          break;
2344#endif /* NSS_DISABLE_DEPRECATED_RC2 */

2346#if NSS_SOFTOKEN_DOES_RC5
      case CKM_RC5_MAC_GENERAL0x00000334UL:
          if (BAD_PARAM_CAST(pMechanism, sizeof(CK_RC5_MAC_GENERAL_PARAMS))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_RC5_MAC_GENERAL_PARAMS))) {
              return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
          }
          mac_bytes =
              ((CK_RC5_MAC_GENERAL_PARAMS *)pMechanism->pParameter)->ulMacLength;
      /* fall through */
      case CKM_RC5_MAC0x00000333UL:
          /* this works because ulEffectiveBits is in the same place in both the
           * CK_RC5_MAC_GENERAL_PARAMS and CK_RC5_CBC_PARAMS */
          if (BAD_PARAM_CAST(pMechanism, sizeof(CK_RC5_MAC_GENERAL_PARAMS))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_RC5_MAC_GENERAL_PARAMS))) {
              return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
          }
          rc5_mac = (CK_RC5_MAC_GENERAL_PARAMS *)pMechanism->pParameter;
          rc5_params.ulWordsize = rc5_mac->ulWordsize;
          rc5_params.ulRounds = rc5_mac->ulRounds;
          rc5_params.pIv = ivBlock;
          if ((blockSize = rc5_mac->ulWordsize * 2) > SFTK_MAX_BLOCK_SIZE16)
              return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
          rc5_params.ulIvLen = blockSize;
          PORT_Memsetmemset(ivBlock, 0, blockSize);
          cbc_mechanism.mechanism = CKM_RC5_CBC0x00000332UL;
          cbc_mechanism.pParameter = &rc5_params;
          cbc_mechanism.ulParameterLen = sizeof(rc5_params);
          break;
2372#endif
      /* add cast and idea later */
      case CKM_DES_MAC_GENERAL0x00000124UL:
          mac_bytes = *(CK_ULONG *)pMechanism->pParameter;
      /* fall through */
      case CKM_DES_MAC0x00000123UL:
          blockSize = 8;
          PORT_Memsetmemset(ivBlock, 0, blockSize);
          cbc_mechanism.mechanism = CKM_DES_CBC0x00000122UL;
          cbc_mechanism.pParameter = &ivBlock;
          cbc_mechanism.ulParameterLen = blockSize;
          break;
      case CKM_DES3_MAC_GENERAL0x00000135UL:
          mac_bytes = *(CK_ULONG *)pMechanism->pParameter;
      /* fall through */
      case CKM_DES3_MAC0x00000134UL:
          blockSize = 8;
          PORT_Memsetmemset(ivBlock, 0, blockSize);
          cbc_mechanism.mechanism = CKM_DES3_CBC0x00000133UL;
          cbc_mechanism.pParameter = &ivBlock;
          cbc_mechanism.ulParameterLen = blockSize;
          break;
      case CKM_CDMF_MAC_GENERAL0x00000144UL:
          mac_bytes = *(CK_ULONG *)pMechanism->pParameter;
      /* fall through */
      case CKM_CDMF_MAC0x00000143UL:
          blockSize = 8;
          PORT_Memsetmemset(ivBlock, 0, blockSize);
          cbc_mechanism.mechanism = CKM_CDMF_CBC0x00000142UL;
          cbc_mechanism.pParameter = &ivBlock;
          cbc_mechanism.ulParameterLen = blockSize;
          break;
2404#ifndef NSS_DISABLE_DEPRECATED_SEED
      case CKM_SEED_MAC_GENERAL0x00000654UL:
          mac_bytes = *(CK_ULONG *)pMechanism->pParameter;
      /* fall through */
      case CKM_SEED_MAC0x00000653UL:
          blockSize = 16;
          PORT_Memsetmemset(ivBlock, 0, blockSize);
          cbc_mechanism.mechanism = CKM_SEED_CBC0x00000652UL;
          cbc_mechanism.pParameter = &ivBlock;
          cbc_mechanism.ulParameterLen = blockSize;
          break;
2415#endif /* NSS_DISABLE_DEPRECATED_SEED */
      case CKM_CAMELLIA_MAC_GENERAL0x00000554UL:
          mac_bytes = *(CK_ULONG *)pMechanism->pParameter;
      /* fall through */
      case CKM_CAMELLIA_MAC0x00000553UL:
          blockSize = 16;
          PORT_Memsetmemset(ivBlock, 0, blockSize);
          cbc_mechanism.mechanism = CKM_CAMELLIA_CBC0x00000552UL;
          cbc_mechanism.pParameter = &ivBlock;
          cbc_mechanism.ulParameterLen = blockSize;
          break;
      case CKM_AES_MAC_GENERAL0x00001084UL:
          mac_bytes = *(CK_ULONG *)pMechanism->pParameter;
      /* fall through */
      case CKM_AES_MAC0x00001083UL:
          blockSize = 16;
          PORT_Memsetmemset(ivBlock, 0, blockSize);
          cbc_mechanism.mechanism = CKM_AES_CBC0x00001082UL;
          cbc_mechanism.pParameter = &ivBlock;
          cbc_mechanism.ulParameterLen = blockSize;
          break;
      case CKM_AES_XCBC_MAC_960x0000108DUL:
      case CKM_AES_XCBC_MAC0x0000108CUL:
          /* The only difference between CKM_AES_XCBC_MAC
           * and CKM_AES_XCBC_MAC_96 is the size of the returned mac. */
          mac_bytes = pMechanism->mechanism == CKM_AES_XCBC_MAC_960x0000108DUL ? 12 : 16;
          blockSize = 16;
          PORT_Memsetmemset(ivBlock, 0, blockSize);
          cbc_mechanism.mechanism = CKM_AES_CBC0x00001082UL;
          cbc_mechanism.pParameter = &ivBlock;
          cbc_mechanism.ulParameterLen = blockSize;
          /* is XCBC requires extra processing at the end of the operation */
          isXCBC = PR_TRUE1;
          /* The input key is used to generate k1, k2, and k3. k2 and k3
           * are used at the end in the pad step. k1 replaces the input
           * key in the aes cbc mac */
          crv = sftk_aes_xcbc_new_keys(hSession, hKey, &hKey, k2, k3);
          if (crv != CKR_OK0x00000000UL) {
              return crv;
          }
          break;
      default:
          return CKR_FUNCTION_NOT_SUPPORTED0x00000054UL;
  }

  /* if MAC size is externally supplied, it should be checked.
   */
  if (mac_bytes == SFTK_INVALID_MAC_SIZE0xffffffff)
      mac_bytes = blockSize >> 1;
  else {
      if (mac_bytes > blockSize) {
          crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
          goto fail;
      }
  }

  crv = sftk_CryptInit(hSession, &cbc_mechanism, hKey,
                       CKA_ENCRYPT0x00000104UL, /* CBC mech is able to ENCRYPT, not SIGN/VERIFY */
                       keyUsage, contextType, PR_TRUE1);
  if (crv != CKR_OK0x00000000UL)
      goto fail;
  crv = sftk_GetContext(hSession, &context, contextType, PR_TRUE1, NULL((void*)0));

  /* this shouldn't happen! */
  PORT_Assert(crv == CKR_OK)((crv == 0x00000000UL)?((void)0):PR_Assert("crv == CKR_OK","pkcs11c.c"
,2479));
  if (crv != CKR_OK0x00000000UL)
      goto fail;
  context->blockSize = blockSize;
  context->macSize = mac_bytes;
  context->isXCBC = isXCBC;
  if (isXCBC) {
      /* save the xcbc specific parameters */
      PORT_Memcpymemcpy(context->k2, k2, blockSize);
      PORT_Memcpymemcpy(context->k3, k3, blockSize);
      PORT_Memsetmemset(k2, 0, blockSize);
      PORT_Memsetmemset(k3, 0, blockSize);
      /* get rid of the temp key now that the context has been created */
      NSC_DestroyObject(hSession, hKey);
  }
  return CKR_OK0x00000000UL;
2495fail:
  if (isXCBC) {
      PORT_Memsetmemset(k2, 0, blockSize);
      PORT_Memsetmemset(k3, 0, blockSize);
      NSC_DestroyObject(hSession, hKey); /* get rid of our temp key */
  }
  return crv;
2502}

2504/*
* encode RSA PKCS #1 Signature data before signing...
*/
2507static SECStatus
2508sftk_RSAHashSign(SFTKHashSignInfo *info, unsigned char *sig,
               unsigned int *sigLen, unsigned int maxLen,
               const unsigned char *hash, unsigned int hashLen)
2511{
  PORT_Assert(info->key->keyType == NSSLOWKEYRSAKey)((info->key->keyType == NSSLOWKEYRSAKey)?((void)0):PR_Assert
("info->key->keyType == NSSLOWKEYRSAKey","pkcs11c.c",2512
));
  if (info->key->keyType != NSSLOWKEYRSAKey) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_KEY);
      return SECFailure;
  }

  return RSA_HashSign(info->hashOid, info->key, sig, sigLen, maxLen,
                      hash, hashLen);
2520}

2522/* XXX Old template; want to expunge it eventually. */
2523static DERTemplate SECAlgorithmIDTemplate[] = {
  { DER_SEQUENCE0x10,
    0, NULL((void*)0), sizeof(SECAlgorithmID) },
  { DER_OBJECT_ID0x06,
    offsetof(SECAlgorithmID, algorithm)__builtin_offsetof(SECAlgorithmID, algorithm) },
  { DER_OPTIONAL0x00100 | DER_ANY0x00400,
    offsetof(SECAlgorithmID, parameters)__builtin_offsetof(SECAlgorithmID, parameters) },
  { 0 }
2531};

2533/*
* XXX OLD Template.  Once all uses have been switched over to new one,
* remove this.
*/
2537static DERTemplate SGNDigestInfoTemplate[] = {
  { DER_SEQUENCE0x10,
    0, NULL((void*)0), sizeof(SGNDigestInfo) },
  { DER_INLINE0x00800,
    offsetof(SGNDigestInfo, digestAlgorithm)__builtin_offsetof(SGNDigestInfo, digestAlgorithm),
    SECAlgorithmIDTemplate },
  { DER_OCTET_STRING0x04,
    offsetof(SGNDigestInfo, digest)__builtin_offsetof(SGNDigestInfo, digest) },
  { 0 }
2546};

2548/*
* encode RSA PKCS #1 Signature data before signing...
*/
2551SECStatus
2552RSA_HashSign(SECOidTag hashOid, NSSLOWKEYPrivateKey *key,
           unsigned char *sig, unsigned int *sigLen, unsigned int maxLen,
           const unsigned char *hash, unsigned int hashLen)
2555{
  SECStatus rv = SECFailure;
  SECItem digder;
  PLArenaPool *arena = NULL((void*)0);
  SGNDigestInfo *di = NULL((void*)0);

  digder.data = NULL((void*)0);

  arena = PORT_NewArenaPORT_NewArena_Util(DER_DEFAULT_CHUNKSIZE(2048));
  if (!arena) {
      goto loser;
  }

  /* Construct digest info */
  di = SGN_CreateDigestInfoSGN_CreateDigestInfo_Util(hashOid, hash, hashLen);
  if (!di) {
      goto loser;
  }

  /* Der encode the digest as a DigestInfo */
  rv = DER_EncodeDER_Encode_Util(arena, &digder, SGNDigestInfoTemplate, di);
  if (rv != SECSuccess) {
      goto loser;
  }

  /*
  ** Encrypt signature after constructing appropriate PKCS#1 signature
  ** block
  */
  rv = RSA_Sign(&key->u.rsa, sig, sigLen, maxLen, digder.data,
                digder.len);
  if (rv != SECSuccess && PORT_GetErrorPORT_GetError_Util() == SEC_ERROR_LIBRARY_FAILURE) {
      sftk_fatalError = PR_TRUE1;
  }

2590loser:
  SGN_DestroyDigestInfoSGN_DestroyDigestInfo_Util(di);
  if (arena != NULL((void*)0)) {
      PORT_FreeArenaPORT_FreeArena_Util(arena, PR_TRUE1);
  }
  return rv;
2596}

2598static SECStatus
2599sftk_RSASign(NSSLOWKEYPrivateKey *key, unsigned char *output,
           unsigned int *outputLen, unsigned int maxOutputLen,
           const unsigned char *input, unsigned int inputLen)
2602{
  SECStatus rv = SECFailure;

  PORT_Assert(key->keyType == NSSLOWKEYRSAKey)((key->keyType == NSSLOWKEYRSAKey)?((void)0):PR_Assert("key->keyType == NSSLOWKEYRSAKey"
,"pkcs11c.c",2605));
  if (key->keyType != NSSLOWKEYRSAKey) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_KEY);
      return SECFailure;
  }

  rv = RSA_Sign(&key->u.rsa, output, outputLen, maxOutputLen, input,
                inputLen);
  if (rv != SECSuccess && PORT_GetErrorPORT_GetError_Util() == SEC_ERROR_LIBRARY_FAILURE) {
      sftk_fatalError = PR_TRUE1;
  }
  return rv;
2617}

2619static SECStatus
2620sftk_RSASignRaw(NSSLOWKEYPrivateKey *key, unsigned char *output,
              unsigned int *outputLen, unsigned int maxOutputLen,
              const unsigned char *input, unsigned int inputLen)
2623{
  SECStatus rv = SECFailure;

  PORT_Assert(key->keyType == NSSLOWKEYRSAKey)((key->keyType == NSSLOWKEYRSAKey)?((void)0):PR_Assert("key->keyType == NSSLOWKEYRSAKey"
,"pkcs11c.c",2626));
  if (key->keyType != NSSLOWKEYRSAKey) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_KEY);
      return SECFailure;
  }

  rv = RSA_SignRaw(&key->u.rsa, output, outputLen, maxOutputLen, input,
                   inputLen);
  if (rv != SECSuccess && PORT_GetErrorPORT_GetError_Util() == SEC_ERROR_LIBRARY_FAILURE) {
      sftk_fatalError = PR_TRUE1;
  }
  return rv;
2638}

2640static SECStatus
2641sftk_RSASignPSS(SFTKPSSSignInfo *info, unsigned char *sig,
              unsigned int *sigLen, unsigned int maxLen,
              const unsigned char *hash, unsigned int hashLen)
2644{
  SECStatus rv = SECFailure;
  HASH_HashType hashAlg;
  HASH_HashType maskHashAlg;
  CK_RSA_PKCS_PSS_PARAMS *params = &info->params;

  PORT_Assert(info->key->keyType == NSSLOWKEYRSAKey)((info->key->keyType == NSSLOWKEYRSAKey)?((void)0):PR_Assert
("info->key->keyType == NSSLOWKEYRSAKey","pkcs11c.c",2650
));
  if (info->key->keyType != NSSLOWKEYRSAKey) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_KEY);
      return SECFailure;
  }

  hashAlg = sftk_GetHashTypeFromMechanism(params->hashAlg);
  maskHashAlg = sftk_GetHashTypeFromMechanism(params->mgf);

  rv = RSA_SignPSS(&info->key->u.rsa, hashAlg, maskHashAlg, NULL((void*)0),
                   params->sLen, sig, sigLen, maxLen, hash, hashLen);
  if (rv != SECSuccess && PORT_GetErrorPORT_GetError_Util() == SEC_ERROR_LIBRARY_FAILURE) {
      sftk_fatalError = PR_TRUE1;
  }
  return rv;
2665}

2667static SECStatus
2668nsc_DSA_Verify_Stub(void *ctx, void *sigBuf, unsigned int sigLen,
                  void *dataBuf, unsigned int dataLen)
2670{
  SECItem signature = { siBuffer, (unsigned char *)sigBuf, sigLen };
  SECItem digest = { siBuffer, (unsigned char *)dataBuf, dataLen };
  NSSLOWKEYPublicKey *key = (NSSLOWKEYPublicKey *)ctx;
  return DSA_VerifyDigest(&(key->u.dsa), &signature, &digest);
2675}

2677static SECStatus
2678nsc_DSA_Sign_Stub(void *ctx, void *sigBuf,
                unsigned int *sigLen, unsigned int maxSigLen,
                void *dataBuf, unsigned int dataLen)
2681{
  NSSLOWKEYPrivateKey *key = (NSSLOWKEYPrivateKey *)ctx;
  SECItem signature = { siBuffer, (unsigned char *)sigBuf, maxSigLen };
  SECItem digest = { siBuffer, (unsigned char *)dataBuf, dataLen };
  SECStatus rv = DSA_SignDigest(&(key->u.dsa), &signature, &digest);
  if (rv != SECSuccess && PORT_GetErrorPORT_GetError_Util() == SEC_ERROR_LIBRARY_FAILURE) {
      sftk_fatalError = PR_TRUE1;
  }
  *sigLen = signature.len;
  return rv;
2691}

2693static SECStatus
2694nsc_ECDSAVerifyStub(void *ctx, void *sigBuf, unsigned int sigLen,
                  void *dataBuf, unsigned int dataLen)
2696{
  SECItem signature = { siBuffer, (unsigned char *)sigBuf, sigLen };
  SECItem digest = { siBuffer, (unsigned char *)dataBuf, dataLen };
  NSSLOWKEYPublicKey *key = (NSSLOWKEYPublicKey *)ctx;
  return ECDSA_VerifyDigest(&(key->u.ec), &signature, &digest);
2701}

2703static SECStatus
2704nsc_ECDSASignStub(void *ctx, void *sigBuf,
                unsigned int *sigLen, unsigned int maxSigLen,
                void *dataBuf, unsigned int dataLen)
2707{
  NSSLOWKEYPrivateKey *key = (NSSLOWKEYPrivateKey *)ctx;
  SECItem signature = { siBuffer, (unsigned char *)sigBuf, maxSigLen };
  SECItem digest = { siBuffer, (unsigned char *)dataBuf, dataLen };

  SECStatus rv = ECDSA_SignDigest(&(key->u.ec), &signature, &digest);
  if (rv != SECSuccess && PORT_GetErrorPORT_GetError_Util() == SEC_ERROR_LIBRARY_FAILURE) {
      sftk_fatalError = PR_TRUE1;
  }
  *sigLen = signature.len;
  return rv;
2718}

2720static SECStatus
2721nsc_EDDSAVerifyStub(void *ctx, void *sigBuf, unsigned int sigLen,
                  void *dataBuf, unsigned int dataLen)
2723{
  SECItem signature = { siBuffer, (unsigned char *)sigBuf, sigLen };
  SECItem digest = { siBuffer, (unsigned char *)dataBuf, dataLen };
  NSSLOWKEYPublicKey *key = (NSSLOWKEYPublicKey *)ctx;
  return ED_VerifyMessage(&(key->u.ec), &signature, &digest);
2728}

2730static SECStatus
2731nsc_EDDSASignStub(void *ctx, void *sigBuf,
                unsigned int *sigLen, unsigned int maxSigLen,
                void *dataBuf, unsigned int dataLen)
2734{
  NSSLOWKEYPrivateKey *key = (NSSLOWKEYPrivateKey *)ctx;
  SECItem signature = { siBuffer, (unsigned char *)sigBuf, maxSigLen };
  SECItem digest = { siBuffer, (unsigned char *)dataBuf, dataLen };

  SECStatus rv = ED_SignMessage(&(key->u.ec), &signature, &digest);
  if (rv != SECSuccess && PORT_GetErrorPORT_GetError_Util() == SEC_ERROR_LIBRARY_FAILURE) {
      sftk_fatalError = PR_TRUE1;
  }
  *sigLen = signature.len;
  return rv;
2745}

2747/* NSC_SignInit setups up the signing operations. There are three basic
* types of signing:
*      (1) the tradition single part, where "Raw RSA" or "Raw DSA" is applied
*  to data in a single Sign operation (which often looks a lot like an
*  encrypt, with data coming in and data going out).
*      (2) Hash based signing, where we continually hash the data, then apply
*  some sort of signature to the end.
*      (3) Block Encryption CBC MAC's, where the Data is encrypted with a key,
*  and only the final block is part of the mac.
*
*  For case number 3, we initialize a context much like the Encryption Context
*  (in fact we share code). We detect case 3 in C_SignUpdate, C_Sign, and
*  C_Final by the following method... if it's not multi-part, and it's doesn't
*  have a hash context, it must be a block Encryption CBC MAC.
*
*  For case number 2, we initialize a hash structure, as well as make it
*  multi-part. Updates are simple calls to the hash update function. Final
*  calls the hashend, then passes the result to the 'update' function (which
*  operates as a final signature function). In some hash based MAC'ing (as
*  opposed to hash base signatures), the update function is can be simply a
*  copy (as is the case with HMAC).
*/
2769CK_RV
2770NSC_SignInit(CK_SESSION_HANDLE hSession,
           CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey)
2772{
  SFTKSession *session;
  SFTKObject *key;
  SFTKSessionContext *context;
  CK_KEY_TYPE key_type;
  CK_RV crv = CKR_OK0x00000000UL;
  NSSLOWKEYPrivateKey *privKey;
  SFTKHashSignInfo *info = NULL((void*)0);
  SFTKPSSSignInfo *pinfo = NULL((void*)0);

  CHECK_FORK();

  /* Block Cipher MACing Algorithms use a different Context init method..*/
  crv = sftk_InitCBCMac(hSession, pMechanism, hKey, CKA_SIGN0x00000108UL, SFTK_SIGN);
  if (crv != CKR_FUNCTION_NOT_SUPPORTED0x00000054UL)
      return crv;

  /* we're not using a block cipher mac */
  session = sftk_SessionFromHandle(hSession);
  if (session == NULL((void*)0))
      return CKR_SESSION_HANDLE_INVALID0x000000B3UL;
  crv = sftk_InitGeneric(session, pMechanism, &context, SFTK_SIGN, &key,
                         hKey, &key_type, CKO_PRIVATE_KEY0x00000003UL, CKA_SIGN0x00000108UL);
  if (crv != CKR_OK0x00000000UL) {
      sftk_FreeSession(session);
      return crv;
  }

  context->multi = PR_FALSE0;

2802#define INIT_RSA_SIGN_MECH(mmm)case CKM_mmm_RSA_PKCS: context->multi = 1; crv = sftk_doSubmmm
(context); if (crv != 0x00000000UL) break; context->update
 = (SFTKCipher)sftk_RSAHashSign; info = (SFTKHashSignInfo *)PORT_Alloc_Util
(sizeof(SFTKHashSignInfo)); if (info == ((void*)0)) { crv = 0x00000002UL
; break; } info->hashOid = SEC_OID_mmm; goto finish_rsa;                         \
  case CKM_##mmm##_RSA_PKCS:                          \
      context->multi = PR_TRUE1;                       \
      crv = sftk_doSub##mmm(context);                 \
      if (crv != CKR_OK0x00000000UL)                              \
          break;                                      \
      context->update = (SFTKCipher)sftk_RSAHashSign; \
      info = PORT_New(SFTKHashSignInfo)(SFTKHashSignInfo *)PORT_Alloc_Util(sizeof(SFTKHashSignInfo));              \
      if (info == NULL((void*)0)) {                             \
          crv = CKR_HOST_MEMORY0x00000002UL;                      \
          break;                                      \
      }                                               \
      info->hashOid = SEC_OID_##mmm;                  \
      goto finish_rsa;

  switch (pMechanism->mechanism) {
      INIT_RSA_SIGN_MECH(MD5)case 0x00000005UL: context->multi = 1; crv = sftk_doSubMD5
(context); if (crv != 0x00000000UL) break; context->update
 = (SFTKCipher)sftk_RSAHashSign; info = (SFTKHashSignInfo *)PORT_Alloc_Util
(sizeof(SFTKHashSignInfo)); if (info == ((void*)0)) { crv = 0x00000002UL
; break; } info->hashOid = SEC_OID_MD5; goto finish_rsa;
      INIT_RSA_SIGN_MECH(MD2)case 0x00000004UL: context->multi = 1; crv = sftk_doSubMD2
(context); if (crv != 0x00000000UL) break; context->update
 = (SFTKCipher)sftk_RSAHashSign; info = (SFTKHashSignInfo *)PORT_Alloc_Util
(sizeof(SFTKHashSignInfo)); if (info == ((void*)0)) { crv = 0x00000002UL
; break; } info->hashOid = SEC_OID_MD2; goto finish_rsa;
      INIT_RSA_SIGN_MECH(SHA1)case 0x00000006UL: context->multi = 1; crv = sftk_doSubSHA1
(context); if (crv != 0x00000000UL) break; context->update
 = (SFTKCipher)sftk_RSAHashSign; info = (SFTKHashSignInfo *)PORT_Alloc_Util
(sizeof(SFTKHashSignInfo)); if (info == ((void*)0)) { crv = 0x00000002UL
; break; } info->hashOid = SEC_OID_SHA1; goto finish_rsa;
      INIT_RSA_SIGN_MECH(SHA224)case 0x00000046UL: context->multi = 1; crv = sftk_doSubSHA224
(context); if (crv != 0x00000000UL) break; context->update
 = (SFTKCipher)sftk_RSAHashSign; info = (SFTKHashSignInfo *)PORT_Alloc_Util
(sizeof(SFTKHashSignInfo)); if (info == ((void*)0)) { crv = 0x00000002UL
; break; } info->hashOid = SEC_OID_SHA224; goto finish_rsa
;
      INIT_RSA_SIGN_MECH(SHA256)case 0x00000040UL: context->multi = 1; crv = sftk_doSubSHA256
(context); if (crv != 0x00000000UL) break; context->update
 = (SFTKCipher)sftk_RSAHashSign; info = (SFTKHashSignInfo *)PORT_Alloc_Util
(sizeof(SFTKHashSignInfo)); if (info == ((void*)0)) { crv = 0x00000002UL
; break; } info->hashOid = SEC_OID_SHA256; goto finish_rsa
;
      INIT_RSA_SIGN_MECH(SHA384)case 0x00000041UL: context->multi = 1; crv = sftk_doSubSHA384
(context); if (crv != 0x00000000UL) break; context->update
 = (SFTKCipher)sftk_RSAHashSign; info = (SFTKHashSignInfo *)PORT_Alloc_Util
(sizeof(SFTKHashSignInfo)); if (info == ((void*)0)) { crv = 0x00000002UL
; break; } info->hashOid = SEC_OID_SHA384; goto finish_rsa
;
      INIT_RSA_SIGN_MECH(SHA512)case 0x00000042UL: context->multi = 1; crv = sftk_doSubSHA512
(context); if (crv != 0x00000000UL) break; context->update
 = (SFTKCipher)sftk_RSAHashSign; info = (SFTKHashSignInfo *)PORT_Alloc_Util
(sizeof(SFTKHashSignInfo)); if (info == ((void*)0)) { crv = 0x00000002UL
; break; } info->hashOid = SEC_OID_SHA512; goto finish_rsa
;

      case CKM_RSA_PKCS0x00000001UL:
          context->update = (SFTKCipher)sftk_RSASign;
          goto finish_rsa;
      case CKM_RSA_X_5090x00000003UL:
          context->update = (SFTKCipher)sftk_RSASignRaw;
      finish_rsa:
          if (key_type != CKK_RSA0x00000000UL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          context->rsa = PR_TRUE1;
          privKey = sftk_GetPrivKey(key, CKK_RSA0x00000000UL, &crv);
          if (privKey == NULL((void*)0)) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          /* OK, info is allocated only if we're doing hash and sign mechanism.
           * It's necessary to be able to set the correct OID in the final
           * signature.
           */
          if (info) {
              info->key = privKey;
              context->cipherInfo = info;
              context->destroy = (SFTKDestroy)sftk_Space;
          } else {
              context->cipherInfo = privKey;
              context->destroy = (SFTKDestroy)sftk_Null;
          }
          context->maxLen = nsslowkey_PrivateModulusLen(privKey);
          break;

2857#define INIT_RSA_PSS_SIG_MECH(mmm)case CKM_mmm_RSA_PKCS_PSS: context->multi = 1; crv = sftk_doSubmmm
(context); if (crv != 0x00000000UL) break; if (pMechanism->
ulParameterLen != sizeof(CK_RSA_PKCS_PSS_PARAMS)) { crv = 0x00000071UL
; break; } if (((const CK_RSA_PKCS_PSS_PARAMS *)pMechanism->
pParameter)->hashAlg != CKM_mmm) { crv = 0x00000071UL; break
; } goto finish_rsa_pss;                                                            \
  case CKM_##mmm##_RSA_PKCS_PSS:                                                            \
      context->multi = PR_TRUE1;                                                             \
      crv = sftk_doSub##mmm(context);                                                       \
      if (crv != CKR_OK0x00000000UL)                                                                    \
          break;                                                                            \
      if (pMechanism->ulParameterLen != sizeof(CK_RSA_PKCS_PSS_PARAMS)) {                   \
          crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;                                                \
          break;                                                                            \
      }                                                                                     \
      if (((const CK_RSA_PKCS_PSS_PARAMS *)pMechanism->pParameter)->hashAlg != CKM_##mmm) { \
          crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;                                                \
          break;                                                                            \
      }                                                                                     \
      goto finish_rsa_pss;
          INIT_RSA_PSS_SIG_MECH(SHA1)case 0x0000000EUL: context->multi = 1; crv = sftk_doSubSHA1
(context); if (crv != 0x00000000UL) break; if (pMechanism->
ulParameterLen != sizeof(CK_RSA_PKCS_PSS_PARAMS)) { crv = 0x00000071UL
; break; } if (((const CK_RSA_PKCS_PSS_PARAMS *)pMechanism->
pParameter)->hashAlg != 0x00000220UL) { crv = 0x00000071UL
; break; } goto finish_rsa_pss;
          INIT_RSA_PSS_SIG_MECH(SHA224)case 0x00000047UL: context->multi = 1; crv = sftk_doSubSHA224
(context); if (crv != 0x00000000UL) break; if (pMechanism->
ulParameterLen != sizeof(CK_RSA_PKCS_PSS_PARAMS)) { crv = 0x00000071UL
; break; } if (((const CK_RSA_PKCS_PSS_PARAMS *)pMechanism->
pParameter)->hashAlg != 0x00000255UL) { crv = 0x00000071UL
; break; } goto finish_rsa_pss;
          INIT_RSA_PSS_SIG_MECH(SHA256)case 0x00000043UL: context->multi = 1; crv = sftk_doSubSHA256
(context); if (crv != 0x00000000UL) break; if (pMechanism->
ulParameterLen != sizeof(CK_RSA_PKCS_PSS_PARAMS)) { crv = 0x00000071UL
; break; } if (((const CK_RSA_PKCS_PSS_PARAMS *)pMechanism->
pParameter)->hashAlg != 0x00000250UL) { crv = 0x00000071UL
; break; } goto finish_rsa_pss;
          INIT_RSA_PSS_SIG_MECH(SHA384)case 0x00000044UL: context->multi = 1; crv = sftk_doSubSHA384
(context); if (crv != 0x00000000UL) break; if (pMechanism->
ulParameterLen != sizeof(CK_RSA_PKCS_PSS_PARAMS)) { crv = 0x00000071UL
; break; } if (((const CK_RSA_PKCS_PSS_PARAMS *)pMechanism->
pParameter)->hashAlg != 0x00000260UL) { crv = 0x00000071UL
; break; } goto finish_rsa_pss;
          INIT_RSA_PSS_SIG_MECH(SHA512)case 0x00000045UL: context->multi = 1; crv = sftk_doSubSHA512
(context); if (crv != 0x00000000UL) break; if (pMechanism->
ulParameterLen != sizeof(CK_RSA_PKCS_PSS_PARAMS)) { crv = 0x00000071UL
; break; } if (((const CK_RSA_PKCS_PSS_PARAMS *)pMechanism->
pParameter)->hashAlg != 0x00000270UL) { crv = 0x00000071UL
; break; } goto finish_rsa_pss;
      case CKM_RSA_PKCS_PSS0x0000000DUL:
      finish_rsa_pss:
          if (key_type != CKK_RSA0x00000000UL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          context->rsa = PR_TRUE1;
          if (pMechanism->ulParameterLen != sizeof(CK_RSA_PKCS_PSS_PARAMS) ||
              !sftk_ValidatePssParams((const CK_RSA_PKCS_PSS_PARAMS *)pMechanism->pParameter)) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          pinfo = PORT_New(SFTKPSSSignInfo)(SFTKPSSSignInfo *)PORT_Alloc_Util(sizeof(SFTKPSSSignInfo));
          if (pinfo == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          pinfo->size = sizeof(SFTKPSSSignInfo);
          pinfo->params = *(CK_RSA_PKCS_PSS_PARAMS *)pMechanism->pParameter;
          pinfo->key = sftk_GetPrivKey(key, CKK_RSA0x00000000UL, &crv);
          if (pinfo->key == NULL((void*)0)) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          context->cipherInfo = pinfo;
          context->destroy = (SFTKDestroy)sftk_ZSpace;
          context->update = (SFTKCipher)sftk_RSASignPSS;
          context->maxLen = nsslowkey_PrivateModulusLen(pinfo->key);
          break;

2907#define INIT_DSA_SIG_MECH(mmm)case CKM_DSA_mmm: context->multi = 1; crv = sftk_doSubmmm(
context); if (crv != 0x00000000UL) break; goto finish_dsa;          \
  case CKM_DSA_##mmm:                 \
      context->multi = PR_TRUE1;       \
      crv = sftk_doSub##mmm(context); \
      if (crv != CKR_OK0x00000000UL)              \
          break;                      \
      goto finish_dsa;
          INIT_DSA_SIG_MECH(SHA1)case 0x00000012UL: context->multi = 1; crv = sftk_doSubSHA1
(context); if (crv != 0x00000000UL) break; goto finish_dsa;
          INIT_DSA_SIG_MECH(SHA224)case 0x00000013UL: context->multi = 1; crv = sftk_doSubSHA224
(context); if (crv != 0x00000000UL) break; goto finish_dsa;
          INIT_DSA_SIG_MECH(SHA256)case 0x00000014UL: context->multi = 1; crv = sftk_doSubSHA256
(context); if (crv != 0x00000000UL) break; goto finish_dsa;
          INIT_DSA_SIG_MECH(SHA384)case 0x00000015UL: context->multi = 1; crv = sftk_doSubSHA384
(context); if (crv != 0x00000000UL) break; goto finish_dsa;
          INIT_DSA_SIG_MECH(SHA512)case 0x00000016UL: context->multi = 1; crv = sftk_doSubSHA512
(context); if (crv != 0x00000000UL) break; goto finish_dsa;
      case CKM_DSA0x00000011UL:
      finish_dsa:
          if (key_type != CKK_DSA0x00000001UL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          privKey = sftk_GetPrivKey(key, CKK_DSA0x00000001UL, &crv);
          if (privKey == NULL((void*)0)) {
              break;
          }
          context->cipherInfo = privKey;
          context->update = (SFTKCipher)nsc_DSA_Sign_Stub;
          context->destroy = (privKey == key->objectInfo) ? (SFTKDestroy)sftk_Null : (SFTKDestroy)sftk_FreePrivKey;
          context->maxLen = DSA_MAX_SIGNATURE_LEN(32 * 2);

          break;

2936#define INIT_ECDSA_SIG_MECH(mmm)case CKM_ECDSA_mmm: context->multi = 1; crv = sftk_doSubmmm
(context); if (crv != 0x00000000UL) break; goto finish_ecdsa;        \
  case CKM_ECDSA_##mmm:               \
      context->multi = PR_TRUE1;       \
      crv = sftk_doSub##mmm(context); \
      if (crv != CKR_OK0x00000000UL)              \
          break;                      \
      goto finish_ecdsa;
          INIT_ECDSA_SIG_MECH(SHA1)case 0x00001042UL: context->multi = 1; crv = sftk_doSubSHA1
(context); if (crv != 0x00000000UL) break; goto finish_ecdsa;
          INIT_ECDSA_SIG_MECH(SHA224)case 0x00001043UL: context->multi = 1; crv = sftk_doSubSHA224
(context); if (crv != 0x00000000UL) break; goto finish_ecdsa;
          INIT_ECDSA_SIG_MECH(SHA256)case 0x00001044UL: context->multi = 1; crv = sftk_doSubSHA256
(context); if (crv != 0x00000000UL) break; goto finish_ecdsa;
          INIT_ECDSA_SIG_MECH(SHA384)case 0x00001045UL: context->multi = 1; crv = sftk_doSubSHA384
(context); if (crv != 0x00000000UL) break; goto finish_ecdsa;
          INIT_ECDSA_SIG_MECH(SHA512)case 0x00001046UL: context->multi = 1; crv = sftk_doSubSHA512
(context); if (crv != 0x00000000UL) break; goto finish_ecdsa;
      case CKM_ECDSA0x00001041UL:
      finish_ecdsa:
          if (key_type != CKK_EC0x00000003UL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          privKey = sftk_GetPrivKey(key, CKK_EC0x00000003UL, &crv);
          if (privKey == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          context->cipherInfo = privKey;
          context->update = (SFTKCipher)nsc_ECDSASignStub;
          context->destroy = (privKey == key->objectInfo) ? (SFTKDestroy)sftk_Null : (SFTKDestroy)sftk_FreePrivKey;
          context->maxLen = MAX_ECKEY_LEN72 * 2;

          break;

      case CKM_EDDSA0x00001057UL:
          if (key_type != CKK_EC_EDWARDS0x00000040UL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }

          if (pMechanism->pParameter) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }

          privKey = sftk_GetPrivKey(key, CKK_EC_EDWARDS0x00000040UL, &crv);
          if (privKey == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          context->cipherInfo = privKey;
          context->update = (SFTKCipher)nsc_EDDSASignStub;
          context->destroy = (privKey == key->objectInfo) ? (SFTKDestroy)sftk_Null : (SFTKDestroy)sftk_FreePrivKey;
          context->maxLen = MAX_ECKEY_LEN72 * 2;

          break;

2989#define INIT_HMAC_MECH(mmm)case CKM_mmm_HMAC_GENERAL: ((pMechanism->pParameter)?((void
)0):PR_Assert("pMechanism->pParameter","pkcs11c.c",2989));
 if (!pMechanism->pParameter) { crv = 0x00000071UL; break;
 } crv = sftk_doMACInit(pMechanism->mechanism, context, key
, *(CK_ULONG *)pMechanism->pParameter); break; case CKM_mmm_HMAC
: crv = sftk_doMACInit(pMechanism->mechanism, context, key
, mmm_LENGTH); break;                                        \
  case CKM_##mmm##_HMAC_GENERAL:                                 \
      PORT_Assert(pMechanism->pParameter)((pMechanism->pParameter)?((void)0):PR_Assert("pMechanism->pParameter"
,"pkcs11c.c",2991));                       \
      if (!pMechanism->pParameter) {                             \
          crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;                     \
          break;                                                 \
      }                                                          \
      crv = sftk_doMACInit(pMechanism->mechanism, context, key,  \
                           *(CK_ULONG *)pMechanism->pParameter); \
      break;                                                     \
  case CKM_##mmm##_HMAC:                                         \
      crv = sftk_doMACInit(pMechanism->mechanism, context, key,  \
                           mmm##_LENGTH);                        \
      break;

          INIT_HMAC_MECH(MD2)case 0x00000202UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3004)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x00000201UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 16); break;
          INIT_HMAC_MECH(MD5)case 0x00000212UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3005)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x00000211UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 16); break;
          INIT_HMAC_MECH(SHA1)case 0x00000222UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3006)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x00000221UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 20); break;
          INIT_HMAC_MECH(SHA224)case 0x00000257UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3007)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x00000256UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 28); break;
          INIT_HMAC_MECH(SHA256)case 0x00000252UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3008)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x00000251UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 32); break;
          INIT_HMAC_MECH(SHA384)case 0x00000262UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3009)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x00000261UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 48); break;
          INIT_HMAC_MECH(SHA512)case 0x00000272UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3010)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x00000271UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 64); break;
          INIT_HMAC_MECH(SHA3_224)case 0x000002B7UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3011)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x000002B6UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 28); break;
          INIT_HMAC_MECH(SHA3_256)case 0x000002B2UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3012)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x000002B1UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 32); break;
          INIT_HMAC_MECH(SHA3_384)case 0x000002C2UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3013)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x000002C1UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 48); break;
          INIT_HMAC_MECH(SHA3_512)case 0x000002D2UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3014)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x000002D1UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 64); break;

      case CKM_AES_CMAC_GENERAL0x0000108BUL:
          PORT_Assert(pMechanism->pParameter)((pMechanism->pParameter)?((void)0):PR_Assert("pMechanism->pParameter"
,"pkcs11c.c",3017));
          if (!pMechanism->pParameter || pMechanism->ulParameterLen != sizeof(CK_MAC_GENERAL_PARAMS)) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          crv = sftk_doMACInit(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism->pParameter);
          break;
      case CKM_AES_CMAC0x0000108AUL:
          crv = sftk_doMACInit(pMechanism->mechanism, context, key, AES_BLOCK_SIZE16);
          break;
      case CKM_SSL3_MD5_MAC0x00000380UL:
          PORT_Assert(pMechanism->pParameter)((pMechanism->pParameter)?((void)0):PR_Assert("pMechanism->pParameter"
,"pkcs11c.c",3028));
          if (!pMechanism->pParameter) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          crv = sftk_doSSLMACInit(context, SEC_OID_MD5, key,
                                  *(CK_ULONG *)pMechanism->pParameter);
          break;
      case CKM_SSL3_SHA1_MAC0x00000381UL:
          PORT_Assert(pMechanism->pParameter)((pMechanism->pParameter)?((void)0):PR_Assert("pMechanism->pParameter"
,"pkcs11c.c",3037));
          if (!pMechanism->pParameter) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          crv = sftk_doSSLMACInit(context, SEC_OID_SHA1, key,
                                  *(CK_ULONG *)pMechanism->pParameter);
          break;
      case CKM_TLS_PRF_GENERAL0x80000373UL:
          crv = sftk_TLSPRFInit(context, key, key_type, HASH_AlgNULL, 0);
          break;
      case CKM_TLS_MAC0x000003E4UL: {
          CK_TLS_MAC_PARAMS *tls12_mac_params;
          HASH_HashType tlsPrfHash;
          const char *label;

          if (pMechanism->ulParameterLen != sizeof(CK_TLS_MAC_PARAMS)) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          tls12_mac_params = (CK_TLS_MAC_PARAMS *)pMechanism->pParameter;
          if (tls12_mac_params->prfHashMechanism == CKM_TLS_PRF0x00000378UL) {
              /* The TLS 1.0 and 1.1 PRF */
              tlsPrfHash = HASH_AlgNULL;
              if (tls12_mac_params->ulMacLength != 12) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
          } else {
              /* The hash function for the TLS 1.2 PRF */
              tlsPrfHash =
                  sftk_GetHashTypeFromMechanism(tls12_mac_params->prfHashMechanism);
              if (tlsPrfHash == HASH_AlgNULL ||
                  tls12_mac_params->ulMacLength < 12) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
          }
          if (tls12_mac_params->ulServerOrClient == 1) {
              label = "server finished";
          } else if (tls12_mac_params->ulServerOrClient == 2) {
              label = "client finished";
          } else {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          crv = sftk_TLSPRFInit(context, key, key_type, tlsPrfHash,
                                tls12_mac_params->ulMacLength);
          if (crv == CKR_OK0x00000000UL) {
              context->hashUpdate(context->hashInfo, label, 15);
          }
          break;
      }
      case CKM_NSS_TLS_PRF_GENERAL_SHA256((0x80000000UL | 0x4E534350) + 21):
          crv = sftk_TLSPRFInit(context, key, key_type, HASH_AlgSHA256, 0);
          break;

      case CKM_NSS_HMAC_CONSTANT_TIME((0x80000000UL | 0x4E534350) + 19): {
          sftk_MACConstantTimeCtx *ctx =
              sftk_HMACConstantTime_New(pMechanism, key);
          CK_ULONG *intpointer;

          if (ctx == NULL((void*)0)) {
              crv = CKR_ARGUMENTS_BAD0x00000007UL;
              break;
          }
          intpointer = PORT_New(CK_ULONG)(CK_ULONG *)PORT_Alloc_Util(sizeof(CK_ULONG));
          if (intpointer == NULL((void*)0)) {
              PORT_FreePORT_Free_Util(ctx);
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          *intpointer = ctx->hash->length;

          context->cipherInfo = intpointer;
          context->hashInfo = ctx;
          context->currentMech = pMechanism->mechanism;
          context->hashUpdate = sftk_HMACConstantTime_Update;
          context->hashdestroy = sftk_MACConstantTime_DestroyContext;
          context->end = sftk_MACConstantTime_EndHash;
          context->update = (SFTKCipher)sftk_SignCopy;
          context->destroy = sftk_Space;
          context->maxLen = 64;
          context->multi = PR_TRUE1;
          break;
      }

      case CKM_NSS_SSL3_MAC_CONSTANT_TIME((0x80000000UL | 0x4E534350) + 20): {
          sftk_MACConstantTimeCtx *ctx =
              sftk_SSLv3MACConstantTime_New(pMechanism, key);
          CK_ULONG *intpointer;

          if (ctx == NULL((void*)0)) {
              crv = CKR_ARGUMENTS_BAD0x00000007UL;
              break;
          }
          intpointer = PORT_New(CK_ULONG)(CK_ULONG *)PORT_Alloc_Util(sizeof(CK_ULONG));
          if (intpointer == NULL((void*)0)) {
              PORT_FreePORT_Free_Util(ctx);
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          *intpointer = ctx->hash->length;

          context->cipherInfo = intpointer;
          context->hashInfo = ctx;
          context->currentMech = pMechanism->mechanism;
          context->hashUpdate = sftk_SSLv3MACConstantTime_Update;
          context->hashdestroy = sftk_MACConstantTime_DestroyContext;
          context->end = sftk_MACConstantTime_EndHash;
          context->update = (SFTKCipher)sftk_SignCopy;
          context->destroy = sftk_Space;
          context->maxLen = 64;
          context->multi = PR_TRUE1;
          break;
      }

      default:
          crv = CKR_MECHANISM_INVALID0x00000070UL;
          break;
  }

  if (crv != CKR_OK0x00000000UL) {
      if (info)
          PORT_FreePORT_Free_Util(info);
      if (pinfo)
          PORT_ZFreePORT_ZFree_Util(pinfo, pinfo->size);
      sftk_FreeContext(context);
      sftk_FreeSession(session);
      return crv;
  }
  sftk_SetContextByType(session, SFTK_SIGN, context);
  sftk_FreeSession(session);
  return CKR_OK0x00000000UL;
3171}

3173/** MAC one block of data by block cipher
*/
3175static CK_RV
3176sftk_MACBlock(SFTKSessionContext *ctx, void *blk)
3177{
  unsigned int outlen;
  return (SECSuccess == (ctx->update)(ctx->cipherInfo, ctx->macBuf, &outlen,
                                      SFTK_MAX_BLOCK_SIZE16, blk, ctx->blockSize))
             ? CKR_OK0x00000000UL
             : sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
3183}

3185/** MAC last (incomplete) block of data by block cipher
*
*  Call once, then terminate MACing operation.
*/
3189static CK_RV
3190sftk_MACFinal(SFTKSessionContext *ctx)
3191{
  unsigned int padLen = ctx->padDataLength;
  /* pad and proceed the residual */
  if (ctx->isXCBC) {
      CK_RV crv = sftk_xcbc_mac_pad(ctx->padBuf, padLen, ctx->blockSize,
                                    ctx->k2, ctx->k3);
      if (crv != CKR_OK0x00000000UL)
          return crv;
      return sftk_MACBlock(ctx, ctx->padBuf);
  }
  if (padLen) {
      /* shd clr ctx->padLen to make sftk_MACFinal idempotent */
      PORT_Memsetmemset(ctx->padBuf + padLen, 0, ctx->blockSize - padLen);
      return sftk_MACBlock(ctx, ctx->padBuf);
  } else
      return CKR_OK0x00000000UL;
3207}

3209/** The common implementation for {Sign,Verify}Update. (S/V only vary in their
* setup and final operations).
*
* A call which results in an error terminates the operation [PKCS#11,v2.11]
*/
3214static CK_RV
3215sftk_MACUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
             CK_ULONG ulPartLen, SFTKContextType type)
3217{
  SFTKSession *session;
  SFTKSessionContext *context;
  CK_RV crv;

  /* make sure we're legal */
  crv = sftk_GetContext(hSession, &context, type, PR_TRUE1, &session);
  if (crv3.1
'crv' is equal to CKR_OK
 != CKR_OK0x00000000UL)
4
←
Taking false branch→
      return crv;

  if (context->hashInfo) {
5
←
Assuming field 'hashInfo' is null→
6
←
Taking false branch→
3228#if (ULONG_MAX(9223372036854775807L *2UL+1UL) > UINT_MAX(2147483647 *2U +1U))
      while (ulPartLen > UINT_MAX(2147483647 *2U +1U)) {
          (*context->hashUpdate)(context->cipherInfo, pPart, UINT_MAX(2147483647 *2U +1U));
          pPart += UINT_MAX(2147483647 *2U +1U);
          ulPartLen -= UINT_MAX(2147483647 *2U +1U);
      }
3234#endif
      (*context->hashUpdate)(context->hashInfo, pPart, ulPartLen);
  } else {
      /* must be block cipher MACing */

      unsigned int blkSize = context->blockSize;
7
←
'blkSize' initialized here→
      unsigned char *residual = /* free room in context->padBuf */
          context->padBuf + context->padDataLength;
      unsigned int minInput = /* min input for MACing at least one block */
          blkSize - context->padDataLength;

      /* not enough data even for one block */
      if (ulPartLen <= minInput) {
8
←
Assuming 'ulPartLen' is > 'minInput'→
9
←
Taking false branch→
          PORT_Memcpymemcpy(residual, pPart, ulPartLen);
          context->padDataLength += ulPartLen;
          goto cleanup;
      }
      /* MACing residual */
      if (context->padDataLength) {
10
←
Assuming field 'padDataLength' is 0→
11
←
Taking false branch→
          PORT_Memcpymemcpy(residual, pPart, minInput);
          ulPartLen -= minInput;
          pPart += minInput;
          if (CKR_OK0x00000000UL != (crv = sftk_MACBlock(context, context->padBuf)))
              goto terminate;
      }
      /* MACing full blocks */
      while (ulPartLen > blkSize) {
12
←
Assuming 'ulPartLen' is > 'blkSize'→
13
←
Loop condition is true.  Entering loop body→
16
←
Assuming 'ulPartLen' is <= 'blkSize'→
17
←
Loop condition is false. Execution continues on line 3267→
          if (CKR_OK0x00000000UL != (crv = sftk_MACBlock(context, pPart)))
14
←
Taking false branch→
              goto terminate;
          ulPartLen -= blkSize;
          pPart += blkSize;
15
←
Null pointer value stored to 'pPart'→
      }
      /* save the residual */
      if ((context->padDataLength = ulPartLen))
18
←
Assuming field 'padDataLength' is not equal to 0→
19
←
Taking true branch→
          PORT_Memcpymemcpy(context->padBuf, pPart, ulPartLen);
20
←
Null pointer passed to 2nd parameter expecting 'nonnull'
  } /* blk cipher MACing */

  goto cleanup;

3273terminate:
  sftk_TerminateOp(session, type, context);
3275cleanup:
  sftk_FreeSession(session);
  return crv;
3278}

3280/* NSC_SignUpdate continues a multiple-part signature operation,
* where the signature is (will be) an appendix to the data,
* and plaintext cannot be recovered from the signature
*
* A call which results in an error terminates the operation [PKCS#11,v2.11]
*/
3286CK_RV
3287NSC_SignUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
             CK_ULONG ulPartLen)
3289{
  CHECK_FORK();
  return sftk_MACUpdate(hSession, pPart, ulPartLen, SFTK_SIGN);
3292}

3294struct SFTK_SESSION_FLAGS {
  CK_FLAGS flag;
  SFTKContextType type;
3297};

3299const static struct SFTK_SESSION_FLAGS sftk_session_flags[] = {
  { CKF_ENCRYPT0x00000100UL, SFTK_ENCRYPT },
  { CKF_DECRYPT0x00000200UL, SFTK_DECRYPT },
  { CKF_DIGEST0x00000400UL, SFTK_HASH },
  { CKF_SIGN0x00000800UL, SFTK_SIGN },
  { CKF_SIGN_RECOVER0x00001000UL, SFTK_SIGN_RECOVER },
  { CKF_VERIFY0x00002000, SFTK_VERIFY },
  { CKF_VERIFY_RECOVER0x00004000UL, SFTK_VERIFY_RECOVER },
  { CKF_MESSAGE_ENCRYPT0x00000002UL, SFTK_MESSAGE_ENCRYPT },
  { CKF_MESSAGE_DECRYPT0x00000004UL, SFTK_MESSAGE_DECRYPT },
  { CKF_MESSAGE_SIGN0x00000008UL, SFTK_MESSAGE_SIGN },
  { CKF_MESSAGE_VERIFY0x00000010UL, SFTK_MESSAGE_VERIFY },
3311};
3312const static int sftk_flag_count = PR_ARRAY_SIZE(sftk_session_flags)(sizeof(sftk_session_flags)/sizeof((sftk_session_flags)[0]));

3314/*
* Cancel one or more operations running on the existing session.
*/
3317CK_RV
3318NSC_SessionCancel(CK_SESSION_HANDLE hSession, CK_FLAGS flags)
3319{
  SFTKSession *session;
  SFTKSessionContext *context;
  CK_RV gcrv = CKR_OK0x00000000UL;
  CK_RV crv;
  int i;

  for (i = 0; i < sftk_flag_count; i++) {
      if (flags & sftk_session_flags[i].flag) {
          flags &= ~sftk_session_flags[i].flag;
          crv = sftk_GetContext(hSession, &context, sftk_session_flags[i].type, PR_TRUE1, &session);
          if (crv != CKR_OK0x00000000UL) {
              gcrv = CKR_OPERATION_CANCEL_FAILED0x00000202UL;
              continue;
          }
          sftk_TerminateOp(session, sftk_session_flags[i].type, context);
      }
  }
  if (flags & CKF_FIND_OBJECTS0x00000040UL) {
      flags &= ~CKF_FIND_OBJECTS0x00000040UL;
      crv = NSC_FindObjectsFinal(hSession);
      if (crv != CKR_OK0x00000000UL) {
          gcrv = CKR_OPERATION_CANCEL_FAILED0x00000202UL;
      }
  }
  if (flags) {
      gcrv = CKR_OPERATION_CANCEL_FAILED0x00000202UL;
  }
  return gcrv;
3348}

3350/* NSC_SignFinal finishes a multiple-part signature operation,
* returning the signature. */
3352CK_RV
3353NSC_SignFinal(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSignature,
            CK_ULONG_PTR pulSignatureLen)
3355{
  SFTKSession *session;
  SFTKSessionContext *context;
  unsigned int outlen;
  unsigned int maxoutlen = *pulSignatureLen;
  CK_RV crv;

  CHECK_FORK();

  /* make sure we're legal */
  crv = sftk_GetContext(hSession, &context, SFTK_SIGN, PR_TRUE1, &session);
  if (crv != CKR_OK0x00000000UL)
      return crv;

  if (context->hashInfo) {
      unsigned int digestLen;
      unsigned char tmpbuf[SFTK_MAX_MAC_LENGTH64];

      if (!pSignature) {
          outlen = context->maxLen;
          goto finish;
      }
      (*context->end)(context->hashInfo, tmpbuf, &digestLen, sizeof(tmpbuf));
      if (SECSuccess != (context->update)(context->cipherInfo, pSignature,
                                          &outlen, maxoutlen, tmpbuf, digestLen))
          crv = sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
      /* CKR_BUFFER_TOO_SMALL here isn't continuable, let operation terminate.
       * Keeping "too small" CK_RV intact is a standard violation, but allows
       * application read EXACT signature length */
      PORT_Memsetmemset(tmpbuf, 0, sizeof tmpbuf);
  } else {
      /* must be block cipher MACing */
      outlen = context->macSize;
      /* null or "too small" buf doesn't terminate operation [PKCS#11,v2.11]*/
      if (!pSignature || maxoutlen < outlen) {
          if (pSignature)
              crv = CKR_BUFFER_TOO_SMALL0x00000150UL;
          goto finish;
      }
      if (CKR_OK0x00000000UL == (crv = sftk_MACFinal(context)))
          PORT_Memcpymemcpy(pSignature, context->macBuf, outlen);
  }

  sftk_TerminateOp(session, SFTK_SIGN, context);
3399finish:
  *pulSignatureLen = outlen;
  sftk_FreeSession(session);
  return crv;
3403}

3405/* NSC_Sign signs (encrypts with private key) data in a single part,
* where the signature is (will be) an appendix to the data,
* and plaintext cannot be recovered from the signature */
3408CK_RV
3409NSC_Sign(CK_SESSION_HANDLE hSession,
       CK_BYTE_PTR pData, CK_ULONG ulDataLen, CK_BYTE_PTR pSignature,
       CK_ULONG_PTR pulSignatureLen)
3412{
  SFTKSession *session;
  SFTKSessionContext *context;
  CK_RV crv;

  CHECK_FORK();

  /* make sure we're legal */
  crv = sftk_GetContext(hSession, &context, SFTK_SIGN, PR_FALSE0, &session);
  if (crv != CKR_OK0x00000000UL)
      return crv;

  if (!pSignature) {
      /* see also how C_SignUpdate implements this */
      *pulSignatureLen = (!context->multi || context->hashInfo)
                             ? context->maxLen
                             : context->macSize; /* must be block cipher MACing */
      goto finish;
  }

  /* multi part Signing are completely implemented by SignUpdate and
   * sign Final */
  if (context->multi) {
      /* SignFinal can't follow failed SignUpdate */
      if (CKR_OK0x00000000UL == (crv = NSC_SignUpdate(hSession, pData, ulDataLen)))
          crv = NSC_SignFinal(hSession, pSignature, pulSignatureLen);
  } else {
      /* single-part PKC signature (e.g. CKM_ECDSA) */
      unsigned int outlen;
      unsigned int maxoutlen = *pulSignatureLen;
      if (SECSuccess != (*context->update)(context->cipherInfo, pSignature,
                                           &outlen, maxoutlen, pData, ulDataLen))
          crv = sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
      *pulSignatureLen = (CK_ULONG)outlen;
      /*  "too small" here is certainly continuable */
      if (crv != CKR_BUFFER_TOO_SMALL0x00000150UL)
          sftk_TerminateOp(session, SFTK_SIGN, context);
  } /* single-part */

3451finish:
  sftk_FreeSession(session);
  return crv;
3454}

3456/*
************** Crypto Functions:     Sign Recover  ************************
*/
3459/* NSC_SignRecoverInit initializes a signature operation,
* where the (digest) data can be recovered from the signature.
* E.g. encryption with the user's private key */
3462CK_RV
3463NSC_SignRecoverInit(CK_SESSION_HANDLE hSession,
                  CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey)
3465{
  CHECK_FORK();

  switch (pMechanism->mechanism) {
      case CKM_RSA_PKCS0x00000001UL:
      case CKM_RSA_X_5090x00000003UL:
          return NSC_SignInit(hSession, pMechanism, hKey);
      default:
          break;
  }
  return CKR_MECHANISM_INVALID0x00000070UL;
3476}

3478/* NSC_SignRecover signs data in a single operation
* where the (digest) data can be recovered from the signature.
* E.g. encryption with the user's private key */
3481CK_RV
3482NSC_SignRecover(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData,
              CK_ULONG ulDataLen, CK_BYTE_PTR pSignature, CK_ULONG_PTR pulSignatureLen)
3484{
  CHECK_FORK();

  return NSC_Sign(hSession, pData, ulDataLen, pSignature, pulSignatureLen);
3488}

3490/*
************** Crypto Functions:     verify  ************************
*/

3494/* Handle RSA Signature formatting */
3495static SECStatus
3496sftk_hashCheckSign(SFTKHashVerifyInfo *info, const unsigned char *sig,
                 unsigned int sigLen, const unsigned char *digest,
                 unsigned int digestLen)
3499{
  PORT_Assert(info->key->keyType == NSSLOWKEYRSAKey)((info->key->keyType == NSSLOWKEYRSAKey)?((void)0):PR_Assert
("info->key->keyType == NSSLOWKEYRSAKey","pkcs11c.c",3500
));
  if (info->key->keyType != NSSLOWKEYRSAKey) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_KEY);
      return SECFailure;
  }

  return RSA_HashCheckSign(info->hashOid, info->key, sig, sigLen, digest,
                           digestLen);
3508}

3510SECStatus
3511RSA_HashCheckSign(SECOidTag digestOid, NSSLOWKEYPublicKey *key,
                const unsigned char *sig, unsigned int sigLen,
                const unsigned char *digestData, unsigned int digestLen)
3514{
  unsigned char *pkcs1DigestInfoData;
  SECItem pkcs1DigestInfo;
  SECItem digest;
  unsigned int bufferSize;
  SECStatus rv;

  /* pkcs1DigestInfo.data must be less than key->u.rsa.modulus.len */
  bufferSize = key->u.rsa.modulus.len;
  pkcs1DigestInfoData = PORT_ZAllocPORT_ZAlloc_Util(bufferSize);
  if (!pkcs1DigestInfoData) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_NO_MEMORY);
      return SECFailure;
  }

  pkcs1DigestInfo.data = pkcs1DigestInfoData;
  pkcs1DigestInfo.len = bufferSize;

  /* decrypt the block */
  rv = RSA_CheckSignRecover(&key->u.rsa, pkcs1DigestInfo.data,
                            &pkcs1DigestInfo.len, pkcs1DigestInfo.len,
                            sig, sigLen);
  if (rv != SECSuccess) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_BAD_SIGNATURE);
  } else {
      digest.data = (PRUint8 *)digestData;
      digest.len = digestLen;
      rv = _SGN_VerifyPKCS1DigestInfo(
          digestOid, &digest, &pkcs1DigestInfo,
          PR_FALSE0 /*XXX: unsafeAllowMissingParameters*/);
  }

  PORT_ZFreePORT_ZFree_Util(pkcs1DigestInfoData, bufferSize);
  return rv;
3548}

3550static SECStatus
3551sftk_RSACheckSign(NSSLOWKEYPublicKey *key, const unsigned char *sig,
                unsigned int sigLen, const unsigned char *digest,
                unsigned int digestLen)
3554{
  PORT_Assert(key->keyType == NSSLOWKEYRSAKey)((key->keyType == NSSLOWKEYRSAKey)?((void)0):PR_Assert("key->keyType == NSSLOWKEYRSAKey"
,"pkcs11c.c",3555));
  if (key->keyType != NSSLOWKEYRSAKey) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_KEY);
      return SECFailure;
  }

  return RSA_CheckSign(&key->u.rsa, sig, sigLen, digest, digestLen);
3562}

3564static SECStatus
3565sftk_RSACheckSignRaw(NSSLOWKEYPublicKey *key, const unsigned char *sig,
                   unsigned int sigLen, const unsigned char *digest,
                   unsigned int digestLen)
3568{
  PORT_Assert(key->keyType == NSSLOWKEYRSAKey)((key->keyType == NSSLOWKEYRSAKey)?((void)0):PR_Assert("key->keyType == NSSLOWKEYRSAKey"
,"pkcs11c.c",3569));
  if (key->keyType != NSSLOWKEYRSAKey) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_KEY);
      return SECFailure;
  }

  return RSA_CheckSignRaw(&key->u.rsa, sig, sigLen, digest, digestLen);
3576}

3578static SECStatus
3579sftk_RSACheckSignPSS(SFTKPSSVerifyInfo *info, const unsigned char *sig,
                   unsigned int sigLen, const unsigned char *digest,
                   unsigned int digestLen)
3582{
  HASH_HashType hashAlg;
  HASH_HashType maskHashAlg;
  CK_RSA_PKCS_PSS_PARAMS *params = &info->params;

  PORT_Assert(info->key->keyType == NSSLOWKEYRSAKey)((info->key->keyType == NSSLOWKEYRSAKey)?((void)0):PR_Assert
("info->key->keyType == NSSLOWKEYRSAKey","pkcs11c.c",3587
));
  if (info->key->keyType != NSSLOWKEYRSAKey) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_KEY);
      return SECFailure;
  }

  hashAlg = sftk_GetHashTypeFromMechanism(params->hashAlg);
  maskHashAlg = sftk_GetHashTypeFromMechanism(params->mgf);

  return RSA_CheckSignPSS(&info->key->u.rsa, hashAlg, maskHashAlg,
                          params->sLen, sig, sigLen, digest, digestLen);
3598}

3600/* NSC_VerifyInit initializes a verification operation,
* where the signature is an appendix to the data,
* and plaintext cannot be recovered from the signature (e.g. DSA) */
3603CK_RV
3604NSC_VerifyInit(CK_SESSION_HANDLE hSession,
             CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey)
3606{
  SFTKSession *session;
  SFTKObject *key;
  SFTKSessionContext *context;
  CK_KEY_TYPE key_type;
  CK_RV crv = CKR_OK0x00000000UL;
  NSSLOWKEYPublicKey *pubKey;
  SFTKHashVerifyInfo *info = NULL((void*)0);
  SFTKPSSVerifyInfo *pinfo = NULL((void*)0);

  CHECK_FORK();

  /* Block Cipher MACing Algorithms use a different Context init method..*/
  crv = sftk_InitCBCMac(hSession, pMechanism, hKey, CKA_VERIFY0x0000010AUL, SFTK_VERIFY);
  if (crv != CKR_FUNCTION_NOT_SUPPORTED0x00000054UL)
      return crv;

  session = sftk_SessionFromHandle(hSession);
  if (session == NULL((void*)0))
      return CKR_SESSION_HANDLE_INVALID0x000000B3UL;
  crv = sftk_InitGeneric(session, pMechanism, &context, SFTK_VERIFY, &key,
                         hKey, &key_type, CKO_PUBLIC_KEY0x00000002UL, CKA_VERIFY0x0000010AUL);
  if (crv != CKR_OK0x00000000UL) {
      sftk_FreeSession(session);
      return crv;
  }

  context->multi = PR_FALSE0;

3635#define INIT_RSA_VFY_MECH(mmm)case CKM_mmm_RSA_PKCS: context->multi = 1; crv = sftk_doSubmmm
(context); if (crv != 0x00000000UL) break; context->verify
 = (SFTKVerify)sftk_hashCheckSign; info = (SFTKHashVerifyInfo
 *)PORT_Alloc_Util(sizeof(SFTKHashVerifyInfo)); if (info == (
(void*)0)) { crv = 0x00000002UL; break; } info->hashOid = SEC_OID_mmm
; goto finish_rsa;                            \
  case CKM_##mmm##_RSA_PKCS:                            \
      context->multi = PR_TRUE1;                         \
      crv = sftk_doSub##mmm(context);                   \
      if (crv != CKR_OK0x00000000UL)                                \
          break;                                        \
      context->verify = (SFTKVerify)sftk_hashCheckSign; \
      info = PORT_New(SFTKHashVerifyInfo)(SFTKHashVerifyInfo *)PORT_Alloc_Util(sizeof(SFTKHashVerifyInfo
));              \
      if (info == NULL((void*)0)) {                               \
          crv = CKR_HOST_MEMORY0x00000002UL;                        \
          break;                                        \
      }                                                 \
      info->hashOid = SEC_OID_##mmm;                    \
      goto finish_rsa;

  switch (pMechanism->mechanism) {
      INIT_RSA_VFY_MECH(MD5)case 0x00000005UL: context->multi = 1; crv = sftk_doSubMD5
(context); if (crv != 0x00000000UL) break; context->verify
 = (SFTKVerify)sftk_hashCheckSign; info = (SFTKHashVerifyInfo
 *)PORT_Alloc_Util(sizeof(SFTKHashVerifyInfo)); if (info == (
(void*)0)) { crv = 0x00000002UL; break; } info->hashOid = SEC_OID_MD5
; goto finish_rsa;
      INIT_RSA_VFY_MECH(MD2)case 0x00000004UL: context->multi = 1; crv = sftk_doSubMD2
(context); if (crv != 0x00000000UL) break; context->verify
 = (SFTKVerify)sftk_hashCheckSign; info = (SFTKHashVerifyInfo
 *)PORT_Alloc_Util(sizeof(SFTKHashVerifyInfo)); if (info == (
(void*)0)) { crv = 0x00000002UL; break; } info->hashOid = SEC_OID_MD2
; goto finish_rsa;
      INIT_RSA_VFY_MECH(SHA1)case 0x00000006UL: context->multi = 1; crv = sftk_doSubSHA1
(context); if (crv != 0x00000000UL) break; context->verify
 = (SFTKVerify)sftk_hashCheckSign; info = (SFTKHashVerifyInfo
 *)PORT_Alloc_Util(sizeof(SFTKHashVerifyInfo)); if (info == (
(void*)0)) { crv = 0x00000002UL; break; } info->hashOid = SEC_OID_SHA1
; goto finish_rsa;
      INIT_RSA_VFY_MECH(SHA224)case 0x00000046UL: context->multi = 1; crv = sftk_doSubSHA224
(context); if (crv != 0x00000000UL) break; context->verify
 = (SFTKVerify)sftk_hashCheckSign; info = (SFTKHashVerifyInfo
 *)PORT_Alloc_Util(sizeof(SFTKHashVerifyInfo)); if (info == (
(void*)0)) { crv = 0x00000002UL; break; } info->hashOid = SEC_OID_SHA224
; goto finish_rsa;
      INIT_RSA_VFY_MECH(SHA256)case 0x00000040UL: context->multi = 1; crv = sftk_doSubSHA256
(context); if (crv != 0x00000000UL) break; context->verify
 = (SFTKVerify)sftk_hashCheckSign; info = (SFTKHashVerifyInfo
 *)PORT_Alloc_Util(sizeof(SFTKHashVerifyInfo)); if (info == (
(void*)0)) { crv = 0x00000002UL; break; } info->hashOid = SEC_OID_SHA256
; goto finish_rsa;
      INIT_RSA_VFY_MECH(SHA384)case 0x00000041UL: context->multi = 1; crv = sftk_doSubSHA384
(context); if (crv != 0x00000000UL) break; context->verify
 = (SFTKVerify)sftk_hashCheckSign; info = (SFTKHashVerifyInfo
 *)PORT_Alloc_Util(sizeof(SFTKHashVerifyInfo)); if (info == (
(void*)0)) { crv = 0x00000002UL; break; } info->hashOid = SEC_OID_SHA384
; goto finish_rsa;
      INIT_RSA_VFY_MECH(SHA512)case 0x00000042UL: context->multi = 1; crv = sftk_doSubSHA512
(context); if (crv != 0x00000000UL) break; context->verify
 = (SFTKVerify)sftk_hashCheckSign; info = (SFTKHashVerifyInfo
 *)PORT_Alloc_Util(sizeof(SFTKHashVerifyInfo)); if (info == (
(void*)0)) { crv = 0x00000002UL; break; } info->hashOid = SEC_OID_SHA512
; goto finish_rsa;

      case CKM_RSA_PKCS0x00000001UL:
          context->verify = (SFTKVerify)sftk_RSACheckSign;
          goto finish_rsa;
      case CKM_RSA_X_5090x00000003UL:
          context->verify = (SFTKVerify)sftk_RSACheckSignRaw;
      finish_rsa:
          if (key_type != CKK_RSA0x00000000UL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          context->rsa = PR_TRUE1;
          pubKey = sftk_GetPubKey(key, CKK_RSA0x00000000UL, &crv);
          if (pubKey == NULL((void*)0)) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          if (info) {
              info->key = pubKey;
              context->cipherInfo = info;
              context->destroy = sftk_Space;
          } else {
              context->cipherInfo = pubKey;
              context->destroy = sftk_Null;
          }
          break;

          INIT_RSA_PSS_SIG_MECH(SHA1)case 0x0000000EUL: context->multi = 1; crv = sftk_doSubSHA1
(context); if (crv != 0x00000000UL) break; if (pMechanism->
ulParameterLen != sizeof(CK_RSA_PKCS_PSS_PARAMS)) { crv = 0x00000071UL
; break; } if (((const CK_RSA_PKCS_PSS_PARAMS *)pMechanism->
pParameter)->hashAlg != 0x00000220UL) { crv = 0x00000071UL
; break; } goto finish_rsa_pss;
          INIT_RSA_PSS_SIG_MECH(SHA224)case 0x00000047UL: context->multi = 1; crv = sftk_doSubSHA224
(context); if (crv != 0x00000000UL) break; if (pMechanism->
ulParameterLen != sizeof(CK_RSA_PKCS_PSS_PARAMS)) { crv = 0x00000071UL
; break; } if (((const CK_RSA_PKCS_PSS_PARAMS *)pMechanism->
pParameter)->hashAlg != 0x00000255UL) { crv = 0x00000071UL
; break; } goto finish_rsa_pss;
          INIT_RSA_PSS_SIG_MECH(SHA256)case 0x00000043UL: context->multi = 1; crv = sftk_doSubSHA256
(context); if (crv != 0x00000000UL) break; if (pMechanism->
ulParameterLen != sizeof(CK_RSA_PKCS_PSS_PARAMS)) { crv = 0x00000071UL
; break; } if (((const CK_RSA_PKCS_PSS_PARAMS *)pMechanism->
pParameter)->hashAlg != 0x00000250UL) { crv = 0x00000071UL
; break; } goto finish_rsa_pss;
          INIT_RSA_PSS_SIG_MECH(SHA384)case 0x00000044UL: context->multi = 1; crv = sftk_doSubSHA384
(context); if (crv != 0x00000000UL) break; if (pMechanism->
ulParameterLen != sizeof(CK_RSA_PKCS_PSS_PARAMS)) { crv = 0x00000071UL
; break; } if (((const CK_RSA_PKCS_PSS_PARAMS *)pMechanism->
pParameter)->hashAlg != 0x00000260UL) { crv = 0x00000071UL
; break; } goto finish_rsa_pss;
          INIT_RSA_PSS_SIG_MECH(SHA512)case 0x00000045UL: context->multi = 1; crv = sftk_doSubSHA512
(context); if (crv != 0x00000000UL) break; if (pMechanism->
ulParameterLen != sizeof(CK_RSA_PKCS_PSS_PARAMS)) { crv = 0x00000071UL
; break; } if (((const CK_RSA_PKCS_PSS_PARAMS *)pMechanism->
pParameter)->hashAlg != 0x00000270UL) { crv = 0x00000071UL
; break; } goto finish_rsa_pss;
      case CKM_RSA_PKCS_PSS0x0000000DUL:
      finish_rsa_pss:
          if (key_type != CKK_RSA0x00000000UL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          context->rsa = PR_TRUE1;
          if (pMechanism->ulParameterLen != sizeof(CK_RSA_PKCS_PSS_PARAMS) ||
              !sftk_ValidatePssParams((const CK_RSA_PKCS_PSS_PARAMS *)pMechanism->pParameter)) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          pinfo = PORT_New(SFTKPSSVerifyInfo)(SFTKPSSVerifyInfo *)PORT_Alloc_Util(sizeof(SFTKPSSVerifyInfo
));
          if (pinfo == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          pinfo->size = sizeof(SFTKPSSVerifyInfo);
          pinfo->params = *(CK_RSA_PKCS_PSS_PARAMS *)pMechanism->pParameter;
          pinfo->key = sftk_GetPubKey(key, CKK_RSA0x00000000UL, &crv);
          if (pinfo->key == NULL((void*)0)) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          context->cipherInfo = pinfo;
          context->destroy = (SFTKDestroy)sftk_ZSpace;
          context->verify = (SFTKVerify)sftk_RSACheckSignPSS;
          break;

          INIT_DSA_SIG_MECH(SHA1)case 0x00000012UL: context->multi = 1; crv = sftk_doSubSHA1
(context); if (crv != 0x00000000UL) break; goto finish_dsa;
          INIT_DSA_SIG_MECH(SHA224)case 0x00000013UL: context->multi = 1; crv = sftk_doSubSHA224
(context); if (crv != 0x00000000UL) break; goto finish_dsa;
          INIT_DSA_SIG_MECH(SHA256)case 0x00000014UL: context->multi = 1; crv = sftk_doSubSHA256
(context); if (crv != 0x00000000UL) break; goto finish_dsa;
          INIT_DSA_SIG_MECH(SHA384)case 0x00000015UL: context->multi = 1; crv = sftk_doSubSHA384
(context); if (crv != 0x00000000UL) break; goto finish_dsa;
          INIT_DSA_SIG_MECH(SHA512)case 0x00000016UL: context->multi = 1; crv = sftk_doSubSHA512
(context); if (crv != 0x00000000UL) break; goto finish_dsa;
      case CKM_DSA0x00000011UL:
      finish_dsa:
          if (key_type != CKK_DSA0x00000001UL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          pubKey = sftk_GetPubKey(key, CKK_DSA0x00000001UL, &crv);
          if (pubKey == NULL((void*)0)) {
              break;
          }
          context->cipherInfo = pubKey;
          context->verify = (SFTKVerify)nsc_DSA_Verify_Stub;
          context->destroy = sftk_Null;
          break;

          INIT_ECDSA_SIG_MECH(SHA1)case 0x00001042UL: context->multi = 1; crv = sftk_doSubSHA1
(context); if (crv != 0x00000000UL) break; goto finish_ecdsa;
          INIT_ECDSA_SIG_MECH(SHA224)case 0x00001043UL: context->multi = 1; crv = sftk_doSubSHA224
(context); if (crv != 0x00000000UL) break; goto finish_ecdsa;
          INIT_ECDSA_SIG_MECH(SHA256)case 0x00001044UL: context->multi = 1; crv = sftk_doSubSHA256
(context); if (crv != 0x00000000UL) break; goto finish_ecdsa;
          INIT_ECDSA_SIG_MECH(SHA384)case 0x00001045UL: context->multi = 1; crv = sftk_doSubSHA384
(context); if (crv != 0x00000000UL) break; goto finish_ecdsa;
          INIT_ECDSA_SIG_MECH(SHA512)case 0x00001046UL: context->multi = 1; crv = sftk_doSubSHA512
(context); if (crv != 0x00000000UL) break; goto finish_ecdsa;
      case CKM_ECDSA0x00001041UL:
      finish_ecdsa:
          if (key_type != CKK_EC0x00000003UL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          pubKey = sftk_GetPubKey(key, CKK_EC0x00000003UL, &crv);
          if (pubKey == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          context->cipherInfo = pubKey;
          context->verify = (SFTKVerify)nsc_ECDSAVerifyStub;
          context->destroy = sftk_Null;
          break;

          INIT_HMAC_MECH(MD2)case 0x00000202UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3760)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x00000201UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 16); break;
          INIT_HMAC_MECH(MD5)case 0x00000212UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3761)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x00000211UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 16); break;
          INIT_HMAC_MECH(SHA1)case 0x00000222UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3762)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x00000221UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 20); break;
          INIT_HMAC_MECH(SHA224)case 0x00000257UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3763)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x00000256UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 28); break;
          INIT_HMAC_MECH(SHA256)case 0x00000252UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3764)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x00000251UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 32); break;
          INIT_HMAC_MECH(SHA384)case 0x00000262UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3765)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x00000261UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 48); break;
          INIT_HMAC_MECH(SHA512)case 0x00000272UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3766)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x00000271UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 64); break;
          INIT_HMAC_MECH(SHA3_224)case 0x000002B7UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3767)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x000002B6UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 28); break;
          INIT_HMAC_MECH(SHA3_256)case 0x000002B2UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3768)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x000002B1UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 32); break;
          INIT_HMAC_MECH(SHA3_384)case 0x000002C2UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3769)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x000002C1UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 48); break;
          INIT_HMAC_MECH(SHA3_512)case 0x000002D2UL: ((pMechanism->pParameter)?((void)0):PR_Assert
("pMechanism->pParameter","pkcs11c.c",3770)); if (!pMechanism
->pParameter) { crv = 0x00000071UL; break; } crv = sftk_doMACInit
(pMechanism->mechanism, context, key, *(CK_ULONG *)pMechanism
->pParameter); break; case 0x000002D1UL: crv = sftk_doMACInit
(pMechanism->mechanism, context, key, 64); break;

      case CKM_EDDSA0x00001057UL:
          if (key_type != CKK_EC_EDWARDS0x00000040UL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          pubKey = sftk_GetPubKey(key, CKK_EC_EDWARDS0x00000040UL, &crv);
          if (pubKey == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }

          if (pMechanism->pParameter) {
              crv = CKR_FUNCTION_NOT_SUPPORTED0x00000054UL;
              break;
          }

          context->cipherInfo = pubKey;
          context->verify = (SFTKVerify)nsc_EDDSAVerifyStub;
          context->destroy = sftk_Null;
          break;

      case CKM_SSL3_MD5_MAC0x00000380UL:
          PORT_Assert(pMechanism->pParameter)((pMechanism->pParameter)?((void)0):PR_Assert("pMechanism->pParameter"
,"pkcs11c.c",3794));
          if (!pMechanism->pParameter) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          crv = sftk_doSSLMACInit(context, SEC_OID_MD5, key,
                                  *(CK_ULONG *)pMechanism->pParameter);
          break;
      case CKM_SSL3_SHA1_MAC0x00000381UL:
          PORT_Assert(pMechanism->pParameter)((pMechanism->pParameter)?((void)0):PR_Assert("pMechanism->pParameter"
,"pkcs11c.c",3803));
          if (!pMechanism->pParameter) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          crv = sftk_doSSLMACInit(context, SEC_OID_SHA1, key,
                                  *(CK_ULONG *)pMechanism->pParameter);
          break;
      case CKM_TLS_PRF_GENERAL0x80000373UL:
          crv = sftk_TLSPRFInit(context, key, key_type, HASH_AlgNULL, 0);
          break;
      case CKM_NSS_TLS_PRF_GENERAL_SHA256((0x80000000UL | 0x4E534350) + 21):
          crv = sftk_TLSPRFInit(context, key, key_type, HASH_AlgSHA256, 0);
          break;

      default:
          crv = CKR_MECHANISM_INVALID0x00000070UL;
          break;
  }

  if (crv != CKR_OK0x00000000UL) {
      if (info)
          PORT_FreePORT_Free_Util(info);
      if (pinfo)
          PORT_ZFreePORT_ZFree_Util(pinfo, pinfo->size);
      sftk_FreeContext(context);
      sftk_FreeSession(session);
      return crv;
  }
  sftk_SetContextByType(session, SFTK_VERIFY, context);
  sftk_FreeSession(session);
  return CKR_OK0x00000000UL;
3835}

3837/* NSC_Verify verifies a signature in a single-part operation,
* where the signature is an appendix to the data,
* and plaintext cannot be recovered from the signature */
3840CK_RV
3841NSC_Verify(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData,
         CK_ULONG ulDataLen, CK_BYTE_PTR pSignature, CK_ULONG ulSignatureLen)
3843{
  SFTKSession *session;
  SFTKSessionContext *context;
  CK_RV crv;

  CHECK_FORK();

  /* make sure we're legal */
  crv = sftk_GetContext(hSession, &context, SFTK_VERIFY, PR_FALSE0, &session);
  if (crv != CKR_OK0x00000000UL)
      return crv;

  /* multi part Verifying are completely implemented by VerifyUpdate and
   * VerifyFinal */
  if (context->multi) {
      /* VerifyFinal can't follow failed VerifyUpdate */
      if (CKR_OK0x00000000UL == (crv = NSC_VerifyUpdate(hSession, pData, ulDataLen)))
          crv = NSC_VerifyFinal(hSession, pSignature, ulSignatureLen);
  } else {
      if (SECSuccess != (*context->verify)(context->cipherInfo, pSignature,
                                           ulSignatureLen, pData, ulDataLen))
          crv = sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());

      sftk_TerminateOp(session, SFTK_VERIFY, context);
  }
  sftk_FreeSession(session);
  return crv;
3870}

3872/* NSC_VerifyUpdate continues a multiple-part verification operation,
* where the signature is an appendix to the data,
* and plaintext cannot be recovered from the signature
*
* A call which results in an error terminates the operation [PKCS#11,v2.11]
*/
3878CK_RV
3879NSC_VerifyUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
               CK_ULONG ulPartLen)
3881{
  CHECK_FORK();
  return sftk_MACUpdate(hSession, pPart, ulPartLen, SFTK_VERIFY);
3
←
Calling 'sftk_MACUpdate'→
3884}

3886/* NSC_VerifyFinal finishes a multiple-part verification operation,
* checking the signature. */
3888CK_RV
3889NSC_VerifyFinal(CK_SESSION_HANDLE hSession,
              CK_BYTE_PTR pSignature, CK_ULONG ulSignatureLen)
3891{
  SFTKSession *session;
  SFTKSessionContext *context;
  CK_RV crv;

  CHECK_FORK();

  if (!pSignature)
      return CKR_ARGUMENTS_BAD0x00000007UL;

  /* make sure we're legal */
  crv = sftk_GetContext(hSession, &context, SFTK_VERIFY, PR_TRUE1, &session);
  if (crv != CKR_OK0x00000000UL)
      return crv;

  if (context->hashInfo) {
      unsigned int digestLen;
      unsigned char tmpbuf[SFTK_MAX_MAC_LENGTH64];

      (*context->end)(context->hashInfo, tmpbuf, &digestLen, sizeof(tmpbuf));
      if (SECSuccess != (context->verify)(context->cipherInfo, pSignature,
                                          ulSignatureLen, tmpbuf, digestLen))
          crv = sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
      PORT_Memsetmemset(tmpbuf, 0, sizeof tmpbuf);
  } else if (ulSignatureLen != context->macSize) {
      /* must be block cipher MACing */
      crv = CKR_SIGNATURE_LEN_RANGE0x000000C1UL;
  } else if (CKR_OK0x00000000UL == (crv = sftk_MACFinal(context))) {
      if (NSS_SecureMemcmp(pSignature, context->macBuf, ulSignatureLen))
          crv = CKR_SIGNATURE_INVALID0x000000C0UL;
  }

  sftk_TerminateOp(session, SFTK_VERIFY, context);
  sftk_FreeSession(session);
  return crv;
3926}

3928/*
************** Crypto Functions:     Verify  Recover ************************
*/
3931static SECStatus
3932sftk_RSACheckSignRecover(NSSLOWKEYPublicKey *key, unsigned char *data,
                       unsigned int *dataLen, unsigned int maxDataLen,
                       const unsigned char *sig, unsigned int sigLen)
3935{
  PORT_Assert(key->keyType == NSSLOWKEYRSAKey)((key->keyType == NSSLOWKEYRSAKey)?((void)0):PR_Assert("key->keyType == NSSLOWKEYRSAKey"
,"pkcs11c.c",3936));
  if (key->keyType != NSSLOWKEYRSAKey) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_KEY);
      return SECFailure;
  }

  return RSA_CheckSignRecover(&key->u.rsa, data, dataLen, maxDataLen,
                              sig, sigLen);
3944}

3946static SECStatus
3947sftk_RSACheckSignRecoverRaw(NSSLOWKEYPublicKey *key, unsigned char *data,
                          unsigned int *dataLen, unsigned int maxDataLen,
                          const unsigned char *sig, unsigned int sigLen)
3950{
  PORT_Assert(key->keyType == NSSLOWKEYRSAKey)((key->keyType == NSSLOWKEYRSAKey)?((void)0):PR_Assert("key->keyType == NSSLOWKEYRSAKey"
,"pkcs11c.c",3951));
  if (key->keyType != NSSLOWKEYRSAKey) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_KEY);
      return SECFailure;
  }

  return RSA_CheckSignRecoverRaw(&key->u.rsa, data, dataLen, maxDataLen,
                                 sig, sigLen);
3959}

3961/* NSC_VerifyRecoverInit initializes a signature verification operation,
* where the data is recovered from the signature.
* E.g. Decryption with the user's public key */
3964CK_RV
3965NSC_VerifyRecoverInit(CK_SESSION_HANDLE hSession,
                    CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey)
3967{
  SFTKSession *session;
  SFTKObject *key;
  SFTKSessionContext *context;
  CK_KEY_TYPE key_type;
  CK_RV crv = CKR_OK0x00000000UL;
  NSSLOWKEYPublicKey *pubKey;

  CHECK_FORK();

  session = sftk_SessionFromHandle(hSession);
  if (session == NULL((void*)0))
      return CKR_SESSION_HANDLE_INVALID0x000000B3UL;
  crv = sftk_InitGeneric(session, pMechanism, &context, SFTK_VERIFY_RECOVER,
                         &key, hKey, &key_type, CKO_PUBLIC_KEY0x00000002UL, CKA_VERIFY_RECOVER0x0000010BUL);
  if (crv != CKR_OK0x00000000UL) {
      sftk_FreeSession(session);
      return crv;
  }

  context->multi = PR_TRUE1;

  switch (pMechanism->mechanism) {
      case CKM_RSA_PKCS0x00000001UL:
      case CKM_RSA_X_5090x00000003UL:
          if (key_type != CKK_RSA0x00000000UL) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          context->multi = PR_FALSE0;
          context->rsa = PR_TRUE1;
          pubKey = sftk_GetPubKey(key, CKK_RSA0x00000000UL, &crv);
          if (pubKey == NULL((void*)0)) {
              break;
          }
          context->cipherInfo = pubKey;
          context->update = (SFTKCipher)(pMechanism->mechanism == CKM_RSA_X_5090x00000003UL
                                             ? sftk_RSACheckSignRecoverRaw
                                             : sftk_RSACheckSignRecover);
          context->destroy = sftk_Null;
          break;
      default:
          crv = CKR_MECHANISM_INVALID0x00000070UL;
          break;
  }

  if (crv != CKR_OK0x00000000UL) {
      PORT_FreePORT_Free_Util(context);
      sftk_FreeSession(session);
      return crv;
  }
  sftk_SetContextByType(session, SFTK_VERIFY_RECOVER, context);
  sftk_FreeSession(session);
  return CKR_OK0x00000000UL;
4021}

4023/* NSC_VerifyRecover verifies a signature in a single-part operation,
* where the data is recovered from the signature.
* E.g. Decryption with the user's public key */
4026CK_RV
4027NSC_VerifyRecover(CK_SESSION_HANDLE hSession,
                CK_BYTE_PTR pSignature, CK_ULONG ulSignatureLen,
                CK_BYTE_PTR pData, CK_ULONG_PTR pulDataLen)
4030{
  SFTKSession *session;
  SFTKSessionContext *context;
  unsigned int outlen;
  unsigned int maxoutlen = *pulDataLen;
  CK_RV crv;
  SECStatus rv;

  CHECK_FORK();

  /* make sure we're legal */
  crv = sftk_GetContext(hSession, &context, SFTK_VERIFY_RECOVER,
                        PR_FALSE0, &session);
  if (crv != CKR_OK0x00000000UL)
      return crv;
  if (pData == NULL((void*)0)) {
      /* to return the actual size, we need  to do the decrypt, just return
       * the max size, which is the size of the input signature. */
      *pulDataLen = ulSignatureLen;
      rv = SECSuccess;
      goto finish;
  }

  rv = (*context->update)(context->cipherInfo, pData, &outlen, maxoutlen,
                          pSignature, ulSignatureLen);
  *pulDataLen = (CK_ULONG)outlen;

  sftk_TerminateOp(session, SFTK_VERIFY_RECOVER, context);
4058finish:
  sftk_FreeSession(session);
  return (rv == SECSuccess) ? CKR_OK0x00000000UL : sftk_MapVerifyError(PORT_GetErrorPORT_GetError_Util());
4061}

4063/*
**************************** Random Functions:  ************************
*/

4067/* NSC_SeedRandom mixes additional seed material into the token's random number
* generator. */
4069CK_RV
4070NSC_SeedRandom(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSeed,
             CK_ULONG ulSeedLen)
4072{
  SECStatus rv;

  CHECK_FORK();

  rv = RNG_RandomUpdate(pSeed, ulSeedLen);
  return (rv == SECSuccess) ? CKR_OK0x00000000UL : sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
4079}

4081/* NSC_GenerateRandom generates random data. */
4082CK_RV
4083NSC_GenerateRandom(CK_SESSION_HANDLE hSession,
                 CK_BYTE_PTR pRandomData, CK_ULONG ulRandomLen)
4085{
  SECStatus rv;

  CHECK_FORK();

  rv = RNG_GenerateGlobalRandomBytes(pRandomData, ulRandomLen);
  /*
   * This may fail with SEC_ERROR_NEED_RANDOM, which means the RNG isn't
   * seeded with enough entropy.
   */
  return (rv == SECSuccess) ? CKR_OK0x00000000UL : sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
4096}

4098/*
**************************** Key Functions:  ************************
*/

4102/*
* generate a password based encryption key. This code uses
* PKCS5 to do the work.
*/
4106static CK_RV
4107nsc_pbe_key_gen(NSSPKCS5PBEParameter *pkcs5_pbe, CK_MECHANISM_PTR pMechanism,
              void *buf, CK_ULONG *key_length, PRBool faulty3DES)
4109{
  SECItem *pbe_key = NULL((void*)0), iv, pwitem;
  CK_PBE_PARAMS *pbe_params = NULL((void*)0);
  CK_PKCS5_PBKD2_PARAMS *pbkd2_params = NULL((void*)0);

  *key_length = 0;
  iv.data = NULL((void*)0);
  iv.len = 0;

  if (pMechanism->mechanism == CKM_PKCS5_PBKD20x000003B0UL) {
      if (BAD_PARAM_CAST(pMechanism, sizeof(CK_PKCS5_PBKD2_PARAMS))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_PKCS5_PBKD2_PARAMS))) {
          return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
      }
      pbkd2_params = (CK_PKCS5_PBKD2_PARAMS *)pMechanism->pParameter;
      pwitem.data = (unsigned char *)pbkd2_params->pPassword;
      /* was this a typo in the PKCS #11 spec? */
      pwitem.len = *pbkd2_params->ulPasswordLen;
  } else {
      if (BAD_PARAM_CAST(pMechanism, sizeof(CK_PBE_PARAMS))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_PBE_PARAMS))) {
          return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
      }
      pbe_params = (CK_PBE_PARAMS *)pMechanism->pParameter;
      pwitem.data = (unsigned char *)pbe_params->pPassword;
      pwitem.len = pbe_params->ulPasswordLen;
  }
  pbe_key = nsspkcs5_ComputeKeyAndIV(pkcs5_pbe, &pwitem, &iv, faulty3DES);
  if (pbe_key == NULL((void*)0)) {
      return CKR_HOST_MEMORY0x00000002UL;
  }

  PORT_Memcpymemcpy(buf, pbe_key->data, pbe_key->len);
  *key_length = pbe_key->len;
  SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(pbe_key, PR_TRUE1);
  pbe_key = NULL((void*)0);

  if (iv.data) {
      if (pbe_params && pbe_params->pInitVector != NULL((void*)0)) {
          PORT_Memcpymemcpy(pbe_params->pInitVector, iv.data, iv.len);
      }
      PORT_FreePORT_Free_Util(iv.data);
  }

  return CKR_OK0x00000000UL;
4152}

4154/*
* this is coded for "full" support. These selections will be limitted to
* the official subset by freebl.
*/
4158static unsigned int
4159sftk_GetSubPrimeFromPrime(unsigned int primeBits)
4160{
  if (primeBits <= 1024) {
      return 160;
  } else if (primeBits <= 2048) {
      return 224;
  } else if (primeBits <= 3072) {
      return 256;
  } else if (primeBits <= 7680) {
      return 384;
  } else {
      return 512;
  }
4172}

4174static CK_RV
4175nsc_parameter_gen(CK_KEY_TYPE key_type, SFTKObject *key)
4176{
  SFTKAttribute *attribute;
  CK_ULONG counter;
  unsigned int seedBits = 0;
  unsigned int subprimeBits = 0;
  unsigned int primeBits;
  unsigned int j = 8; /* default to 1024 bits */
  CK_RV crv = CKR_OK0x00000000UL;
  PQGParams *params = NULL((void*)0);
  PQGVerify *vfy = NULL((void*)0);
  SECStatus rv;

  attribute = sftk_FindAttribute(key, CKA_PRIME_BITS0x00000133UL);
  if (attribute == NULL((void*)0)) {
      attribute = sftk_FindAttribute(key, CKA_PRIME0x00000130UL);
      if (attribute == NULL((void*)0)) {
          return CKR_TEMPLATE_INCOMPLETE0x000000D0UL;
      } else {
          primeBits = attribute->attrib.ulValueLen;
          sftk_FreeAttribute(attribute);
      }
  } else {
      primeBits = (unsigned int)*(CK_ULONG *)attribute->attrib.pValue;
      sftk_FreeAttribute(attribute);
  }
  if (primeBits < 1024) {
      j = PQG_PBITS_TO_INDEX(primeBits)(((primeBits) < 512 || (primeBits) > 1024 || (primeBits
) % 64) ? -1 : (int)((primeBits)-512) / 64);
      if (j == (unsigned int)-1) {
          return CKR_ATTRIBUTE_VALUE_INVALID0x00000013UL;
      }
  }

  attribute = sftk_FindAttribute(key, CKA_NSS_PQG_SEED_BITS((0x80000000UL | 0x4E534350) + 23));
  if (attribute != NULL((void*)0)) {
      seedBits = (unsigned int)*(CK_ULONG *)attribute->attrib.pValue;
      sftk_FreeAttribute(attribute);
  }

  attribute = sftk_FindAttribute(key, CKA_SUBPRIME_BITS0x00000134UL);
  if (attribute != NULL((void*)0)) {
      subprimeBits = (unsigned int)*(CK_ULONG *)attribute->attrib.pValue;
      sftk_FreeAttribute(attribute);
  }

  /* if P and Q are supplied, we want to generate a new G */
  attribute = sftk_FindAttribute(key, CKA_PRIME0x00000130UL);
  if (attribute != NULL((void*)0)) {
      PLArenaPool *arena;

      sftk_FreeAttribute(attribute);
      arena = PORT_NewArenaPORT_NewArena_Util(1024);
      if (arena == NULL((void*)0)) {
          crv = CKR_HOST_MEMORY0x00000002UL;
          goto loser;
      }
      params = PORT_ArenaAllocPORT_ArenaAlloc_Util(arena, sizeof(*params));
      if (params == NULL((void*)0)) {
          crv = CKR_HOST_MEMORY0x00000002UL;
          goto loser;
      }
      params->arena = arena;
      crv = sftk_Attribute2SSecItem(arena, &params->prime, key, CKA_PRIME0x00000130UL);
      if (crv != CKR_OK0x00000000UL) {
          goto loser;
      }
      crv = sftk_Attribute2SSecItem(arena, &params->subPrime,
                                    key, CKA_SUBPRIME0x00000131UL);
      if (crv != CKR_OK0x00000000UL) {
          goto loser;
      }

      arena = PORT_NewArenaPORT_NewArena_Util(1024);
      if (arena == NULL((void*)0)) {
          crv = CKR_HOST_MEMORY0x00000002UL;
          goto loser;
      }
      vfy = PORT_ArenaAllocPORT_ArenaAlloc_Util(arena, sizeof(*vfy));
      if (vfy == NULL((void*)0)) {
          crv = CKR_HOST_MEMORY0x00000002UL;
          goto loser;
      }
      vfy->arena = arena;
      crv = sftk_Attribute2SSecItem(arena, &vfy->seed, key, CKA_NSS_PQG_SEED((0x80000000UL | 0x4E534350) + 21));
      if (crv != CKR_OK0x00000000UL) {
          goto loser;
      }
      crv = sftk_Attribute2SSecItem(arena, &vfy->h, key, CKA_NSS_PQG_H((0x80000000UL | 0x4E534350) + 22));
      if (crv != CKR_OK0x00000000UL) {
          goto loser;
      }
      sftk_DeleteAttributeType(key, CKA_PRIME0x00000130UL);
      sftk_DeleteAttributeType(key, CKA_SUBPRIME0x00000131UL);
      sftk_DeleteAttributeType(key, CKA_NSS_PQG_SEED((0x80000000UL | 0x4E534350) + 21));
      sftk_DeleteAttributeType(key, CKA_NSS_PQG_H((0x80000000UL | 0x4E534350) + 22));
  }

  sftk_DeleteAttributeType(key, CKA_PRIME_BITS0x00000133UL);
  sftk_DeleteAttributeType(key, CKA_SUBPRIME_BITS0x00000134UL);
  sftk_DeleteAttributeType(key, CKA_NSS_PQG_SEED_BITS((0x80000000UL | 0x4E534350) + 23));

  /* use the old PQG interface if we have old input data */
  if ((primeBits < 1024) || ((primeBits == 1024) && (subprimeBits == 0))) {
      if (seedBits == 0) {
          rv = PQG_ParamGen(j, &params, &vfy);
      } else {
          rv = PQG_ParamGenSeedLen(j, seedBits / 8, &params, &vfy);
      }
  } else {
      if (subprimeBits == 0) {
          subprimeBits = sftk_GetSubPrimeFromPrime(primeBits);
      }
      if (seedBits == 0) {
          seedBits = primeBits;
      }
      rv = PQG_ParamGenV2(primeBits, subprimeBits, seedBits / 8, &params, &vfy);
  }

  if (rv != SECSuccess) {
      if (PORT_GetErrorPORT_GetError_Util() == SEC_ERROR_LIBRARY_FAILURE) {
          sftk_fatalError = PR_TRUE1;
      }
      return sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
  }
  crv = sftk_AddAttributeType(key, CKA_PRIME0x00000130UL,
                              params->prime.data, params->prime.len);
  if (crv != CKR_OK0x00000000UL)
      goto loser;
  crv = sftk_AddAttributeType(key, CKA_SUBPRIME0x00000131UL,
                              params->subPrime.data, params->subPrime.len);
  if (crv != CKR_OK0x00000000UL)
      goto loser;
  crv = sftk_AddAttributeType(key, CKA_BASE0x00000132UL,
                              params->base.data, params->base.len);
  if (crv != CKR_OK0x00000000UL)
      goto loser;
  counter = vfy->counter;
  crv = sftk_AddAttributeType(key, CKA_NSS_PQG_COUNTER((0x80000000UL | 0x4E534350) + 20),
                              &counter, sizeof(counter));
  crv = sftk_AddAttributeType(key, CKA_NSS_PQG_SEED((0x80000000UL | 0x4E534350) + 21),
                              vfy->seed.data, vfy->seed.len);
  if (crv != CKR_OK0x00000000UL)
      goto loser;
  crv = sftk_AddAttributeType(key, CKA_NSS_PQG_H((0x80000000UL | 0x4E534350) + 22),
                              vfy->h.data, vfy->h.len);
  if (crv != CKR_OK0x00000000UL)
      goto loser;

4323loser:
  if (params) {
      PQG_DestroyParams(params);
  }

  if (vfy) {
      PQG_DestroyVerify(vfy);
  }
  return crv;
4332}

4334static CK_RV
4335nsc_SetupBulkKeyGen(CK_MECHANISM_TYPE mechanism, CK_KEY_TYPE *key_type,
                  CK_ULONG *key_length)
4337{
  CK_RV crv = CKR_OK0x00000000UL;

  switch (mechanism) {
4341#ifndef NSS_DISABLE_DEPRECATED_RC2
      case CKM_RC2_KEY_GEN0x00000100UL:
          *key_type = CKK_RC20x00000011UL;
          if (*key_length == 0)
              crv = CKR_TEMPLATE_INCOMPLETE0x000000D0UL;
          break;
4347#endif /* NSS_DISABLE_DEPRECATED_RC2 */
4348#if NSS_SOFTOKEN_DOES_RC5
      case CKM_RC5_KEY_GEN0x00000330UL:
          *key_type = CKK_RC50x00000019UL;
          if (*key_length == 0)
              crv = CKR_TEMPLATE_INCOMPLETE0x000000D0UL;
          break;
4354#endif
      case CKM_RC4_KEY_GEN0x00000110UL:
          *key_type = CKK_RC40x00000012UL;
          if (*key_length == 0)
              crv = CKR_TEMPLATE_INCOMPLETE0x000000D0UL;
          break;
      case CKM_GENERIC_SECRET_KEY_GEN0x00000350UL:
          *key_type = CKK_GENERIC_SECRET0x00000010UL;
          if (*key_length == 0)
              crv = CKR_TEMPLATE_INCOMPLETE0x000000D0UL;
          break;
      case CKM_CDMF_KEY_GEN0x00000140UL:
          *key_type = CKK_CDMF0x0000001EUL;
          *key_length = 8;
          break;
      case CKM_DES_KEY_GEN0x00000120UL:
          *key_type = CKK_DES0x00000013UL;
          *key_length = 8;
          break;
      case CKM_DES2_KEY_GEN0x00000130UL:
          *key_type = CKK_DES20x00000014UL;
          *key_length = 16;
          break;
      case CKM_DES3_KEY_GEN0x00000131UL:
          *key_type = CKK_DES30x00000015UL;
          *key_length = 24;
          break;
4381#ifndef NSS_DISABLE_DEPRECATED_SEED
      case CKM_SEED_KEY_GEN0x00000650UL:
          *key_type = CKK_SEED0x0000002FUL;
          *key_length = 16;
          break;
4386#endif /* NSS_DISABLE_DEPRECATED_SEED */
      case CKM_CAMELLIA_KEY_GEN0x00000550UL:
          *key_type = CKK_CAMELLIA0x00000025UL;
          if (*key_length == 0)
              crv = CKR_TEMPLATE_INCOMPLETE0x000000D0UL;
          break;
      case CKM_AES_KEY_GEN0x00001080UL:
          *key_type = CKK_AES0x0000001FUL;
          if (*key_length == 0)
              crv = CKR_TEMPLATE_INCOMPLETE0x000000D0UL;
          break;
      case CKM_NSS_CHACHA20_KEY_GEN((0x80000000UL | 0x4E534350) + 27):
          *key_type = CKK_NSS_CHACHA20((0x80000000UL | 0x4E534350) + 4);
          *key_length = 32;
          break;
      case CKM_CHACHA20_KEY_GEN0x00001225UL:
          *key_type = CKK_CHACHA200x00000033UL;
          *key_length = 32;
          break;
      case CKM_HKDF_KEY_GEN0x0000402cUL:
          *key_type = CKK_HKDF0x00000042UL;
          if (*key_length == 0)
              crv = CKR_TEMPLATE_INCOMPLETE0x000000D0UL;
          break;
      default:
          PORT_Assert(0)((0)?((void)0):PR_Assert("0","pkcs11c.c",4411));
          crv = CKR_MECHANISM_INVALID0x00000070UL;
          break;
  }

  return crv;
4417}

4419CK_RV
4420nsc_SetupHMACKeyGen(CK_MECHANISM_PTR pMechanism, NSSPKCS5PBEParameter **pbe)
4421{
  SECItem salt;
  CK_PBE_PARAMS *pbe_params = NULL((void*)0);
  NSSPKCS5PBEParameter *params;
  PLArenaPool *arena = NULL((void*)0);
  SECStatus rv;

  *pbe = NULL((void*)0);

  arena = PORT_NewArenaPORT_NewArena_Util(SEC_ASN1_DEFAULT_ARENA_SIZE(2048));
  if (arena == NULL((void*)0)) {
      return CKR_HOST_MEMORY0x00000002UL;
  }

  params = (NSSPKCS5PBEParameter *)PORT_ArenaZAllocPORT_ArenaZAlloc_Util(arena,
                                                    sizeof(NSSPKCS5PBEParameter));
  if (params == NULL((void*)0)) {
      PORT_FreeArenaPORT_FreeArena_Util(arena, PR_TRUE1);
      return CKR_HOST_MEMORY0x00000002UL;
  }
  if (BAD_PARAM_CAST(pMechanism, sizeof(CK_PBE_PARAMS))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_PBE_PARAMS))) {
      PORT_FreeArenaPORT_FreeArena_Util(arena, PR_TRUE1);
      return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
  }

  params->poolp = arena;
  params->ivLen = 0;
  params->pbeType = NSSPKCS5_PKCS12_V2;
  params->hashType = HASH_AlgSHA1;
  params->encAlg = SEC_OID_SHA1; /* any invalid value */
  params->is2KeyDES = PR_FALSE0;
  params->keyID = pbeBitGenIntegrityKey;
  pbe_params = (CK_PBE_PARAMS *)pMechanism->pParameter;
  params->iter = pbe_params->ulIteration;

  salt.data = (unsigned char *)pbe_params->pSalt;
  salt.len = (unsigned int)pbe_params->ulSaltLen;
  salt.type = siBuffer;
  rv = SECITEM_CopyItemSECITEM_CopyItem_Util(arena, &params->salt, &salt);
  if (rv != SECSuccess) {
      PORT_FreeArenaPORT_FreeArena_Util(arena, PR_TRUE1);
      return CKR_HOST_MEMORY0x00000002UL;
  }
  switch (pMechanism->mechanism) {
      case CKM_NSS_PBE_SHA1_HMAC_KEY_GEN0x80000009UL:
      case CKM_PBA_SHA1_WITH_SHA1_HMAC0x000003C0UL:
          params->hashType = HASH_AlgSHA1;
          params->keyLen = 20;
          break;
      case CKM_NSS_PBE_MD5_HMAC_KEY_GEN0x8000000aUL:
          params->hashType = HASH_AlgMD5;
          params->keyLen = 16;
          break;
      case CKM_NSS_PBE_MD2_HMAC_KEY_GEN0x8000000bUL:
          params->hashType = HASH_AlgMD2;
          params->keyLen = 16;
          break;
      case CKM_NSS_PKCS12_PBE_SHA224_HMAC_KEY_GEN((0x80000000UL | 0x4E534350) + 29):
          params->hashType = HASH_AlgSHA224;
          params->keyLen = 28;
          break;
      case CKM_NSS_PKCS12_PBE_SHA256_HMAC_KEY_GEN((0x80000000UL | 0x4E534350) + 30):
          params->hashType = HASH_AlgSHA256;
          params->keyLen = 32;
          break;
      case CKM_NSS_PKCS12_PBE_SHA384_HMAC_KEY_GEN((0x80000000UL | 0x4E534350) + 31):
          params->hashType = HASH_AlgSHA384;
          params->keyLen = 48;
          break;
      case CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN((0x80000000UL | 0x4E534350) + 32):
          params->hashType = HASH_AlgSHA512;
          params->keyLen = 64;
          break;
      default:
          PORT_FreeArenaPORT_FreeArena_Util(arena, PR_TRUE1);
          return CKR_MECHANISM_INVALID0x00000070UL;
  }
  *pbe = params;
  return CKR_OK0x00000000UL;
4500}

4502/* maybe this should be table driven? */
4503static CK_RV
4504nsc_SetupPBEKeyGen(CK_MECHANISM_PTR pMechanism, NSSPKCS5PBEParameter **pbe,
                 CK_KEY_TYPE *key_type, CK_ULONG *key_length)
4506{
  CK_RV crv = CKR_OK0x00000000UL;
  SECOidData *oid;
  CK_PBE_PARAMS *pbe_params = NULL((void*)0);
  NSSPKCS5PBEParameter *params = NULL((void*)0);
  HASH_HashType hashType = HASH_AlgSHA1;
  CK_PKCS5_PBKD2_PARAMS *pbkd2_params = NULL((void*)0);
  SECItem salt;
  CK_ULONG iteration = 0;

  *pbe = NULL((void*)0);

  oid = SECOID_FindOIDByMechanism(pMechanism->mechanism);
  if (oid == NULL((void*)0)) {
      return CKR_MECHANISM_INVALID0x00000070UL;
  }

  if (pMechanism->mechanism == CKM_PKCS5_PBKD20x000003B0UL) {
      if (BAD_PARAM_CAST(pMechanism, sizeof(CK_PKCS5_PBKD2_PARAMS))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_PKCS5_PBKD2_PARAMS))) {
          return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
      }
      pbkd2_params = (CK_PKCS5_PBKD2_PARAMS *)pMechanism->pParameter;
      switch (pbkd2_params->prf) {
          case CKP_PKCS5_PBKD2_HMAC_SHA10x00000001UL:
              hashType = HASH_AlgSHA1;
              break;
          case CKP_PKCS5_PBKD2_HMAC_SHA2240x00000003UL:
              hashType = HASH_AlgSHA224;
              break;
          case CKP_PKCS5_PBKD2_HMAC_SHA2560x00000004UL:
              hashType = HASH_AlgSHA256;
              break;
          case CKP_PKCS5_PBKD2_HMAC_SHA3840x00000005UL:
              hashType = HASH_AlgSHA384;
              break;
          case CKP_PKCS5_PBKD2_HMAC_SHA5120x00000006UL:
              hashType = HASH_AlgSHA512;
              break;
          default:
              return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
      }
      if (pbkd2_params->saltSource != CKZ_SALT_SPECIFIED0x00000001UL) {
          return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
      }
      salt.data = (unsigned char *)pbkd2_params->pSaltSourceData;
      salt.len = (unsigned int)pbkd2_params->ulSaltSourceDataLen;
      iteration = pbkd2_params->iterations;
  } else {
      if (BAD_PARAM_CAST(pMechanism, sizeof(CK_PBE_PARAMS))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_PBE_PARAMS))) {
          return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
      }
      pbe_params = (CK_PBE_PARAMS *)pMechanism->pParameter;
      salt.data = (unsigned char *)pbe_params->pSalt;
      salt.len = (unsigned int)pbe_params->ulSaltLen;
      iteration = pbe_params->ulIteration;
  }
  params = nsspkcs5_NewParam(oid->offset, hashType, &salt, iteration);
  if (params == NULL((void*)0)) {
      return CKR_MECHANISM_INVALID0x00000070UL;
  }

  switch (params->encAlg) {
      case SEC_OID_DES_CBC:
          *key_type = CKK_DES0x00000013UL;
          *key_length = params->keyLen;
          break;
      case SEC_OID_DES_EDE3_CBC:
          *key_type = params->is2KeyDES ? CKK_DES20x00000014UL : CKK_DES30x00000015UL;
          *key_length = params->keyLen;
          break;
4576#ifndef NSS_DISABLE_DEPRECATED_RC2
      case SEC_OID_RC2_CBC:
          *key_type = CKK_RC20x00000011UL;
          *key_length = params->keyLen;
          break;
4581#endif /* NSS_DISABLE_DEPRECATED_RC2 */
      case SEC_OID_RC4:
          *key_type = CKK_RC40x00000012UL;
          *key_length = params->keyLen;
          break;
      case SEC_OID_PKCS5_PBKDF2:
          /* key type must already be set */
          if (*key_type == CKK_INVALID_KEY_TYPE0xffffffffUL) {
              crv = CKR_TEMPLATE_INCOMPLETE0x000000D0UL;
              break;
          }
          /* PBKDF2 needs to calculate the key length from the other parameters
           */
          if (*key_length == 0) {
              *key_length = sftk_MapKeySize(*key_type);
          }
          if (*key_length == 0) {
              crv = CKR_TEMPLATE_INCOMPLETE0x000000D0UL;
              break;
          }
          params->keyLen = *key_length;
          break;
      default:
          crv = CKR_MECHANISM_INVALID0x00000070UL;
          break;
  }
  if (crv == CKR_OK0x00000000UL) {
      *pbe = params;
  } else {
      nsspkcs5_DestroyPBEParameter(params);
  }
  return crv;
4613}

4615/* NSC_GenerateKey generates a secret key, creating a new key object. */
4616CK_RV
4617NSC_GenerateKey(CK_SESSION_HANDLE hSession,
              CK_MECHANISM_PTR pMechanism, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount,
              CK_OBJECT_HANDLE_PTR phKey)
4620{
  SFTKObject *key;
  SFTKSession *session;
  PRBool checkWeak = PR_FALSE0;
  CK_ULONG key_length = 0;
  CK_KEY_TYPE key_type = CKK_INVALID_KEY_TYPE0xffffffffUL;
  CK_OBJECT_CLASS objclass = CKO_SECRET_KEY0x00000004UL;
  CK_RV crv = CKR_OK0x00000000UL;
  CK_BBOOL cktrue = CK_TRUE1;
  NSSPKCS5PBEParameter *pbe_param = NULL((void*)0);
  int i;
  SFTKSlot *slot = sftk_SlotFromSessionHandle(hSession);
  unsigned char buf[MAX_KEY_LEN256];
  enum { nsc_pbe,
         nsc_ssl,
         nsc_bulk,
         nsc_param,
         nsc_jpake } key_gen_type;
  SSL3RSAPreMasterSecret *rsa_pms;
  CK_VERSION *version;
  /* in very old versions of NSS, there were implementation errors with key
   * generation methods.  We want to beable to read these, but not
   * produce them any more.  The affected algorithm was 3DES.
   */
  PRBool faultyPBE3DES = PR_FALSE0;
  HASH_HashType hashType = HASH_AlgNULL;

  CHECK_FORK();

  if (!slot) {
      return CKR_SESSION_HANDLE_INVALID0x000000B3UL;
  }
  /*
   * now lets create an object to hang the attributes off of
   */
  key = sftk_NewObject(slot); /* fill in the handle later */
  if (key == NULL((void*)0)) {
      return CKR_HOST_MEMORY0x00000002UL;
  }

  /*
   * load the template values into the object
   */
  for (i = 0; i < (int)ulCount; i++) {
      if (pTemplate[i].type == CKA_VALUE_LEN0x00000161UL) {
          key_length = *(CK_ULONG *)pTemplate[i].pValue;
          continue;
      }
      /* some algorithms need keytype specified */
      if (pTemplate[i].type == CKA_KEY_TYPE0x00000100UL) {
          key_type = *(CK_ULONG *)pTemplate[i].pValue;
          continue;
      }

      crv = sftk_AddAttributeType(key, sftk_attr_expand(&pTemplate[i])(&pTemplate[i])->type, (&pTemplate[i])->pValue,
 (&pTemplate[i])->ulValueLen);
      if (crv != CKR_OK0x00000000UL) {
          break;
      }
  }
  if (crv != CKR_OK0x00000000UL) {
      goto loser;
  }

  /* make sure we don't have any class, key_type, or value fields */
  sftk_DeleteAttributeType(key, CKA_CLASS0x00000000UL);
  sftk_DeleteAttributeType(key, CKA_KEY_TYPE0x00000100UL);
  sftk_DeleteAttributeType(key, CKA_VALUE0x00000011UL);

  /* Now Set up the parameters to generate the key (based on mechanism) */
  key_gen_type = nsc_bulk; /* bulk key by default */
  switch (pMechanism->mechanism) {
      case CKM_CDMF_KEY_GEN0x00000140UL:
      case CKM_DES_KEY_GEN0x00000120UL:
      case CKM_DES2_KEY_GEN0x00000130UL:
      case CKM_DES3_KEY_GEN0x00000131UL:
          checkWeak = PR_TRUE1;
4696/* fall through */
4697#ifndef NSS_DISABLE_DEPRECATED_RC2
      case CKM_RC2_KEY_GEN0x00000100UL:
4699#endif
      case CKM_RC4_KEY_GEN0x00000110UL:
      case CKM_GENERIC_SECRET_KEY_GEN0x00000350UL:
4702#ifndef NSS_DISABLE_DEPRECATED_SEED
      case CKM_SEED_KEY_GEN0x00000650UL:
4704#endif
      case CKM_CAMELLIA_KEY_GEN0x00000550UL:
      case CKM_AES_KEY_GEN0x00001080UL:
      case CKM_NSS_CHACHA20_KEY_GEN((0x80000000UL | 0x4E534350) + 27):
      case CKM_CHACHA20_KEY_GEN0x00001225UL:
4709#if NSS_SOFTOKEN_DOES_RC5
      case CKM_RC5_KEY_GEN0x00000330UL:
4711#endif
          crv = nsc_SetupBulkKeyGen(pMechanism->mechanism, &key_type, &key_length);
          break;
      case CKM_SSL3_PRE_MASTER_KEY_GEN0x00000370UL:
          key_type = CKK_GENERIC_SECRET0x00000010UL;
          key_length = 48;
          key_gen_type = nsc_ssl;
          break;
      case CKM_PBA_SHA1_WITH_SHA1_HMAC0x000003C0UL:
      case CKM_NSS_PBE_SHA1_HMAC_KEY_GEN0x80000009UL:
      case CKM_NSS_PBE_MD5_HMAC_KEY_GEN0x8000000aUL:
      case CKM_NSS_PBE_MD2_HMAC_KEY_GEN0x8000000bUL:
      case CKM_NSS_PKCS12_PBE_SHA224_HMAC_KEY_GEN((0x80000000UL | 0x4E534350) + 29):
      case CKM_NSS_PKCS12_PBE_SHA256_HMAC_KEY_GEN((0x80000000UL | 0x4E534350) + 30):
      case CKM_NSS_PKCS12_PBE_SHA384_HMAC_KEY_GEN((0x80000000UL | 0x4E534350) + 31):
      case CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN((0x80000000UL | 0x4E534350) + 32):
          key_gen_type = nsc_pbe;
          key_type = CKK_GENERIC_SECRET0x00000010UL;
          crv = nsc_SetupHMACKeyGen(pMechanism, &pbe_param);
          break;
      case CKM_NSS_PBE_SHA1_FAULTY_3DES_CBC0x80000008UL:
          faultyPBE3DES = PR_TRUE1;
      /* fall through */
      case CKM_NSS_PBE_SHA1_TRIPLE_DES_CBC0x80000003UL:
4735#ifndef NSS_DISABLE_DEPRECATED_RC2
      case CKM_NSS_PBE_SHA1_40_BIT_RC2_CBC0x80000004UL:
      case CKM_NSS_PBE_SHA1_128_BIT_RC2_CBC0x80000005UL:
      case CKM_PBE_SHA1_RC2_128_CBC0x000003AAUL:
      case CKM_PBE_SHA1_RC2_40_CBC0x000003ABUL:
4740#endif
      case CKM_NSS_PBE_SHA1_DES_CBC0x80000002UL:
      case CKM_NSS_PBE_SHA1_40_BIT_RC40x80000006UL:
      case CKM_NSS_PBE_SHA1_128_BIT_RC40x80000007UL:
      case CKM_PBE_SHA1_DES3_EDE_CBC0x000003A8UL:
      case CKM_PBE_SHA1_DES2_EDE_CBC0x000003A9UL:
      case CKM_PBE_SHA1_RC4_1280x000003A6UL:
      case CKM_PBE_SHA1_RC4_400x000003A7UL:
      case CKM_PBE_MD5_DES_CBC0x000003A1UL:
      case CKM_PBE_MD2_DES_CBC0x000003A0UL:
      case CKM_PKCS5_PBKD20x000003B0UL:
          key_gen_type = nsc_pbe;
          crv = nsc_SetupPBEKeyGen(pMechanism, &pbe_param, &key_type, &key_length);
          break;
      case CKM_DSA_PARAMETER_GEN0x00002000UL:
          key_gen_type = nsc_param;
          key_type = CKK_DSA0x00000001UL;
          objclass = CKO_DOMAIN_PARAMETERS0x00000006UL;
          crv = CKR_OK0x00000000UL;
          break;
      case CKM_NSS_JPAKE_ROUND1_SHA1((0x80000000UL | 0x4E534350) + 7):
          hashType = HASH_AlgSHA1;
          goto jpake1;
      case CKM_NSS_JPAKE_ROUND1_SHA256((0x80000000UL | 0x4E534350) + 8):
          hashType = HASH_AlgSHA256;
          goto jpake1;
      case CKM_NSS_JPAKE_ROUND1_SHA384((0x80000000UL | 0x4E534350) + 9):
          hashType = HASH_AlgSHA384;
          goto jpake1;
      case CKM_NSS_JPAKE_ROUND1_SHA512((0x80000000UL | 0x4E534350) + 10):
          hashType = HASH_AlgSHA512;
          goto jpake1;
      jpake1:
          key_gen_type = nsc_jpake;
          key_type = CKK_NSS_JPAKE_ROUND1((0x80000000UL | 0x4E534350) + 2);
          objclass = CKO_PRIVATE_KEY0x00000003UL;
          if (pMechanism->pParameter == NULL((void*)0) ||
              pMechanism->ulParameterLen != sizeof(CK_NSS_JPAKERound1Params)) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          if (sftk_isTrue(key, CKA_TOKEN0x00000001UL)) {
              crv = CKR_TEMPLATE_INCONSISTENT0x000000D1UL;
              break;
          }
          crv = CKR_OK0x00000000UL;
          break;
      default:
          crv = CKR_MECHANISM_INVALID0x00000070UL;
          break;
  }

  /* make sure we aren't going to overflow the buffer */
  if (sizeof(buf) < key_length) {
      /* someone is getting pretty optimistic about how big their key can
       * be... */
      crv = CKR_TEMPLATE_INCONSISTENT0x000000D1UL;
  }

  if (crv != CKR_OK0x00000000UL) {
      if (pbe_param) {
          nsspkcs5_DestroyPBEParameter(pbe_param);
      }
      goto loser;
  }

  /* if there was no error,
   * key_type *MUST* be set in the switch statement above */
  PORT_Assert(key_type != CKK_INVALID_KEY_TYPE)((key_type != 0xffffffffUL)?((void)0):PR_Assert("key_type != CKK_INVALID_KEY_TYPE"
,"pkcs11c.c",4808));

  /*
   * now to the actual key gen.
   */
  switch (key_gen_type) {
      case nsc_pbe:
          crv = nsc_pbe_key_gen(pbe_param, pMechanism, buf, &key_length,
                                faultyPBE3DES);
          nsspkcs5_DestroyPBEParameter(pbe_param);
          break;
      case nsc_ssl:
          rsa_pms = (SSL3RSAPreMasterSecret *)buf;
          if (BAD_PARAM_CAST(pMechanism, sizeof(CK_VERSION))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_VERSION))) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              goto loser;
          }
          version = (CK_VERSION *)pMechanism->pParameter;
          rsa_pms->client_version[0] = version->major;
          rsa_pms->client_version[1] = version->minor;
          crv =
              NSC_GenerateRandom(0, &rsa_pms->random[0], sizeof(rsa_pms->random));
          break;
      case nsc_bulk:
          /* get the key, check for weak keys and repeat if found */
          do {
              crv = NSC_GenerateRandom(0, buf, key_length);
          } while (crv == CKR_OK0x00000000UL && checkWeak && sftk_IsWeakKey(buf, key_type));
          break;
      case nsc_param:
          /* generate parameters */
          *buf = 0;
          crv = nsc_parameter_gen(key_type, key);
          break;
      case nsc_jpake:
          if (BAD_PARAM_CAST(pMechanism, sizeof(CK_NSS_JPAKERound1Params))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_NSS_JPAKERound1Params))) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              goto loser;
          }
          crv = jpake_Round1(hashType,
                             (CK_NSS_JPAKERound1Params *)pMechanism->pParameter,
                             key);
          break;
  }

  if (crv != CKR_OK0x00000000UL) {
      goto loser;
  }

  /* Add the class, key_type, and value */
  crv = sftk_AddAttributeType(key, CKA_CLASS0x00000000UL, &objclass, sizeof(CK_OBJECT_CLASS));
  if (crv != CKR_OK0x00000000UL) {
      goto loser;
  }
  crv = sftk_AddAttributeType(key, CKA_KEY_TYPE0x00000100UL, &key_type, sizeof(CK_KEY_TYPE));
  if (crv != CKR_OK0x00000000UL) {
      goto loser;
  }
  if (key_length != 0) {
      crv = sftk_AddAttributeType(key, CKA_VALUE0x00000011UL, buf, key_length);
      if (crv != CKR_OK0x00000000UL) {
          goto loser;
      }
  }

  /* get the session */
  session = sftk_SessionFromHandle(hSession);
  if (session == NULL((void*)0)) {
      crv = CKR_SESSION_HANDLE_INVALID0x000000B3UL;
      goto loser;
  }

  /*
   * handle the base object stuff
   */
  crv = sftk_handleObject(key, session);
  sftk_FreeSession(session);
  if (crv == CKR_OK0x00000000UL && sftk_isTrue(key, CKA_SENSITIVE0x00000103UL)) {
      crv = sftk_forceAttribute(key, CKA_ALWAYS_SENSITIVE0x00000165UL, &cktrue, sizeof(CK_BBOOL));
  }
  if (crv == CKR_OK0x00000000UL && !sftk_isTrue(key, CKA_EXTRACTABLE0x00000162UL)) {
      crv = sftk_forceAttribute(key, CKA_NEVER_EXTRACTABLE0x00000164UL, &cktrue, sizeof(CK_BBOOL));
  }
  if (crv == CKR_OK0x00000000UL) {
      *phKey = key->handle;
  }
4894loser:
  PORT_Memsetmemset(buf, 0, sizeof buf);
  sftk_FreeObject(key);
  return crv;
4898}

4900#define PAIRWISE_DIGEST_LENGTH20 SHA1_LENGTH20 /* 160-bits */
4901#define PAIRWISE_MESSAGE_LENGTH20 20         /* 160-bits */

4903/*
* FIPS 140-2 pairwise consistency check utilized to validate key pair.
*
* This function returns
*   CKR_OK               if pairwise consistency check passed
*   CKR_GENERAL_ERROR    if pairwise consistency check failed
*   other error codes    if paiswise consistency check could not be
*                        performed, for example, CKR_HOST_MEMORY.
*/
4912static CK_RV
4913sftk_PairwiseConsistencyCheck(CK_SESSION_HANDLE hSession, SFTKSlot *slot,
                            SFTKObject *publicKey, SFTKObject *privateKey, CK_KEY_TYPE keyType)
4915{
  /*
   *                      Key type    Mechanism type
   *                      --------------------------------
   * For encrypt/decrypt: CKK_RSA  => CKM_RSA_PKCS
   *                      others   => CKM_INVALID_MECHANISM
   *
   * For sign/verify:     CKK_RSA  => CKM_RSA_PKCS
   *                      CKK_DSA  => CKM_DSA
   *                      CKK_EC   => CKM_ECDSA
   *                      others   => CKM_INVALID_MECHANISM
   *
   * None of these mechanisms has a parameter.
   *
   * For derive           CKK_DH   => CKM_DH_PKCS_DERIVE
   *                      CKK_EC   => CKM_ECDH1_DERIVE
   *                      others   => CKM_INVALID_MECHANISM
   *
   * The parameters for these mechanisms is the public key.
   */
  CK_MECHANISM mech = { 0, NULL((void*)0), 0 };

  CK_ULONG modulusLen = 0;
  CK_ULONG subPrimeLen = 0;
  PRBool isEncryptable = PR_FALSE0;
  PRBool canSignVerify = PR_FALSE0;
  PRBool isDerivable = PR_FALSE0;
  CK_RV crv;

  /* Variables used for Encrypt/Decrypt functions. */
  unsigned char *known_message = (unsigned char *)"Known Crypto Message";
  unsigned char plaintext[PAIRWISE_MESSAGE_LENGTH20];
  CK_ULONG bytes_decrypted;
  unsigned char *ciphertext;
  unsigned char *text_compared;
  CK_ULONG bytes_encrypted;
  CK_ULONG bytes_compared;
  CK_ULONG pairwise_digest_length = PAIRWISE_DIGEST_LENGTH20;

  /* Variables used for Signature/Verification functions. */
  /* Must be at least 256 bits for DSA2 digest */
  unsigned char *known_digest = (unsigned char *)"Mozilla Rules the World through NSS!";
  unsigned char *signature;
  CK_ULONG signature_length;

  if (keyType == CKK_RSA0x00000000UL) {
      SFTKAttribute *attribute;

      /* Get modulus length of private key. */
      attribute = sftk_FindAttribute(privateKey, CKA_MODULUS0x00000120UL);
      if (attribute == NULL((void*)0)) {
          return CKR_DEVICE_ERROR0x00000030UL;
      }
      modulusLen = attribute->attrib.ulValueLen;
      if (*(unsigned char *)attribute->attrib.pValue == 0) {
          modulusLen--;
      }
      sftk_FreeAttribute(attribute);
  } else if (keyType == CKK_DSA0x00000001UL) {
      SFTKAttribute *attribute;

      /* Get subprime length of private key. */
      attribute = sftk_FindAttribute(privateKey, CKA_SUBPRIME0x00000131UL);
      if (attribute == NULL((void*)0)) {
          return CKR_DEVICE_ERROR0x00000030UL;
      }
      subPrimeLen = attribute->attrib.ulValueLen;
      if (subPrimeLen > 1 && *(unsigned char *)attribute->attrib.pValue == 0) {
          subPrimeLen--;
      }
      sftk_FreeAttribute(attribute);
  }

  /**************************************************/
  /* Pairwise Consistency Check of Encrypt/Decrypt. */
  /**************************************************/

  isEncryptable = sftk_isTrue(privateKey, CKA_DECRYPT0x00000105UL);

  /*
   * If the decryption attribute is set, attempt to encrypt
   * with the public key and decrypt with the private key.
   */
  if (isEncryptable) {
      if (keyType != CKK_RSA0x00000000UL) {
          return CKR_DEVICE_ERROR0x00000030UL;
      }
      bytes_encrypted = modulusLen;
      mech.mechanism = CKM_RSA_PKCS0x00000001UL;

      /* Allocate space for ciphertext. */
      ciphertext = (unsigned char *)PORT_ZAllocPORT_ZAlloc_Util(bytes_encrypted);
      if (ciphertext == NULL((void*)0)) {
          return CKR_HOST_MEMORY0x00000002UL;
      }

      /* Prepare for encryption using the public key. */
      crv = NSC_EncryptInit(hSession, &mech, publicKey->handle);
      if (crv != CKR_OK0x00000000UL) {
          PORT_FreePORT_Free_Util(ciphertext);
          return crv;
      }

      /* Encrypt using the public key. */
      crv = NSC_Encrypt(hSession,
                        known_message,
                        PAIRWISE_MESSAGE_LENGTH20,
                        ciphertext,
                        &bytes_encrypted);
      if (crv != CKR_OK0x00000000UL) {
          PORT_FreePORT_Free_Util(ciphertext);
          return crv;
      }

      /* Always use the smaller of these two values . . . */
      bytes_compared = PR_MIN(bytes_encrypted, PAIRWISE_MESSAGE_LENGTH)((bytes_encrypted)<(20)?(bytes_encrypted):(20));

      /*
       * If there was a failure, the plaintext
       * goes at the end, therefore . . .
       */
      text_compared = ciphertext + bytes_encrypted - bytes_compared;

      /*
       * Check to ensure that ciphertext does
       * NOT EQUAL known input message text
       * per FIPS PUB 140-2 directive.
       */
      if (PORT_Memcmpmemcmp(text_compared, known_message,
                      bytes_compared) == 0) {
          /* Set error to Invalid PRIVATE Key. */
          PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_KEY);
          PORT_FreePORT_Free_Util(ciphertext);
          return CKR_GENERAL_ERROR0x00000005UL;
      }

      /* Prepare for decryption using the private key. */
      crv = NSC_DecryptInit(hSession, &mech, privateKey->handle);
      if (crv != CKR_OK0x00000000UL) {
          PORT_FreePORT_Free_Util(ciphertext);
          return crv;
      }

      memset(plaintext, 0, PAIRWISE_MESSAGE_LENGTH20);

      /*
       * Initialize bytes decrypted to be the
       * expected PAIRWISE_MESSAGE_LENGTH.
       */
      bytes_decrypted = PAIRWISE_MESSAGE_LENGTH20;

      /*
       * Decrypt using the private key.
       * NOTE:  No need to reset the
       *        value of bytes_encrypted.
       */
      crv = NSC_Decrypt(hSession,
                        ciphertext,
                        bytes_encrypted,
                        plaintext,
                        &bytes_decrypted);

      /* Finished with ciphertext; free it. */
      PORT_FreePORT_Free_Util(ciphertext);

      if (crv != CKR_OK0x00000000UL) {
          return crv;
      }

      /*
       * Check to ensure that the output plaintext
       * does EQUAL known input message text.
       */
      if ((bytes_decrypted != PAIRWISE_MESSAGE_LENGTH20) ||
          (PORT_Memcmpmemcmp(plaintext, known_message,
                       PAIRWISE_MESSAGE_LENGTH20) != 0)) {
          /* Set error to Bad PUBLIC Key. */
          PORT_SetErrorPORT_SetError_Util(SEC_ERROR_BAD_KEY);
          return CKR_GENERAL_ERROR0x00000005UL;
      }
  }

  /**********************************************/
  /* Pairwise Consistency Check of Sign/Verify. */
  /**********************************************/

  canSignVerify = sftk_isTrue(privateKey, CKA_SIGN0x00000108UL);
  /* Unfortunately CKA_SIGN is always true in lg dbs. We have to check the
   * actual curve to determine if we can do sign/verify. */
  if (canSignVerify && keyType == CKK_EC0x00000003UL) {
      NSSLOWKEYPrivateKey *privKey = sftk_GetPrivKey(privateKey, CKK_EC0x00000003UL, &crv);
      if (privKey && privKey->u.ec.ecParams.name == ECCurve25519) {
          canSignVerify = PR_FALSE0;
      }
  }

  if (canSignVerify) {
      /* Determine length of signature. */
      switch (keyType) {
          case CKK_RSA0x00000000UL:
              signature_length = modulusLen;
              mech.mechanism = CKM_RSA_PKCS0x00000001UL;
              break;
          case CKK_DSA0x00000001UL:
              signature_length = DSA_MAX_SIGNATURE_LEN(32 * 2);
              pairwise_digest_length = subPrimeLen;
              mech.mechanism = CKM_DSA0x00000011UL;
              break;
          case CKK_EC0x00000003UL:
              signature_length = MAX_ECKEY_LEN72 * 2;
              mech.mechanism = CKM_ECDSA0x00001041UL;
              break;
          case CKK_EC_EDWARDS0x00000040UL:
              signature_length = ED25519_SIGN_LEN64U;
              mech.mechanism = CKM_EDDSA0x00001057UL;
              break;
          default:
              return CKR_DEVICE_ERROR0x00000030UL;
      }

      /* Allocate space for signature data. */
      signature = (unsigned char *)PORT_ZAllocPORT_ZAlloc_Util(signature_length);
      if (signature == NULL((void*)0)) {
          return CKR_HOST_MEMORY0x00000002UL;
      }

      /* Sign the known hash using the private key. */
      crv = NSC_SignInit(hSession, &mech, privateKey->handle);
      if (crv != CKR_OK0x00000000UL) {
          PORT_FreePORT_Free_Util(signature);
          return crv;
      }

      crv = NSC_Sign(hSession,
                     known_digest,
                     pairwise_digest_length,
                     signature,
                     &signature_length);
      if (crv != CKR_OK0x00000000UL) {
          PORT_FreePORT_Free_Util(signature);
          return crv;
      }

      /* detect trivial signing transforms */
      if ((signature_length >= pairwise_digest_length) &&
          (PORT_Memcmpmemcmp(known_digest, signature + (signature_length - pairwise_digest_length), pairwise_digest_length) == 0)) {
          PORT_FreePORT_Free_Util(signature);
          return CKR_DEVICE_ERROR0x00000030UL;
      }

      /* Verify the known hash using the public key. */
      crv = NSC_VerifyInit(hSession, &mech, publicKey->handle);
      if (crv != CKR_OK0x00000000UL) {
          PORT_FreePORT_Free_Util(signature);
          return crv;
      }

      crv = NSC_Verify(hSession,
                       known_digest,
                       pairwise_digest_length,
                       signature,
                       signature_length);

      /* Free signature data. */
      PORT_FreePORT_Free_Util(signature);

      if ((crv == CKR_SIGNATURE_LEN_RANGE0x000000C1UL) ||
          (crv == CKR_SIGNATURE_INVALID0x000000C0UL)) {
          return CKR_GENERAL_ERROR0x00000005UL;
      }
      if (crv != CKR_OK0x00000000UL) {
          return crv;
      }
  }

  /**********************************************/
  /* Pairwise Consistency Check for Derivation  */
  /**********************************************/

  isDerivable = sftk_isTrue(privateKey, CKA_DERIVE0x0000010CUL);

  if (isDerivable) {
      SFTKAttribute *pubAttribute = NULL((void*)0);
      CK_OBJECT_HANDLE newKey;
      PRBool isFIPS = sftk_isFIPS(slot->slotID)(((slot->slotID) == 3) || ((slot->slotID) >= 101));
      CK_RV crv2;
      CK_OBJECT_CLASS secret = CKO_SECRET_KEY0x00000004UL;
      CK_KEY_TYPE generic = CKK_GENERIC_SECRET0x00000010UL;
      CK_ULONG keyLen = 128;
      CK_BBOOL ckTrue = CK_TRUE1;
      CK_ATTRIBUTE template[] = {
          { CKA_CLASS0x00000000UL, &secret, sizeof(secret) },
          { CKA_KEY_TYPE0x00000100UL, &generic, sizeof(generic) },
          { CKA_VALUE_LEN0x00000161UL, &keyLen, sizeof(keyLen) },
          { CKA_DERIVE0x0000010CUL, &ckTrue, sizeof(ckTrue) }
      };
      CK_ULONG templateCount = PR_ARRAY_SIZE(template)(sizeof(template)/sizeof((template)[0]));
      CK_ECDH1_DERIVE_PARAMS ecParams;

      crv = CKR_OK0x00000000UL; /*paranoia, already get's set before we drop to the end */
      /* FIPS 140-2 requires we verify that the resulting key is a valid key.
       * The easiest way to do this is to do a derive operation, which checks
       * the validity of the key */

      switch (keyType) {
          case CKK_DH0x00000002UL:
              mech.mechanism = CKM_DH_PKCS_DERIVE0x00000021UL;
              pubAttribute = sftk_FindAttribute(publicKey, CKA_VALUE0x00000011UL);
              if (pubAttribute == NULL((void*)0)) {
                  return CKR_DEVICE_ERROR0x00000030UL;
              }
              mech.pParameter = pubAttribute->attrib.pValue;
              mech.ulParameterLen = pubAttribute->attrib.ulValueLen;
              break;
          case CKK_EC0x00000003UL:
              mech.mechanism = CKM_ECDH1_DERIVE0x00001050UL;
              pubAttribute = sftk_FindAttribute(publicKey, CKA_EC_POINT0x00000181UL);
              if (pubAttribute == NULL((void*)0)) {
                  return CKR_DEVICE_ERROR0x00000030UL;
              }
              ecParams.kdf = CKD_NULL0x00000001UL;
              ecParams.ulSharedDataLen = 0;
              ecParams.pSharedData = NULL((void*)0);
              ecParams.ulPublicDataLen = pubAttribute->attrib.ulValueLen;
              ecParams.pPublicData = pubAttribute->attrib.pValue;
              mech.pParameter = &ecParams;
              mech.ulParameterLen = sizeof(ecParams);
              break;
          default:
              return CKR_DEVICE_ERROR0x00000030UL;
      }

      crv = NSC_DeriveKey(hSession, &mech, privateKey->handle, template, templateCount, &newKey);
      if (crv != CKR_OK0x00000000UL) {
          sftk_FreeAttribute(pubAttribute);
          return crv;
      }
      /* FIPS requires full validation, but in fipx mode NSC_Derive
       * only does partial validation with approved primes, now handle
       * full validation */
      if (isFIPS && keyType == CKK_DH0x00000002UL) {
          SECItem pubKey;
          SECItem prime;
          SECItem subPrime;
          const SECItem *subPrimePtr = &subPrime;

          pubKey.data = pubAttribute->attrib.pValue;
          pubKey.len = pubAttribute->attrib.ulValueLen;
          prime.data = subPrime.data = NULL((void*)0);
          prime.len = subPrime.len = 0;
          crv = sftk_Attribute2SecItem(NULL((void*)0), &prime, privateKey, CKA_PRIME0x00000130UL);
          if (crv != CKR_OK0x00000000UL) {
              goto done;
          }
          crv = sftk_Attribute2SecItem(NULL((void*)0), &prime, privateKey, CKA_PRIME0x00000130UL);
          /* we ignore the return code an only look at the length */
          if (subPrime.len == 0) {
              /* subprime not supplied, In this case look it up.
               * This only works with approved primes, but in FIPS mode
               * that's the only kine of prime that will get here */
              subPrimePtr = sftk_VerifyDH_Prime(&prime, isFIPS);
              if (subPrimePtr == NULL((void*)0)) {
                  crv = CKR_GENERAL_ERROR0x00000005UL;
                  goto done;
              }
          }
          if (!KEA_Verify(&pubKey, &prime, (SECItem *)subPrimePtr)) {
              crv = CKR_GENERAL_ERROR0x00000005UL;
          }
      done:
          SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&subPrime, PR_FALSE0);
          SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&prime, PR_FALSE0);
      }
      /* clean up before we return */
      sftk_FreeAttribute(pubAttribute);
      crv2 = NSC_DestroyObject(hSession, newKey);
      if (crv != CKR_OK0x00000000UL) {
          return crv;
      }
      if (crv2 != CKR_OK0x00000000UL) {
          return crv2;
      }
  }

  return CKR_OK0x00000000UL;
5300}

5302/* NSC_GenerateKeyPair generates a public-key/private-key pair,
* creating new key objects. */
5304CK_RV
5305NSC_GenerateKeyPair(CK_SESSION_HANDLE hSession,
                  CK_MECHANISM_PTR pMechanism, CK_ATTRIBUTE_PTR pPublicKeyTemplate,
                  CK_ULONG ulPublicKeyAttributeCount, CK_ATTRIBUTE_PTR pPrivateKeyTemplate,
                  CK_ULONG ulPrivateKeyAttributeCount, CK_OBJECT_HANDLE_PTR phPublicKey,
                  CK_OBJECT_HANDLE_PTR phPrivateKey)
5310{
  SFTKObject *publicKey, *privateKey;
  SFTKSession *session;
  CK_KEY_TYPE key_type;
  CK_RV crv = CKR_OK0x00000000UL;
  CK_BBOOL cktrue = CK_TRUE1;
  SECStatus rv;
  CK_OBJECT_CLASS pubClass = CKO_PUBLIC_KEY0x00000002UL;
  CK_OBJECT_CLASS privClass = CKO_PRIVATE_KEY0x00000003UL;
  int i;
  SFTKSlot *slot = sftk_SlotFromSessionHandle(hSession);
  unsigned int bitSize;

  /* RSA */
  int public_modulus_bits = 0;
  SECItem pubExp;
  RSAPrivateKey *rsaPriv;

  /* DSA */
  PQGParams pqgParam;
  DHParams dhParam;
  DSAPrivateKey *dsaPriv;

  /* Diffie Hellman */
  DHPrivateKey *dhPriv;

  /* Elliptic Curve Cryptography */
  SECItem ecEncodedParams; /* DER Encoded parameters */
  ECPrivateKey *ecPriv;
  ECParams *ecParams;

  /* Kyber */
  CK_NSS_KEM_PARAMETER_SET_TYPE ckKyberParamSet;

  CHECK_FORK();

  if (!slot) {
      return CKR_SESSION_HANDLE_INVALID0x000000B3UL;
  }
  /*
   * now lets create an object to hang the attributes off of
   */
  publicKey = sftk_NewObject(slot); /* fill in the handle later */
  if (publicKey == NULL((void*)0)) {
      return CKR_HOST_MEMORY0x00000002UL;
  }

  /*
   * load the template values into the publicKey
   */
  for (i = 0; i < (int)ulPublicKeyAttributeCount; i++) {
      if (pPublicKeyTemplate[i].type == CKA_MODULUS_BITS0x00000121UL) {
          public_modulus_bits = *(CK_ULONG *)pPublicKeyTemplate[i].pValue;
          continue;
      }

      if (pPublicKeyTemplate[i].type == CKA_NSS_PARAMETER_SET((0x80000000UL | 0x4E534350) + 40)) {
          ckKyberParamSet = *(CK_NSS_KEM_PARAMETER_SET_TYPE *)pPublicKeyTemplate[i].pValue;
          continue;
      }

      crv = sftk_AddAttributeType(publicKey,
                                  sftk_attr_expand(&pPublicKeyTemplate[i])(&pPublicKeyTemplate[i])->type, (&pPublicKeyTemplate
[i])->pValue, (&pPublicKeyTemplate[i])->ulValueLen);
      if (crv != CKR_OK0x00000000UL)
          break;
  }

  if (crv != CKR_OK0x00000000UL) {
      sftk_FreeObject(publicKey);
      return CKR_HOST_MEMORY0x00000002UL;
  }

  privateKey = sftk_NewObject(slot); /* fill in the handle later */
  if (privateKey == NULL((void*)0)) {
      sftk_FreeObject(publicKey);
      return CKR_HOST_MEMORY0x00000002UL;
  }
  /*
   * now load the private key template
   */
  for (i = 0; i < (int)ulPrivateKeyAttributeCount; i++) {
      if (pPrivateKeyTemplate[i].type == CKA_VALUE_BITS0x00000160UL) {
          continue;
      }

      crv = sftk_AddAttributeType(privateKey,
                                  sftk_attr_expand(&pPrivateKeyTemplate[i])(&pPrivateKeyTemplate[i])->type, (&pPrivateKeyTemplate
[i])->pValue, (&pPrivateKeyTemplate[i])->ulValueLen);
      if (crv != CKR_OK0x00000000UL)
          break;
  }

  if (crv != CKR_OK0x00000000UL) {
      sftk_FreeObject(publicKey);
      sftk_FreeObject(privateKey);
      return CKR_HOST_MEMORY0x00000002UL;
  }
  sftk_DeleteAttributeType(privateKey, CKA_CLASS0x00000000UL);
  sftk_DeleteAttributeType(privateKey, CKA_KEY_TYPE0x00000100UL);
  sftk_DeleteAttributeType(privateKey, CKA_VALUE0x00000011UL);
  sftk_DeleteAttributeType(publicKey, CKA_CLASS0x00000000UL);
  sftk_DeleteAttributeType(publicKey, CKA_KEY_TYPE0x00000100UL);
  sftk_DeleteAttributeType(publicKey, CKA_VALUE0x00000011UL);

  /* Now Set up the parameters to generate the key (based on mechanism) */
  switch (pMechanism->mechanism) {
      case CKM_RSA_PKCS_KEY_PAIR_GEN0x00000000UL:
          /* format the keys */
          sftk_DeleteAttributeType(publicKey, CKA_MODULUS0x00000120UL);
          sftk_DeleteAttributeType(privateKey, CKA_NSS_DB0xD5A0DB00L);
          sftk_DeleteAttributeType(privateKey, CKA_MODULUS0x00000120UL);
          sftk_DeleteAttributeType(privateKey, CKA_PRIVATE_EXPONENT0x00000123UL);
          sftk_DeleteAttributeType(privateKey, CKA_PUBLIC_EXPONENT0x00000122UL);
          sftk_DeleteAttributeType(privateKey, CKA_PRIME_10x00000124UL);
          sftk_DeleteAttributeType(privateKey, CKA_PRIME_20x00000125UL);
          sftk_DeleteAttributeType(privateKey, CKA_EXPONENT_10x00000126UL);
          sftk_DeleteAttributeType(privateKey, CKA_EXPONENT_20x00000127UL);
          sftk_DeleteAttributeType(privateKey, CKA_COEFFICIENT0x00000128UL);
          key_type = CKK_RSA0x00000000UL;
          if (public_modulus_bits == 0) {
              crv = CKR_TEMPLATE_INCOMPLETE0x000000D0UL;
              break;
          }
          if (public_modulus_bits < RSA_MIN_MODULUS_BITS128) {
              crv = CKR_ATTRIBUTE_VALUE_INVALID0x00000013UL;
              break;
          }
          if (public_modulus_bits % 2 != 0) {
              crv = CKR_ATTRIBUTE_VALUE_INVALID0x00000013UL;
              break;
          }

          /* extract the exponent */
          crv = sftk_Attribute2SSecItem(NULL((void*)0), &pubExp, publicKey, CKA_PUBLIC_EXPONENT0x00000122UL);
          if (crv != CKR_OK0x00000000UL)
              break;
          bitSize = sftk_GetLengthInBits(pubExp.data, pubExp.len);
          if (bitSize < 2) {
              crv = CKR_ATTRIBUTE_VALUE_INVALID0x00000013UL;
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pubExp, PR_FALSE0);
              break;
          }
          crv = sftk_AddAttributeType(privateKey, CKA_PUBLIC_EXPONENT0x00000122UL,
                                      sftk_item_expand(&pubExp)(&pubExp)->data, (&pubExp)->len);
          if (crv != CKR_OK0x00000000UL) {
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pubExp, PR_FALSE0);
              break;
          }

          rsaPriv = RSA_NewKey(public_modulus_bits, &pubExp);
          SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pubExp, PR_FALSE0);
          if (rsaPriv == NULL((void*)0)) {
              if (PORT_GetErrorPORT_GetError_Util() == SEC_ERROR_LIBRARY_FAILURE) {
                  sftk_fatalError = PR_TRUE1;
              }
              crv = sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
              break;
          }
          /* now fill in the RSA dependent paramenters in the public key */
          crv = sftk_AddAttributeType(publicKey, CKA_MODULUS0x00000120UL,
                                      sftk_item_expand(&rsaPriv->modulus)(&rsaPriv->modulus)->data, (&rsaPriv->modulus
)->len);
          if (crv != CKR_OK0x00000000UL)
              goto kpg_done;
          /* now fill in the RSA dependent paramenters in the private key */
          crv = sftk_AddAttributeType(privateKey, CKA_NSS_DB0xD5A0DB00L,
                                      sftk_item_expand(&rsaPriv->modulus)(&rsaPriv->modulus)->data, (&rsaPriv->modulus
)->len);
          if (crv != CKR_OK0x00000000UL)
              goto kpg_done;
          crv = sftk_AddAttributeType(privateKey, CKA_MODULUS0x00000120UL,
                                      sftk_item_expand(&rsaPriv->modulus)(&rsaPriv->modulus)->data, (&rsaPriv->modulus
)->len);
          if (crv != CKR_OK0x00000000UL)
              goto kpg_done;
          crv = sftk_AddAttributeType(privateKey, CKA_PRIVATE_EXPONENT0x00000123UL,
                                      sftk_item_expand(&rsaPriv->privateExponent)(&rsaPriv->privateExponent)->data, (&rsaPriv->
privateExponent)->len);
          if (crv != CKR_OK0x00000000UL)
              goto kpg_done;
          crv = sftk_AddAttributeType(privateKey, CKA_PRIME_10x00000124UL,
                                      sftk_item_expand(&rsaPriv->prime1)(&rsaPriv->prime1)->data, (&rsaPriv->prime1)
->len);
          if (crv != CKR_OK0x00000000UL)
              goto kpg_done;
          crv = sftk_AddAttributeType(privateKey, CKA_PRIME_20x00000125UL,
                                      sftk_item_expand(&rsaPriv->prime2)(&rsaPriv->prime2)->data, (&rsaPriv->prime2)
->len);
          if (crv != CKR_OK0x00000000UL)
              goto kpg_done;
          crv = sftk_AddAttributeType(privateKey, CKA_EXPONENT_10x00000126UL,
                                      sftk_item_expand(&rsaPriv->exponent1)(&rsaPriv->exponent1)->data, (&rsaPriv->exponent1
)->len);
          if (crv != CKR_OK0x00000000UL)
              goto kpg_done;
          crv = sftk_AddAttributeType(privateKey, CKA_EXPONENT_20x00000127UL,
                                      sftk_item_expand(&rsaPriv->exponent2)(&rsaPriv->exponent2)->data, (&rsaPriv->exponent2
)->len);
          if (crv != CKR_OK0x00000000UL)
              goto kpg_done;
          crv = sftk_AddAttributeType(privateKey, CKA_COEFFICIENT0x00000128UL,
                                      sftk_item_expand(&rsaPriv->coefficient)(&rsaPriv->coefficient)->data, (&rsaPriv->coefficient
)->len);
      kpg_done:
          /* Should zeroize the contents first, since this func doesn't. */
          PORT_FreeArenaPORT_FreeArena_Util(rsaPriv->arena, PR_TRUE1);
          break;
      case CKM_DSA_KEY_PAIR_GEN0x00000010UL:
          sftk_DeleteAttributeType(publicKey, CKA_VALUE0x00000011UL);
          sftk_DeleteAttributeType(privateKey, CKA_NSS_DB0xD5A0DB00L);
          sftk_DeleteAttributeType(privateKey, CKA_PRIME0x00000130UL);
          sftk_DeleteAttributeType(privateKey, CKA_SUBPRIME0x00000131UL);
          sftk_DeleteAttributeType(privateKey, CKA_BASE0x00000132UL);
          key_type = CKK_DSA0x00000001UL;

          /* extract the necessary parameters and copy them to the private key */
          crv = sftk_Attribute2SSecItem(NULL((void*)0), &pqgParam.prime, publicKey, CKA_PRIME0x00000130UL);
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_Attribute2SSecItem(NULL((void*)0), &pqgParam.subPrime, publicKey,
                                        CKA_SUBPRIME0x00000131UL);
          if (crv != CKR_OK0x00000000UL) {
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.prime, PR_FALSE0);
              break;
          }
          crv = sftk_Attribute2SSecItem(NULL((void*)0), &pqgParam.base, publicKey, CKA_BASE0x00000132UL);
          if (crv != CKR_OK0x00000000UL) {
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.prime, PR_FALSE0);
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.subPrime, PR_FALSE0);
              break;
          }
          crv = sftk_AddAttributeType(privateKey, CKA_PRIME0x00000130UL,
                                      sftk_item_expand(&pqgParam.prime)(&pqgParam.prime)->data, (&pqgParam.prime)->len);
          if (crv != CKR_OK0x00000000UL) {
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.prime, PR_FALSE0);
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.subPrime, PR_FALSE0);
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.base, PR_FALSE0);
              break;
          }
          crv = sftk_AddAttributeType(privateKey, CKA_SUBPRIME0x00000131UL,
                                      sftk_item_expand(&pqgParam.subPrime)(&pqgParam.subPrime)->data, (&pqgParam.subPrime)->
len);
          if (crv != CKR_OK0x00000000UL) {
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.prime, PR_FALSE0);
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.subPrime, PR_FALSE0);
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.base, PR_FALSE0);
              break;
          }
          crv = sftk_AddAttributeType(privateKey, CKA_BASE0x00000132UL,
                                      sftk_item_expand(&pqgParam.base)(&pqgParam.base)->data, (&pqgParam.base)->len);
          if (crv != CKR_OK0x00000000UL) {
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.prime, PR_FALSE0);
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.subPrime, PR_FALSE0);
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.base, PR_FALSE0);
              break;
          }

          /*
           * these are checked by DSA_NewKey
           */
          bitSize = sftk_GetLengthInBits(pqgParam.subPrime.data,
                                         pqgParam.subPrime.len);
          if ((bitSize < DSA_MIN_Q_BITS160) || (bitSize > DSA_MAX_Q_BITS256)) {
              crv = CKR_TEMPLATE_INCOMPLETE0x000000D0UL;
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.prime, PR_FALSE0);
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.subPrime, PR_FALSE0);
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.base, PR_FALSE0);
              break;
          }
          bitSize = sftk_GetLengthInBits(pqgParam.prime.data, pqgParam.prime.len);
          if ((bitSize < DSA_MIN_P_BITS512) || (bitSize > DSA_MAX_P_BITS3072)) {
              crv = CKR_TEMPLATE_INCOMPLETE0x000000D0UL;
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.prime, PR_FALSE0);
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.subPrime, PR_FALSE0);
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.base, PR_FALSE0);
              break;
          }
          bitSize = sftk_GetLengthInBits(pqgParam.base.data, pqgParam.base.len);
          if ((bitSize < 2) || (bitSize > DSA_MAX_P_BITS3072)) {
              crv = CKR_TEMPLATE_INCOMPLETE0x000000D0UL;
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.prime, PR_FALSE0);
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.subPrime, PR_FALSE0);
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.base, PR_FALSE0);
              break;
          }

          /* Generate the key */
          rv = DSA_NewKey(&pqgParam, &dsaPriv);

          SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.prime, PR_FALSE0);
          SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.subPrime, PR_FALSE0);
          SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&pqgParam.base, PR_FALSE0);

          if (rv != SECSuccess) {
              if (PORT_GetErrorPORT_GetError_Util() == SEC_ERROR_LIBRARY_FAILURE) {
                  sftk_fatalError = PR_TRUE1;
              }
              crv = sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
              break;
          }

          /* store the generated key into the attributes */
          crv = sftk_AddAttributeType(publicKey, CKA_VALUE0x00000011UL,
                                      sftk_item_expand(&dsaPriv->publicValue)(&dsaPriv->publicValue)->data, (&dsaPriv->publicValue
)->len);
          if (crv != CKR_OK0x00000000UL)
              goto dsagn_done;

          /* now fill in the RSA dependent paramenters in the private key */
          crv = sftk_AddAttributeType(privateKey, CKA_NSS_DB0xD5A0DB00L,
                                      sftk_item_expand(&dsaPriv->publicValue)(&dsaPriv->publicValue)->data, (&dsaPriv->publicValue
)->len);
          if (crv != CKR_OK0x00000000UL)
              goto dsagn_done;
          crv = sftk_AddAttributeType(privateKey, CKA_VALUE0x00000011UL,
                                      sftk_item_expand(&dsaPriv->privateValue)(&dsaPriv->privateValue)->data, (&dsaPriv->privateValue
)->len);

      dsagn_done:
          /* should zeroize, since this function doesn't. */
          PORT_FreeArenaPORT_FreeArena_Util(dsaPriv->params.arena, PR_TRUE1);
          break;

      case CKM_DH_PKCS_KEY_PAIR_GEN0x00000020UL:
          sftk_DeleteAttributeType(privateKey, CKA_PRIME0x00000130UL);
          sftk_DeleteAttributeType(privateKey, CKA_BASE0x00000132UL);
          sftk_DeleteAttributeType(privateKey, CKA_VALUE0x00000011UL);
          sftk_DeleteAttributeType(privateKey, CKA_NSS_DB0xD5A0DB00L);
          key_type = CKK_DH0x00000002UL;

          /* extract the necessary parameters and copy them to private keys */
          crv = sftk_Attribute2SSecItem(NULL((void*)0), &dhParam.prime, publicKey,
                                        CKA_PRIME0x00000130UL);
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_Attribute2SSecItem(NULL((void*)0), &dhParam.base, publicKey, CKA_BASE0x00000132UL);
          if (crv != CKR_OK0x00000000UL) {
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhParam.prime, PR_FALSE0);
              break;
          }
          crv = sftk_AddAttributeType(privateKey, CKA_PRIME0x00000130UL,
                                      sftk_item_expand(&dhParam.prime)(&dhParam.prime)->data, (&dhParam.prime)->len);
          if (crv != CKR_OK0x00000000UL) {
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhParam.prime, PR_FALSE0);
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhParam.base, PR_FALSE0);
              break;
          }
          crv = sftk_AddAttributeType(privateKey, CKA_BASE0x00000132UL,
                                      sftk_item_expand(&dhParam.base)(&dhParam.base)->data, (&dhParam.base)->len);
          if (crv != CKR_OK0x00000000UL) {
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhParam.prime, PR_FALSE0);
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhParam.base, PR_FALSE0);
              break;
          }
          bitSize = sftk_GetLengthInBits(dhParam.prime.data, dhParam.prime.len);
          if ((bitSize < DH_MIN_P_BITS128) || (bitSize > DH_MAX_P_BITS16384)) {
              crv = CKR_TEMPLATE_INCOMPLETE0x000000D0UL;
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhParam.prime, PR_FALSE0);
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhParam.base, PR_FALSE0);
              break;
          }
          bitSize = sftk_GetLengthInBits(dhParam.base.data, dhParam.base.len);
          if ((bitSize < 1) || (bitSize > DH_MAX_P_BITS16384)) {
              crv = CKR_TEMPLATE_INCOMPLETE0x000000D0UL;
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhParam.prime, PR_FALSE0);
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhParam.base, PR_FALSE0);
              break;
          }

          rv = DH_NewKey(&dhParam, &dhPriv);
          SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhParam.prime, PR_FALSE0);
          SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhParam.base, PR_FALSE0);
          if (rv != SECSuccess) {
              if (PORT_GetErrorPORT_GetError_Util() == SEC_ERROR_LIBRARY_FAILURE) {
                  sftk_fatalError = PR_TRUE1;
              }
              crv = sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
              break;
          }

          crv = sftk_AddAttributeType(publicKey, CKA_VALUE0x00000011UL,
                                      sftk_item_expand(&dhPriv->publicValue)(&dhPriv->publicValue)->data, (&dhPriv->publicValue
)->len);
          if (crv != CKR_OK0x00000000UL)
              goto dhgn_done;

          crv = sftk_AddAttributeType(privateKey, CKA_NSS_DB0xD5A0DB00L,
                                      sftk_item_expand(&dhPriv->publicValue)(&dhPriv->publicValue)->data, (&dhPriv->publicValue
)->len);
          if (crv != CKR_OK0x00000000UL)
              goto dhgn_done;

          crv = sftk_AddAttributeType(privateKey, CKA_VALUE0x00000011UL,
                                      sftk_item_expand(&dhPriv->privateValue)(&dhPriv->privateValue)->data, (&dhPriv->privateValue
)->len);

      dhgn_done:
          /* should zeroize, since this function doesn't. */
          PORT_FreeArenaPORT_FreeArena_Util(dhPriv->arena, PR_TRUE1);
          break;

      case CKM_EC_KEY_PAIR_GEN0x00001040UL:
          sftk_DeleteAttributeType(privateKey, CKA_EC_PARAMS0x00000180UL);
          sftk_DeleteAttributeType(privateKey, CKA_VALUE0x00000011UL);
          sftk_DeleteAttributeType(privateKey, CKA_NSS_DB0xD5A0DB00L);
          key_type = CKK_EC0x00000003UL;

          /* extract the necessary parameters and copy them to private keys */
          crv = sftk_Attribute2SSecItem(NULL((void*)0), &ecEncodedParams, publicKey,
                                        CKA_EC_PARAMS0x00000180UL);
          if (crv != CKR_OK0x00000000UL)
              break;

          crv = sftk_AddAttributeType(privateKey, CKA_EC_PARAMS0x00000180UL,
                                      sftk_item_expand(&ecEncodedParams)(&ecEncodedParams)->data, (&ecEncodedParams)->len);
          if (crv != CKR_OK0x00000000UL) {
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&ecEncodedParams, PR_FALSE0);
              break;
          }

          /* Decode ec params before calling EC_NewKey */
          rv = EC_DecodeParams(&ecEncodedParams, &ecParams);
          SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&ecEncodedParams, PR_FALSE0);
          if (rv != SECSuccess) {
              crv = sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
              break;
          }
          rv = EC_NewKey(ecParams, &ecPriv);
          if (rv != SECSuccess) {
              if (PORT_GetErrorPORT_GetError_Util() == SEC_ERROR_LIBRARY_FAILURE) {
                  sftk_fatalError = PR_TRUE1;
              }
              PORT_FreeArenaPORT_FreeArena_Util(ecParams->arena, PR_TRUE1);
              crv = sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
              break;
          }

          if (PR_GetEnvSecure("NSS_USE_DECODED_CKA_EC_POINT") ||
              ecParams->type != ec_params_named) {
              PORT_FreeArenaPORT_FreeArena_Util(ecParams->arena, PR_TRUE1);
              crv = sftk_AddAttributeType(publicKey, CKA_EC_POINT0x00000181UL,
                                          sftk_item_expand(&ecPriv->publicValue)(&ecPriv->publicValue)->data, (&ecPriv->publicValue
)->len);
          } else {
              PORT_FreeArenaPORT_FreeArena_Util(ecParams->arena, PR_TRUE1);
              SECItem *pubValue = SEC_ASN1EncodeItemSEC_ASN1EncodeItem_Util(NULL((void*)0), NULL((void*)0),
                                                     &ecPriv->publicValue,
                                                     SEC_ASN1_GET(SEC_OctetStringTemplate)SEC_OctetStringTemplate_Util);
              if (!pubValue) {
                  crv = CKR_ARGUMENTS_BAD0x00000007UL;
                  goto ecgn_done;
              }
              crv = sftk_AddAttributeType(publicKey, CKA_EC_POINT0x00000181UL,
                                          sftk_item_expand(pubValue)(pubValue)->data, (pubValue)->len);
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(pubValue, PR_TRUE1);
          }
          if (crv != CKR_OK0x00000000UL)
              goto ecgn_done;

          crv = sftk_AddAttributeType(privateKey, CKA_VALUE0x00000011UL,
                                      sftk_item_expand(&ecPriv->privateValue)(&ecPriv->privateValue)->data, (&ecPriv->privateValue
)->len);
          if (crv != CKR_OK0x00000000UL)
              goto ecgn_done;

          crv = sftk_AddAttributeType(privateKey, CKA_NSS_DB0xD5A0DB00L,
                                      sftk_item_expand(&ecPriv->publicValue)(&ecPriv->publicValue)->data, (&ecPriv->publicValue
)->len);
      ecgn_done:
          /* should zeroize, since this function doesn't. */
          PORT_FreeArenaPORT_FreeArena_Util(ecPriv->ecParams.arena, PR_TRUE1);
          break;

      case CKM_NSS_KYBER_KEY_PAIR_GEN((0x80000000UL | 0x4E534350) + 45):
          sftk_DeleteAttributeType(privateKey, CKA_NSS_DB0xD5A0DB00L);
          key_type = CKK_NSS_KYBER((0x80000000UL | 0x4E534350) + 5);

          SECItem privKey = { siBuffer, NULL((void*)0), 0 };
          SECItem pubKey = { siBuffer, NULL((void*)0), 0 };
          KyberParams kyberParams = sftk_kyber_PK11ParamToInternal(ckKyberParamSet);
          if (!sftk_kyber_AllocPrivKeyItem(kyberParams, &privKey)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              goto kyber_done;
          }
          if (!sftk_kyber_AllocPubKeyItem(kyberParams, &pubKey)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              goto kyber_done;
          }
          rv = Kyber_NewKey(kyberParams, NULL((void*)0), &privKey, &pubKey);
          if (rv != SECSuccess) {
              crv = sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
              goto kyber_done;
          }

          crv = sftk_AddAttributeType(publicKey, CKA_VALUE0x00000011UL, sftk_item_expand(&pubKey)(&pubKey)->data, (&pubKey)->len);
          if (crv != CKR_OK0x00000000UL) {
              goto kyber_done;
          }
          crv = sftk_AddAttributeType(publicKey, CKA_NSS_PARAMETER_SET((0x80000000UL | 0x4E534350) + 40),
                                      &ckKyberParamSet, sizeof(CK_NSS_KEM_PARAMETER_SET_TYPE));
          if (crv != CKR_OK0x00000000UL) {
              goto kyber_done;
          }
          crv = sftk_AddAttributeType(privateKey, CKA_VALUE0x00000011UL,
                                      sftk_item_expand(&privKey)(&privKey)->data, (&privKey)->len);
          if (crv != CKR_OK0x00000000UL) {
              goto kyber_done;
          }
          crv = sftk_AddAttributeType(privateKey, CKA_NSS_PARAMETER_SET((0x80000000UL | 0x4E534350) + 40),
                                      &ckKyberParamSet, sizeof(CK_NSS_KEM_PARAMETER_SET_TYPE));
          if (crv != CKR_OK0x00000000UL) {
              goto kyber_done;
          }
          crv = sftk_AddAttributeType(privateKey, CKA_NSS_DB0xD5A0DB00L,
                                      sftk_item_expand(&pubKey)(&pubKey)->data, (&pubKey)->len);
      kyber_done:
          SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&privKey, PR_FALSE0);
          SECITEM_FreeItemSECITEM_FreeItem_Util(&pubKey, PR_FALSE0);
          break;

      case CKM_EC_EDWARDS_KEY_PAIR_GEN0x00001055UL:
          sftk_DeleteAttributeType(privateKey, CKA_EC_PARAMS0x00000180UL);
          sftk_DeleteAttributeType(privateKey, CKA_VALUE0x00000011UL);
          sftk_DeleteAttributeType(privateKey, CKA_NSS_DB0xD5A0DB00L);
          key_type = CKK_EC_EDWARDS0x00000040UL;

          /* extract the necessary parameters and copy them to private keys */
          crv = sftk_Attribute2SSecItem(NULL((void*)0), &ecEncodedParams, publicKey,
                                        CKA_EC_PARAMS0x00000180UL);
          if (crv != CKR_OK0x00000000UL) {
              break;
          }

          crv = sftk_AddAttributeType(privateKey, CKA_EC_PARAMS0x00000180UL,
                                      sftk_item_expand(&ecEncodedParams)(&ecEncodedParams)->data, (&ecEncodedParams)->len);
          if (crv != CKR_OK0x00000000UL) {
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&ecEncodedParams, PR_FALSE0);
              break;
          }

          /* Decode ec params before calling EC_NewKey */
          rv = EC_DecodeParams(&ecEncodedParams, &ecParams);
          SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&ecEncodedParams, PR_FALSE0);
          if (rv != SECSuccess) {
              crv = sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
              break;
          }

          rv = EC_NewKey(ecParams, &ecPriv);
          if (rv != SECSuccess) {
              if (PORT_GetErrorPORT_GetError_Util() == SEC_ERROR_LIBRARY_FAILURE) {
                  sftk_fatalError = PR_TRUE1;
              }
              PORT_FreeArenaPORT_FreeArena_Util(ecParams->arena, PR_TRUE1);
              crv = sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
              break;
          }
          PORT_FreeArenaPORT_FreeArena_Util(ecParams->arena, PR_TRUE1);
          crv = sftk_AddAttributeType(publicKey, CKA_EC_POINT0x00000181UL,
                                      sftk_item_expand(&ecPriv->publicValue)(&ecPriv->publicValue)->data, (&ecPriv->publicValue
)->len);
          if (crv != CKR_OK0x00000000UL)
              goto edgn_done;

          crv = sftk_AddAttributeType(privateKey, CKA_VALUE0x00000011UL,
                                      sftk_item_expand(&ecPriv->privateValue)(&ecPriv->privateValue)->data, (&ecPriv->privateValue
)->len);
          if (crv != CKR_OK0x00000000UL)
              goto edgn_done;

          crv = sftk_AddAttributeType(privateKey, CKA_NSS_DB0xD5A0DB00L,
                                      sftk_item_expand(&ecPriv->publicValue)(&ecPriv->publicValue)->data, (&ecPriv->publicValue
)->len);
      edgn_done:
          /* should zeroize, since this function doesn't. */
          PORT_FreeArenaPORT_FreeArena_Util(ecPriv->ecParams.arena, PR_TRUE1);
          break;

      default:
          crv = CKR_MECHANISM_INVALID0x00000070UL;
  }

  if (crv != CKR_OK0x00000000UL) {
      sftk_FreeObject(privateKey);
      sftk_FreeObject(publicKey);
      return crv;
  }

  /* Add the class, key_type The loop lets us check errors blow out
   *  on errors and clean up at the bottom */
  session = NULL((void*)0); /* make pedtantic happy... session cannot leave the*/
                  /* loop below NULL unless an error is set... */
  do {
      crv = sftk_AddAttributeType(privateKey, CKA_CLASS0x00000000UL, &privClass,
                                  sizeof(CK_OBJECT_CLASS));
      if (crv != CKR_OK0x00000000UL)
          break;
      crv = sftk_AddAttributeType(publicKey, CKA_CLASS0x00000000UL, &pubClass,
                                  sizeof(CK_OBJECT_CLASS));
      if (crv != CKR_OK0x00000000UL)
          break;
      crv = sftk_AddAttributeType(privateKey, CKA_KEY_TYPE0x00000100UL, &key_type,
                                  sizeof(CK_KEY_TYPE));
      if (crv != CKR_OK0x00000000UL)
          break;
      crv = sftk_AddAttributeType(publicKey, CKA_KEY_TYPE0x00000100UL, &key_type,
                                  sizeof(CK_KEY_TYPE));
      if (crv != CKR_OK0x00000000UL)
          break;
      session = sftk_SessionFromHandle(hSession);
      if (session == NULL((void*)0))
          crv = CKR_SESSION_HANDLE_INVALID0x000000B3UL;
  } while (0);

  if (crv != CKR_OK0x00000000UL) {
      sftk_FreeObject(privateKey);
      sftk_FreeObject(publicKey);
      return crv;
  }

  /*
   * handle the base object cleanup for the public Key
   */
  crv = sftk_handleObject(privateKey, session);
  if (crv != CKR_OK0x00000000UL) {
      sftk_FreeSession(session);
      sftk_FreeObject(privateKey);
      sftk_FreeObject(publicKey);
      return crv;
  }

  /*
   * handle the base object cleanup for the private Key
   * If we have any problems, we destroy the public Key we've
   * created and linked.
   */
  crv = sftk_handleObject(publicKey, session);
  sftk_FreeSession(session);
  if (crv != CKR_OK0x00000000UL) {
      sftk_FreeObject(publicKey);
      NSC_DestroyObject(hSession, privateKey->handle);
      sftk_FreeObject(privateKey);
      return crv;
  }
  if (sftk_isTrue(privateKey, CKA_SENSITIVE0x00000103UL)) {
      crv = sftk_forceAttribute(privateKey, CKA_ALWAYS_SENSITIVE0x00000165UL,
                                &cktrue, sizeof(CK_BBOOL));
  }
  if (crv == CKR_OK0x00000000UL && sftk_isTrue(publicKey, CKA_SENSITIVE0x00000103UL)) {
      crv = sftk_forceAttribute(publicKey, CKA_ALWAYS_SENSITIVE0x00000165UL,
                                &cktrue, sizeof(CK_BBOOL));
  }
  if (crv == CKR_OK0x00000000UL && !sftk_isTrue(privateKey, CKA_EXTRACTABLE0x00000162UL)) {
      crv = sftk_forceAttribute(privateKey, CKA_NEVER_EXTRACTABLE0x00000164UL,
                                &cktrue, sizeof(CK_BBOOL));
  }
  if (crv == CKR_OK0x00000000UL && !sftk_isTrue(publicKey, CKA_EXTRACTABLE0x00000162UL)) {
      crv = sftk_forceAttribute(publicKey, CKA_NEVER_EXTRACTABLE0x00000164UL,
                                &cktrue, sizeof(CK_BBOOL));
  }

  if (crv == CKR_OK0x00000000UL && key_type != CKK_NSS_KYBER((0x80000000UL | 0x4E534350) + 5)) {
      /* Perform FIPS 140-2 pairwise consistency check. */
      crv = sftk_PairwiseConsistencyCheck(hSession, slot,
                                          publicKey, privateKey, key_type);
      if (crv != CKR_OK0x00000000UL) {
          if (sftk_audit_enabled) {
              char msg[128];
              PR_snprintf(msg, sizeof msg,
                          "C_GenerateKeyPair(hSession=0x%08lX, "
                          "pMechanism->mechanism=0x%08lX)=0x%08lX "
                          "self-test: pair-wise consistency test failed",
                          (PRUint32)hSession, (PRUint32)pMechanism->mechanism,
                          (PRUint32)crv);
              sftk_LogAuditMessage(NSS_AUDIT_ERROR, NSS_AUDIT_SELF_TEST, msg);
          }
      }
  }

  if (crv != CKR_OK0x00000000UL) {
      NSC_DestroyObject(hSession, publicKey->handle);
      sftk_FreeObject(publicKey);
      NSC_DestroyObject(hSession, privateKey->handle);
      sftk_FreeObject(privateKey);
      return crv;
  }

  *phPrivateKey = privateKey->handle;
  *phPublicKey = publicKey->handle;
  sftk_FreeObject(publicKey);
  sftk_FreeObject(privateKey);

  return CKR_OK0x00000000UL;
5980}

5982static SECItem *
5983sftk_PackagePrivateKey(SFTKObject *key, CK_RV *crvp)
5984{
  NSSLOWKEYPrivateKey *lk = NULL((void*)0);
  NSSLOWKEYPrivateKeyInfo *pki = NULL((void*)0);
  SFTKAttribute *attribute = NULL((void*)0);
  PLArenaPool *arena = NULL((void*)0);
  SECOidTag algorithm = SEC_OID_UNKNOWN;
  void *dummy, *param = NULL((void*)0);
  SECStatus rv = SECSuccess;
  SECItem *encodedKey = NULL((void*)0);
5993#ifdef EC_DEBUG
  SECItem *fordebug;
5995#endif
  int savelen;

  if (!key) {
      *crvp = CKR_KEY_HANDLE_INVALID0x00000060UL; /* really can't happen */
      return NULL((void*)0);
  }

  attribute = sftk_FindAttribute(key, CKA_KEY_TYPE0x00000100UL);
  if (!attribute) {
      *crvp = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
      return NULL((void*)0);
  }

  lk = sftk_GetPrivKey(key, *(CK_KEY_TYPE *)attribute->attrib.pValue, crvp);
  sftk_FreeAttribute(attribute);
  if (!lk) {
      return NULL((void*)0);
  }

  arena = PORT_NewArenaPORT_NewArena_Util(2048); /* XXX different size? */
  if (!arena) {
      *crvp = CKR_HOST_MEMORY0x00000002UL;
      rv = SECFailure;
      goto loser;
  }

  pki = (NSSLOWKEYPrivateKeyInfo *)PORT_ArenaZAllocPORT_ArenaZAlloc_Util(arena,
                                                    sizeof(NSSLOWKEYPrivateKeyInfo));
  if (!pki) {
      *crvp = CKR_HOST_MEMORY0x00000002UL;
      rv = SECFailure;
      goto loser;
  }
  pki->arena = arena;

  param = NULL((void*)0);
  switch (lk->keyType) {
      case NSSLOWKEYRSAKey:
          prepare_low_rsa_priv_key_for_asn1(lk);
          dummy = SEC_ASN1EncodeItemSEC_ASN1EncodeItem_Util(arena, &pki->privateKey, lk,
                                     nsslowkey_RSAPrivateKeyTemplate);

          /* determine RSA key type from the CKA_PUBLIC_KEY_INFO if present */
          attribute = sftk_FindAttribute(key, CKA_PUBLIC_KEY_INFO0x00000129UL);
          if (attribute) {
              NSSLOWKEYSubjectPublicKeyInfo *publicKeyInfo;
              SECItem spki;

              spki.data = attribute->attrib.pValue;
              spki.len = attribute->attrib.ulValueLen;

              publicKeyInfo = PORT_ArenaZAllocPORT_ArenaZAlloc_Util(arena,
                                               sizeof(NSSLOWKEYSubjectPublicKeyInfo));
              if (!publicKeyInfo) {
                  sftk_FreeAttribute(attribute);
                  *crvp = CKR_HOST_MEMORY0x00000002UL;
                  rv = SECFailure;
                  goto loser;
              }
              rv = SEC_QuickDERDecodeItemSEC_QuickDERDecodeItem_Util(arena, publicKeyInfo,
                                          nsslowkey_SubjectPublicKeyInfoTemplate,
                                          &spki);
              if (rv != SECSuccess) {
                  sftk_FreeAttribute(attribute);
                  *crvp = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
                  goto loser;
              }
              algorithm = SECOID_GetAlgorithmTagSECOID_GetAlgorithmTag_Util(&publicKeyInfo->algorithm);
              if (algorithm != SEC_OID_PKCS1_RSA_ENCRYPTION &&
                  algorithm != SEC_OID_PKCS1_RSA_PSS_SIGNATURE) {
                  sftk_FreeAttribute(attribute);
                  rv = SECFailure;
                  *crvp = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
                  goto loser;
              }
              param = SECITEM_DupItemSECITEM_DupItem_Util(&publicKeyInfo->algorithm.parameters);
              if (!param) {
                  sftk_FreeAttribute(attribute);
                  rv = SECFailure;
                  *crvp = CKR_HOST_MEMORY0x00000002UL;
                  goto loser;
              }
              sftk_FreeAttribute(attribute);
          } else {
              /* default to PKCS #1 */
              algorithm = SEC_OID_PKCS1_RSA_ENCRYPTION;
          }
          break;
      case NSSLOWKEYDSAKey:
          prepare_low_dsa_priv_key_export_for_asn1(lk);
          dummy = SEC_ASN1EncodeItemSEC_ASN1EncodeItem_Util(arena, &pki->privateKey, lk,
                                     nsslowkey_DSAPrivateKeyExportTemplate);
          prepare_low_pqg_params_for_asn1(&lk->u.dsa.params);
          param = SEC_ASN1EncodeItemSEC_ASN1EncodeItem_Util(NULL((void*)0), NULL((void*)0), &(lk->u.dsa.params),
                                     nsslowkey_PQGParamsTemplate);
          algorithm = SEC_OID_ANSIX9_DSA_SIGNATURE;
          break;
      case NSSLOWKEYECKey:
          prepare_low_ec_priv_key_for_asn1(lk);
          /* Public value is encoded as a bit string so adjust length
           * to be in bits before ASN encoding and readjust
           * immediately after.
           *
           * Since the SECG specification recommends not including the
           * parameters as part of ECPrivateKey, we zero out the curveOID
           * length before encoding and restore it later.
           */
          lk->u.ec.publicValue.len <<= 3;
          savelen = lk->u.ec.ecParams.curveOID.len;
          lk->u.ec.ecParams.curveOID.len = 0;
          dummy = SEC_ASN1EncodeItemSEC_ASN1EncodeItem_Util(arena, &pki->privateKey, lk,
                                     nsslowkey_ECPrivateKeyTemplate);
          lk->u.ec.ecParams.curveOID.len = savelen;
          lk->u.ec.publicValue.len >>= 3;

6111#ifdef EC_DEBUG
          fordebug = &pki->privateKey;
          SEC_PRINT("sftk_PackagePrivateKey()", "PrivateKey", lk->keyType,
                    fordebug);
6115#endif

          param = SECITEM_DupItemSECITEM_DupItem_Util(&lk->u.ec.ecParams.DEREncoding);

          algorithm = SEC_OID_ANSIX962_EC_PUBLIC_KEY;
          break;
      case NSSLOWKEYDHKey:
      default:
          dummy = NULL((void*)0);
          break;
  }

  if (!dummy || ((lk->keyType == NSSLOWKEYDSAKey) && !param)) {
      *crvp = CKR_DEVICE_ERROR0x00000030UL; /* should map NSS SECError */
      rv = SECFailure;
      goto loser;
  }

  rv = SECOID_SetAlgorithmIDSECOID_SetAlgorithmID_Util(arena, &pki->algorithm, algorithm,
                             (SECItem *)param);
  if (rv != SECSuccess) {
      *crvp = CKR_DEVICE_ERROR0x00000030UL; /* should map NSS SECError */
      rv = SECFailure;
      goto loser;
  }

  dummy = SEC_ASN1EncodeIntegerSEC_ASN1EncodeInteger_Util(arena, &pki->version,
                                NSSLOWKEY_PRIVATE_KEY_INFO_VERSION0);
  if (!dummy) {
      *crvp = CKR_DEVICE_ERROR0x00000030UL; /* should map NSS SECError */
      rv = SECFailure;
      goto loser;
  }

  encodedKey = SEC_ASN1EncodeItemSEC_ASN1EncodeItem_Util(NULL((void*)0), NULL((void*)0), pki,
                                  nsslowkey_PrivateKeyInfoTemplate);
  *crvp = encodedKey ? CKR_OK0x00000000UL : CKR_DEVICE_ERROR0x00000030UL;

6153#ifdef EC_DEBUG
  fordebug = encodedKey;
  SEC_PRINT("sftk_PackagePrivateKey()", "PrivateKeyInfo", lk->keyType,
            fordebug);
6157#endif
6158loser:
  if (arena) {
      PORT_FreeArenaPORT_FreeArena_Util(arena, PR_TRUE1);
  }

  if (lk && (lk != key->objectInfo)) {
      nsslowkey_DestroyPrivateKey(lk);
  }

  if (param) {
      SECITEM_ZfreeItemSECITEM_ZfreeItem_Util((SECItem *)param, PR_TRUE1);
  }

  if (rv != SECSuccess) {
      return NULL((void*)0);
  }

  return encodedKey;
6176}

6178/* it doesn't matter yet, since we colapse error conditions in the
* level above, but we really should map those few key error differences */
6180static CK_RV
6181sftk_mapWrap(CK_RV crv)
6182{
  switch (crv) {
      case CKR_ENCRYPTED_DATA_INVALID0x00000040UL:
          crv = CKR_WRAPPED_KEY_INVALID0x00000110UL;
          break;
  }
  return crv;
6189}

6191/* NSC_WrapKey wraps (i.e., encrypts) a key. */
6192CK_RV
6193NSC_WrapKey(CK_SESSION_HANDLE hSession,
          CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hWrappingKey,
          CK_OBJECT_HANDLE hKey, CK_BYTE_PTR pWrappedKey,
          CK_ULONG_PTR pulWrappedKeyLen)
6197{
  SFTKSession *session;
  SFTKAttribute *attribute;
  SFTKObject *key;
  CK_RV crv;

  CHECK_FORK();

  session = sftk_SessionFromHandle(hSession);
  if (session == NULL((void*)0)) {
      return CKR_SESSION_HANDLE_INVALID0x000000B3UL;
  }

  key = sftk_ObjectFromHandle(hKey, session);
  if (key == NULL((void*)0)) {
      sftk_FreeSession(session);
      return CKR_KEY_HANDLE_INVALID0x00000060UL;
  }

  switch (key->objclass) {
      case CKO_SECRET_KEY0x00000004UL: {
          SFTKSessionContext *context = NULL((void*)0);
          SECItem pText;

          attribute = sftk_FindAttribute(key, CKA_VALUE0x00000011UL);

          if (attribute == NULL((void*)0)) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          crv = sftk_CryptInit(hSession, pMechanism, hWrappingKey,
                               CKA_WRAP0x00000106UL, CKA_WRAP0x00000106UL, SFTK_ENCRYPT, PR_TRUE1);
          if (crv != CKR_OK0x00000000UL) {
              sftk_FreeAttribute(attribute);
              break;
          }

          pText.type = siBuffer;
          pText.data = (unsigned char *)attribute->attrib.pValue;
          pText.len = attribute->attrib.ulValueLen;

          /* Find out if this is a block cipher. */
          crv = sftk_GetContext(hSession, &context, SFTK_ENCRYPT, PR_FALSE0, NULL((void*)0));
          if (crv != CKR_OK0x00000000UL || !context)
              break;
          if (context->blockSize > 1) {
              unsigned int remainder = pText.len % context->blockSize;
              if (!context->doPad && remainder) {
                  /* When wrapping secret keys with unpadded block ciphers,
                  ** the keys are zero padded, if necessary, to fill out
                  ** a full block.
                  */
                  pText.len += context->blockSize - remainder;
                  pText.data = PORT_ZAllocPORT_ZAlloc_Util(pText.len);
                  if (pText.data)
                      memcpy(pText.data, attribute->attrib.pValue,
                             attribute->attrib.ulValueLen);
                  else {
                      crv = CKR_HOST_MEMORY0x00000002UL;
                      break;
                  }
              }
          }

          crv = NSC_Encrypt(hSession, (CK_BYTE_PTR)pText.data,
                            pText.len, pWrappedKey, pulWrappedKeyLen);
          /* always force a finalize, both on errors and when
           * we are just getting the size */
          if (crv != CKR_OK0x00000000UL || pWrappedKey == NULL((void*)0)) {
              CK_RV lcrv;
              lcrv = sftk_GetContext(hSession, &context,
                                     SFTK_ENCRYPT, PR_FALSE0, NULL((void*)0));
              sftk_SetContextByType(session, SFTK_ENCRYPT, NULL((void*)0));
              if (lcrv == CKR_OK0x00000000UL && context) {
                  sftk_FreeContext(context);
              }
          }

          if (pText.data != (unsigned char *)attribute->attrib.pValue)
              PORT_ZFreePORT_ZFree_Util(pText.data, pText.len);
          sftk_FreeAttribute(attribute);
          break;
      }

      case CKO_PRIVATE_KEY0x00000003UL: {
          SECItem *bpki = sftk_PackagePrivateKey(key, &crv);
          SFTKSessionContext *context = NULL((void*)0);

          if (!bpki) {
              break;
          }

          crv = sftk_CryptInit(hSession, pMechanism, hWrappingKey,
                               CKA_WRAP0x00000106UL, CKA_WRAP0x00000106UL, SFTK_ENCRYPT, PR_TRUE1);
          if (crv != CKR_OK0x00000000UL) {
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(bpki, PR_TRUE1);
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }

          crv = NSC_Encrypt(hSession, bpki->data, bpki->len,
                            pWrappedKey, pulWrappedKeyLen);
          /* always force a finalize */
          if (crv != CKR_OK0x00000000UL || pWrappedKey == NULL((void*)0)) {
              CK_RV lcrv;
              lcrv = sftk_GetContext(hSession, &context,
                                     SFTK_ENCRYPT, PR_FALSE0, NULL((void*)0));
              sftk_SetContextByType(session, SFTK_ENCRYPT, NULL((void*)0));
              if (lcrv == CKR_OK0x00000000UL && context) {
                  sftk_FreeContext(context);
              }
          }
          SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(bpki, PR_TRUE1);
          break;
      }

      default:
          crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
          break;
  }
  sftk_FreeObject(key);
  sftk_FreeSession(session);
  return sftk_mapWrap(crv);
6320}

6322/*
* import a pprivate key info into the desired slot
*/
6325static SECStatus
6326sftk_unwrapPrivateKey(SFTKObject *key, SECItem *bpki)
6327{
  CK_BBOOL cktrue = CK_TRUE1;
  CK_KEY_TYPE keyType = CKK_RSA0x00000000UL;
  SECStatus rv = SECFailure;
  const SEC_ASN1Template *keyTemplate, *paramTemplate;
  void *paramDest = NULL((void*)0);
  PLArenaPool *arena;
  NSSLOWKEYPrivateKey *lpk = NULL((void*)0);
  NSSLOWKEYPrivateKeyInfo *pki = NULL((void*)0);
  CK_RV crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;

  arena = PORT_NewArenaPORT_NewArena_Util(2048);
  if (!arena) {
      return SECFailure;
  }

  pki = (NSSLOWKEYPrivateKeyInfo *)PORT_ArenaZAllocPORT_ArenaZAlloc_Util(arena,
                                                    sizeof(NSSLOWKEYPrivateKeyInfo));
  if (!pki) {
      PORT_FreeArenaPORT_FreeArena_Util(arena, PR_FALSE0);
      return SECFailure;
  }

  if (SEC_ASN1DecodeItemSEC_ASN1DecodeItem_Util(arena, pki, nsslowkey_PrivateKeyInfoTemplate, bpki) != SECSuccess) {
      PORT_FreeArenaPORT_FreeArena_Util(arena, PR_TRUE1);
      return SECFailure;
  }

  lpk = (NSSLOWKEYPrivateKey *)PORT_ArenaZAllocPORT_ArenaZAlloc_Util(arena,
                                                sizeof(NSSLOWKEYPrivateKey));
  if (lpk == NULL((void*)0)) {
      goto loser;
  }
  lpk->arena = arena;

  switch (SECOID_GetAlgorithmTagSECOID_GetAlgorithmTag_Util(&pki->algorithm)) {
      case SEC_OID_PKCS1_RSA_ENCRYPTION:
      case SEC_OID_PKCS1_RSA_PSS_SIGNATURE:
          keyTemplate = nsslowkey_RSAPrivateKeyTemplate;
          paramTemplate = NULL((void*)0);
          paramDest = NULL((void*)0);
          lpk->keyType = NSSLOWKEYRSAKey;
          prepare_low_rsa_priv_key_for_asn1(lpk);
          break;
      case SEC_OID_ANSIX9_DSA_SIGNATURE:
          keyTemplate = nsslowkey_DSAPrivateKeyExportTemplate;
          paramTemplate = nsslowkey_PQGParamsTemplate;
          paramDest = &(lpk->u.dsa.params);
          lpk->keyType = NSSLOWKEYDSAKey;
          prepare_low_dsa_priv_key_export_for_asn1(lpk);
          prepare_low_pqg_params_for_asn1(&lpk->u.dsa.params);
          break;
      /* case NSSLOWKEYDHKey: */
      case SEC_OID_ANSIX962_EC_PUBLIC_KEY:
          keyTemplate = nsslowkey_ECPrivateKeyTemplate;
          paramTemplate = NULL((void*)0);
          paramDest = &(lpk->u.ec.ecParams.DEREncoding);
          lpk->keyType = NSSLOWKEYECKey;
          prepare_low_ec_priv_key_for_asn1(lpk);
          prepare_low_ecparams_for_asn1(&lpk->u.ec.ecParams);
          break;
      default:
          keyTemplate = NULL((void*)0);
          paramTemplate = NULL((void*)0);
          paramDest = NULL((void*)0);
          break;
  }

  if (!keyTemplate) {
      goto loser;
  }

  /* decode the private key and any algorithm parameters */
  rv = SEC_QuickDERDecodeItemSEC_QuickDERDecodeItem_Util(arena, lpk, keyTemplate, &pki->privateKey);

  if (lpk->keyType == NSSLOWKEYECKey) {
      /* convert length in bits to length in bytes */
      lpk->u.ec.publicValue.len >>= 3;
      rv = SECITEM_CopyItemSECITEM_CopyItem_Util(arena,
                            &(lpk->u.ec.ecParams.DEREncoding),
                            &(pki->algorithm.parameters));
      if (rv != SECSuccess) {
          goto loser;
      }
  }

  if (rv != SECSuccess) {
      goto loser;
  }
  if (paramDest && paramTemplate) {
      rv = SEC_QuickDERDecodeItemSEC_QuickDERDecodeItem_Util(arena, paramDest, paramTemplate,
                                  &(pki->algorithm.parameters));
      if (rv != SECSuccess) {
          goto loser;
      }
  }

  rv = SECFailure;

  switch (lpk->keyType) {
      case NSSLOWKEYRSAKey:
          keyType = CKK_RSA0x00000000UL;
          if (sftk_hasAttribute(key, CKA_NSS_DB0xD5A0DB00L)) {
              sftk_DeleteAttributeType(key, CKA_NSS_DB0xD5A0DB00L);
          }
          crv = sftk_AddAttributeType(key, CKA_KEY_TYPE0x00000100UL, &keyType,
                                      sizeof(keyType));
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_UNWRAP0x00000107UL, &cktrue,
                                      sizeof(CK_BBOOL));
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_DECRYPT0x00000105UL, &cktrue,
                                      sizeof(CK_BBOOL));
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_SIGN0x00000108UL, &cktrue,
                                      sizeof(CK_BBOOL));
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_SIGN_RECOVER0x00000109UL, &cktrue,
                                      sizeof(CK_BBOOL));
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_MODULUS0x00000120UL,
                                      sftk_item_expand(&lpk->u.rsa.modulus)(&lpk->u.rsa.modulus)->data, (&lpk->u.rsa.modulus
)->len);
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_PUBLIC_EXPONENT0x00000122UL,
                                      sftk_item_expand(&lpk->u.rsa.publicExponent)(&lpk->u.rsa.publicExponent)->data, (&lpk->u
.rsa.publicExponent)->len);
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_PRIVATE_EXPONENT0x00000123UL,
                                      sftk_item_expand(&lpk->u.rsa.privateExponent)(&lpk->u.rsa.privateExponent)->data, (&lpk->
u.rsa.privateExponent)->len);
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_PRIME_10x00000124UL,
                                      sftk_item_expand(&lpk->u.rsa.prime1)(&lpk->u.rsa.prime1)->data, (&lpk->u.rsa.prime1
)->len);
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_PRIME_20x00000125UL,
                                      sftk_item_expand(&lpk->u.rsa.prime2)(&lpk->u.rsa.prime2)->data, (&lpk->u.rsa.prime2
)->len);
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_EXPONENT_10x00000126UL,
                                      sftk_item_expand(&lpk->u.rsa.exponent1)(&lpk->u.rsa.exponent1)->data, (&lpk->u.rsa.
exponent1)->len);
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_EXPONENT_20x00000127UL,
                                      sftk_item_expand(&lpk->u.rsa.exponent2)(&lpk->u.rsa.exponent2)->data, (&lpk->u.rsa.
exponent2)->len);
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_COEFFICIENT0x00000128UL,
                                      sftk_item_expand(&lpk->u.rsa.coefficient)(&lpk->u.rsa.coefficient)->data, (&lpk->u.rsa
.coefficient)->len);
          break;
      case NSSLOWKEYDSAKey:
          keyType = CKK_DSA0x00000001UL;
          crv = (sftk_hasAttribute(key, CKA_NSS_DB0xD5A0DB00L)) ? CKR_OK0x00000000UL : CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_KEY_TYPE0x00000100UL, &keyType,
                                      sizeof(keyType));
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_SIGN0x00000108UL, &cktrue,
                                      sizeof(CK_BBOOL));
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_SIGN_RECOVER0x00000109UL, &cktrue,
                                      sizeof(CK_BBOOL));
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_PRIME0x00000130UL,
                                      sftk_item_expand(&lpk->u.dsa.params.prime)(&lpk->u.dsa.params.prime)->data, (&lpk->u.dsa
.params.prime)->len);
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_SUBPRIME0x00000131UL,
                                      sftk_item_expand(&lpk->u.dsa.params.subPrime)(&lpk->u.dsa.params.subPrime)->data, (&lpk->
u.dsa.params.subPrime)->len);
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_BASE0x00000132UL,
                                      sftk_item_expand(&lpk->u.dsa.params.base)(&lpk->u.dsa.params.base)->data, (&lpk->u.dsa
.params.base)->len);
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_VALUE0x00000011UL,
                                      sftk_item_expand(&lpk->u.dsa.privateValue)(&lpk->u.dsa.privateValue)->data, (&lpk->u.dsa
.privateValue)->len);
          if (crv != CKR_OK0x00000000UL)
              break;
          break;
6517#ifdef notdef
      case NSSLOWKEYDHKey:
          template = dhTemplate;
          templateCount = sizeof(dhTemplate) / sizeof(CK_ATTRIBUTE);
          keyType = CKK_DH0x00000002UL;
          break;
6523#endif
      /* what about fortezza??? */
      case NSSLOWKEYECKey:
          keyType = CKK_EC0x00000003UL;
          crv = (sftk_hasAttribute(key, CKA_NSS_DB0xD5A0DB00L)) ? CKR_OK0x00000000UL : CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_KEY_TYPE0x00000100UL, &keyType,
                                      sizeof(keyType));
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_SIGN0x00000108UL, &cktrue,
                                      sizeof(CK_BBOOL));
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_SIGN_RECOVER0x00000109UL, &cktrue,
                                      sizeof(CK_BBOOL));
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_DERIVE0x0000010CUL, &cktrue,
                                      sizeof(CK_BBOOL));
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_EC_PARAMS0x00000180UL,
                                      sftk_item_expand(&lpk->u.ec.ecParams.DEREncoding)(&lpk->u.ec.ecParams.DEREncoding)->data, (&lpk->
u.ec.ecParams.DEREncoding)->len);
          if (crv != CKR_OK0x00000000UL)
              break;
          crv = sftk_AddAttributeType(key, CKA_VALUE0x00000011UL,
                                      sftk_item_expand(&lpk->u.ec.privateValue)(&lpk->u.ec.privateValue)->data, (&lpk->u.ec
.privateValue)->len);
          if (crv != CKR_OK0x00000000UL)
              break;
          /* XXX Do we need to decode the EC Params here ?? */
          break;
      default:
          crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
          break;
  }

  if (crv != CKR_OK0x00000000UL) {
      goto loser;
  }

  /* For RSA-PSS, record the original algorithm parameters so
   * they can be encrypted altoghether when wrapping */
  if (SECOID_GetAlgorithmTagSECOID_GetAlgorithmTag_Util(&pki->algorithm) == SEC_OID_PKCS1_RSA_PSS_SIGNATURE) {
      NSSLOWKEYSubjectPublicKeyInfo spki;
      NSSLOWKEYPublicKey pubk;
      SECItem *publicKeyInfo;

      memset(&spki, 0, sizeof(NSSLOWKEYSubjectPublicKeyInfo));
      rv = SECOID_CopyAlgorithmIDSECOID_CopyAlgorithmID_Util(arena, &spki.algorithm, &pki->algorithm);
      if (rv != SECSuccess) {
          crv = CKR_HOST_MEMORY0x00000002UL;
          goto loser;
      }

      prepare_low_rsa_pub_key_for_asn1(&pubk);

      rv = SECITEM_CopyItemSECITEM_CopyItem_Util(arena, &pubk.u.rsa.modulus, &lpk->u.rsa.modulus);
      if (rv != SECSuccess) {
          crv = CKR_HOST_MEMORY0x00000002UL;
          goto loser;
      }
      rv = SECITEM_CopyItemSECITEM_CopyItem_Util(arena, &pubk.u.rsa.publicExponent, &lpk->u.rsa.publicExponent);
      if (rv != SECSuccess) {
          crv = CKR_HOST_MEMORY0x00000002UL;
          goto loser;
      }

      if (SEC_ASN1EncodeItemSEC_ASN1EncodeItem_Util(arena, &spki.subjectPublicKey,
                             &pubk, nsslowkey_RSAPublicKeyTemplate) == NULL((void*)0)) {
          crv = CKR_HOST_MEMORY0x00000002UL;
          goto loser;
      }

      publicKeyInfo = SEC_ASN1EncodeItemSEC_ASN1EncodeItem_Util(arena, NULL((void*)0),
                                         &spki, nsslowkey_SubjectPublicKeyInfoTemplate);
      if (!publicKeyInfo) {
          crv = CKR_HOST_MEMORY0x00000002UL;
          goto loser;
      }
      crv = sftk_AddAttributeType(key, CKA_PUBLIC_KEY_INFO0x00000129UL,
                                  sftk_item_expand(publicKeyInfo)(publicKeyInfo)->data, (publicKeyInfo)->len);
  }

6608loser:
  if (lpk) {
      nsslowkey_DestroyPrivateKey(lpk);
  }

  if (crv != CKR_OK0x00000000UL) {
      return SECFailure;
  }

  return SECSuccess;
6618}

6620/* NSC_UnwrapKey unwraps (decrypts) a wrapped key, creating a new key object. */
6621CK_RV
6622NSC_UnwrapKey(CK_SESSION_HANDLE hSession,
            CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hUnwrappingKey,
            CK_BYTE_PTR pWrappedKey, CK_ULONG ulWrappedKeyLen,
            CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulAttributeCount,
            CK_OBJECT_HANDLE_PTR phKey)
6627{
  SFTKObject *key = NULL((void*)0);
  SFTKSession *session;
  CK_ULONG key_length = 0;
  unsigned char *buf = NULL((void*)0);
  CK_RV crv = CKR_OK0x00000000UL;
  int i;
  CK_ULONG bsize = ulWrappedKeyLen;
  SFTKSlot *slot = sftk_SlotFromSessionHandle(hSession);
  SECItem bpki;
  CK_OBJECT_CLASS target_type = CKO_SECRET_KEY0x00000004UL;

  CHECK_FORK();

  if (!slot) {
      return CKR_SESSION_HANDLE_INVALID0x000000B3UL;
  }
  /*
   * now lets create an object to hang the attributes off of
   */
  key = sftk_NewObject(slot); /* fill in the handle later */
  if (key == NULL((void*)0)) {
      return CKR_HOST_MEMORY0x00000002UL;
  }

  /*
   * load the template values into the object
   */
  for (i = 0; i < (int)ulAttributeCount; i++) {
      if (pTemplate[i].type == CKA_VALUE_LEN0x00000161UL) {
          key_length = *(CK_ULONG *)pTemplate[i].pValue;
          continue;
      }
      if (pTemplate[i].type == CKA_CLASS0x00000000UL) {
          target_type = *(CK_OBJECT_CLASS *)pTemplate[i].pValue;
      }
      crv = sftk_AddAttributeType(key, sftk_attr_expand(&pTemplate[i])(&pTemplate[i])->type, (&pTemplate[i])->pValue,
 (&pTemplate[i])->ulValueLen);
      if (crv != CKR_OK0x00000000UL)
          break;
  }
  if (crv != CKR_OK0x00000000UL) {
      sftk_FreeObject(key);
      return crv;
  }

  crv = sftk_CryptInit(hSession, pMechanism, hUnwrappingKey, CKA_UNWRAP0x00000107UL,
                       CKA_UNWRAP0x00000107UL, SFTK_DECRYPT, PR_FALSE0);
  if (crv != CKR_OK0x00000000UL) {
      sftk_FreeObject(key);
      return sftk_mapWrap(crv);
  }

  /* allocate the buffer to decrypt into
   * this assumes the unwrapped key is never larger than the
   * wrapped key. For all the mechanisms we support this is true */
  buf = (unsigned char *)PORT_AllocPORT_Alloc_Util(ulWrappedKeyLen);
  bsize = ulWrappedKeyLen;

  crv = NSC_Decrypt(hSession, pWrappedKey, ulWrappedKeyLen, buf, &bsize);
  if (crv != CKR_OK0x00000000UL) {
      sftk_FreeObject(key);
      PORT_FreePORT_Free_Util(buf);
      return sftk_mapWrap(crv);
  }

  switch (target_type) {
      case CKO_SECRET_KEY0x00000004UL:
          if (!sftk_hasAttribute(key, CKA_KEY_TYPE0x00000100UL)) {
              crv = CKR_TEMPLATE_INCOMPLETE0x000000D0UL;
              break;
          }

          if (key_length == 0 || key_length > bsize) {
              key_length = bsize;
          }
          if (key_length > MAX_KEY_LEN256) {
              crv = CKR_TEMPLATE_INCONSISTENT0x000000D1UL;
              break;
          }

          /* add the value */
          crv = sftk_AddAttributeType(key, CKA_VALUE0x00000011UL, buf, key_length);
          break;
      case CKO_PRIVATE_KEY0x00000003UL:
          bpki.data = (unsigned char *)buf;
          bpki.len = bsize;
          crv = CKR_OK0x00000000UL;
          if (sftk_unwrapPrivateKey(key, &bpki) != SECSuccess) {
              crv = CKR_TEMPLATE_INCOMPLETE0x000000D0UL;
          }
          break;
      default:
          crv = CKR_TEMPLATE_INCONSISTENT0x000000D1UL;
          break;
  }

  PORT_ZFreePORT_ZFree_Util(buf, bsize);
  if (crv != CKR_OK0x00000000UL) {
      sftk_FreeObject(key);
      return crv;
  }

  /* get the session */
  session = sftk_SessionFromHandle(hSession);
  if (session == NULL((void*)0)) {
      sftk_FreeObject(key);
      return CKR_SESSION_HANDLE_INVALID0x000000B3UL;
  }

  /* mark the key as FIPS if the previous operation was all FIPS */
  key->isFIPS = session->lastOpWasFIPS;

  /*
   * handle the base object stuff
   */
  crv = sftk_handleObject(key, session);
  *phKey = key->handle;
  sftk_FreeSession(session);
  sftk_FreeObject(key);

  return crv;
6748}

6750/*
* The SSL key gen mechanism create's lots of keys. This function handles the
* details of each of these key creation.
*/
6754static CK_RV
6755sftk_buildSSLKey(CK_SESSION_HANDLE hSession, SFTKObject *baseKey,
               PRBool isMacKey, unsigned char *keyBlock, unsigned int keySize,
               CK_OBJECT_HANDLE *keyHandle)
6758{
  SFTKObject *key;
  SFTKSession *session;
  CK_KEY_TYPE keyType = CKK_GENERIC_SECRET0x00000010UL;
  CK_BBOOL cktrue = CK_TRUE1;
  CK_BBOOL ckfalse = CK_FALSE0;
  CK_RV crv = CKR_HOST_MEMORY0x00000002UL;

  /*
   * now lets create an object to hang the attributes off of
   */
  *keyHandle = CK_INVALID_HANDLE0;
  key = sftk_NewObject(baseKey->slot);
  if (key == NULL((void*)0))
      return CKR_HOST_MEMORY0x00000002UL;
  sftk_narrowToSessionObject(key)->wasDerived = PR_TRUE1;

  crv = sftk_CopyObject(key, baseKey);
  if (crv != CKR_OK0x00000000UL)
      goto loser;
  if (isMacKey) {
      crv = sftk_forceAttribute(key, CKA_KEY_TYPE0x00000100UL, &keyType, sizeof(keyType));
      if (crv != CKR_OK0x00000000UL)
          goto loser;
      crv = sftk_forceAttribute(key, CKA_DERIVE0x0000010CUL, &cktrue, sizeof(CK_BBOOL));
      if (crv != CKR_OK0x00000000UL)
          goto loser;
      crv = sftk_forceAttribute(key, CKA_ENCRYPT0x00000104UL, &ckfalse, sizeof(CK_BBOOL));
      if (crv != CKR_OK0x00000000UL)
          goto loser;
      crv = sftk_forceAttribute(key, CKA_DECRYPT0x00000105UL, &ckfalse, sizeof(CK_BBOOL));
      if (crv != CKR_OK0x00000000UL)
          goto loser;
      crv = sftk_forceAttribute(key, CKA_SIGN0x00000108UL, &cktrue, sizeof(CK_BBOOL));
      if (crv != CKR_OK0x00000000UL)
          goto loser;
      crv = sftk_forceAttribute(key, CKA_VERIFY0x0000010AUL, &cktrue, sizeof(CK_BBOOL));
      if (crv != CKR_OK0x00000000UL)
          goto loser;
      crv = sftk_forceAttribute(key, CKA_WRAP0x00000106UL, &ckfalse, sizeof(CK_BBOOL));
      if (crv != CKR_OK0x00000000UL)
          goto loser;
      crv = sftk_forceAttribute(key, CKA_UNWRAP0x00000107UL, &ckfalse, sizeof(CK_BBOOL));
      if (crv != CKR_OK0x00000000UL)
          goto loser;
  }
  crv = sftk_forceAttribute(key, CKA_VALUE0x00000011UL, keyBlock, keySize);
  if (crv != CKR_OK0x00000000UL)
      goto loser;

  /* get the session */
  crv = CKR_HOST_MEMORY0x00000002UL;
  session = sftk_SessionFromHandle(hSession);
  if (session == NULL((void*)0)) {
      goto loser;
  }

  crv = sftk_handleObject(key, session);
  sftk_FreeSession(session);
  *keyHandle = key->handle;
6818loser:
  if (key)
      sftk_FreeObject(key);
  return crv;
6822}

6824/*
* if there is an error, we need to free the keys we already created in SSL
* This is the routine that will do it..
*/
6828static void
6829sftk_freeSSLKeys(CK_SESSION_HANDLE session,
               CK_SSL3_KEY_MAT_OUT *returnedMaterial)
6831{
  if (returnedMaterial->hClientMacSecret != CK_INVALID_HANDLE0) {
      NSC_DestroyObject(session, returnedMaterial->hClientMacSecret);
  }
  if (returnedMaterial->hServerMacSecret != CK_INVALID_HANDLE0) {
      NSC_DestroyObject(session, returnedMaterial->hServerMacSecret);
  }
  if (returnedMaterial->hClientKey != CK_INVALID_HANDLE0) {
      NSC_DestroyObject(session, returnedMaterial->hClientKey);
  }
  if (returnedMaterial->hServerKey != CK_INVALID_HANDLE0) {
      NSC_DestroyObject(session, returnedMaterial->hServerKey);
  }
6844}

6846/*
* when deriving from sensitive and extractable keys, we need to preserve some
* of the semantics in the derived key. This helper routine maintains these
* semantics.
*/
6851static CK_RV
6852sftk_DeriveSensitiveCheck(SFTKObject *baseKey, SFTKObject *destKey,
                        PRBool canBeData)
6854{
  PRBool hasSensitive;
  PRBool sensitive = PR_FALSE0;
  CK_BBOOL bFalse = CK_FALSE0;
  PRBool hasExtractable;
  PRBool extractable = PR_TRUE1;
  CK_BBOOL bTrue = CK_TRUE1;
  CK_RV crv = CKR_OK0x00000000UL;
  SFTKAttribute *att;
  PRBool isData = PR_TRUE1;

  if (canBeData) {
      CK_OBJECT_CLASS objClass;

      /* if the target key is actually data, don't set the unexpected
       * attributes */
      crv = sftk_GetULongAttribute(destKey, CKA_CLASS0x00000000UL, &objClass);
      if (crv != CKR_OK0x00000000UL) {
          return crv;
      }
      if (objClass == CKO_DATA0x00000000UL) {
          return CKR_OK0x00000000UL;
      }

      /* if the base key is data, it doesn't have sensitive attributes,
       * allow the destKey to get it's own */
      crv = sftk_GetULongAttribute(baseKey, CKA_CLASS0x00000000UL, &objClass);
      if (crv != CKR_OK0x00000000UL) {
          return crv;
      }
      if (objClass == CKO_DATA0x00000000UL) {
          isData = PR_TRUE1;
      }
  }

  hasSensitive = PR_FALSE0;
  att = sftk_FindAttribute(destKey, CKA_SENSITIVE0x00000103UL);
  if (att) {
      hasSensitive = PR_TRUE1;
      sensitive = (PRBool) * (CK_BBOOL *)att->attrib.pValue;
      sftk_FreeAttribute(att);
  }

  hasExtractable = PR_FALSE0;
  att = sftk_FindAttribute(destKey, CKA_EXTRACTABLE0x00000162UL);
  if (att) {
      hasExtractable = PR_TRUE1;
      extractable = (PRBool) * (CK_BBOOL *)att->attrib.pValue;
      sftk_FreeAttribute(att);
  }

  /* don't make a key more accessible */
  if (sftk_isTrue(baseKey, CKA_SENSITIVE0x00000103UL) && hasSensitive &&
      (sensitive == PR_FALSE0)) {
      return CKR_KEY_FUNCTION_NOT_PERMITTED0x00000068UL;
  }
  if (!sftk_isTrue(baseKey, CKA_EXTRACTABLE0x00000162UL) && hasExtractable &&
      (extractable == PR_TRUE1)) {
      return CKR_KEY_FUNCTION_NOT_PERMITTED0x00000068UL;
  }

  /* inherit parent's sensitivity */
  if (!hasSensitive) {
      att = sftk_FindAttribute(baseKey, CKA_SENSITIVE0x00000103UL);
      if (att != NULL((void*)0)) {
          crv = sftk_defaultAttribute(destKey,
                                      sftk_attr_expand(&att->attrib)(&att->attrib)->type, (&att->attrib)->pValue
, (&att->attrib)->ulValueLen);
          sftk_FreeAttribute(att);
      } else if (isData) {
          crv = sftk_defaultAttribute(destKey, CKA_SENSITIVE0x00000103UL,
                                      &bFalse, sizeof(bFalse));
      } else {
          return CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
      }
      if (crv != CKR_OK0x00000000UL)
          return crv;
  }
  if (!hasExtractable) {
      att = sftk_FindAttribute(baseKey, CKA_EXTRACTABLE0x00000162UL);
      if (att != NULL((void*)0)) {
          crv = sftk_defaultAttribute(destKey,
                                      sftk_attr_expand(&att->attrib)(&att->attrib)->type, (&att->attrib)->pValue
, (&att->attrib)->ulValueLen);
          sftk_FreeAttribute(att);
      } else if (isData) {
          crv = sftk_defaultAttribute(destKey, CKA_EXTRACTABLE0x00000162UL,
                                      &bTrue, sizeof(bTrue));
      } else {
          return CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
      }
      if (crv != CKR_OK0x00000000UL)
          return crv;
  }

  /* we should inherit the parent's always extractable/ never sensitive info,
   * but handleObject always forces this attributes, so we would need to do
   * something special. */
  return CKR_OK0x00000000UL;
6951}

6953/*
* make known fixed PKCS #11 key types to their sizes in bytes
*/
6956unsigned long
6957sftk_MapKeySize(CK_KEY_TYPE keyType)
6958{
  switch (keyType) {
      case CKK_CDMF0x0000001EUL:
          return 8;
      case CKK_DES0x00000013UL:
          return 8;
      case CKK_DES20x00000014UL:
          return 16;
      case CKK_DES30x00000015UL:
          return 24;
      /* IDEA and CAST need to be added */
      default:
          break;
  }
  return 0;
6973}

6975/* Inputs:
*  key_len: Length of derived key to be generated.
*  SharedSecret: a shared secret that is the output of a key agreement primitive.
*  SharedInfo: (Optional) some data shared by the entities computing the secret key.
*  SharedInfoLen: the length in octets of SharedInfo
*  Hash: The hash function to be used in the KDF
*  HashLen: the length in octets of the output of Hash
* Output:
*  key: Pointer to a buffer containing derived key, if return value is SECSuccess.
*/
6985static CK_RV
6986sftk_compute_ANSI_X9_63_kdf(CK_BYTE **key, CK_ULONG key_len, SECItem *SharedSecret,
                          CK_BYTE_PTR SharedInfo, CK_ULONG SharedInfoLen,
                          SECStatus Hash(unsigned char *, const unsigned char *, PRUint32),
                          CK_ULONG HashLen)
6990{
  unsigned char *buffer = NULL((void*)0), *output_buffer = NULL((void*)0);
  PRUint32 buffer_len, max_counter, i;
  SECStatus rv;
  CK_RV crv;

  /* Check that key_len isn't too long.  The maximum key length could be
   * greatly increased if the code below did not limit the 4-byte counter
   * to a maximum value of 255. */
  if (key_len > 254 * HashLen)
      return CKR_ARGUMENTS_BAD0x00000007UL;

  if (SharedInfo == NULL((void*)0))
      SharedInfoLen = 0;

  buffer_len = SharedSecret->len + 4 + SharedInfoLen;
  buffer = (CK_BYTE *)PORT_AllocPORT_Alloc_Util(buffer_len);
  if (buffer == NULL((void*)0)) {
      crv = CKR_HOST_MEMORY0x00000002UL;
      goto loser;
  }

  max_counter = key_len / HashLen;
  if (key_len > max_counter * HashLen)
      max_counter++;

  output_buffer = (CK_BYTE *)PORT_AllocPORT_Alloc_Util(max_counter * HashLen);
  if (output_buffer == NULL((void*)0)) {
      crv = CKR_HOST_MEMORY0x00000002UL;
      goto loser;
  }

  /* Populate buffer with SharedSecret || Counter || [SharedInfo]
   * where Counter is 0x00000001 */
  PORT_Memcpymemcpy(buffer, SharedSecret->data, SharedSecret->len);
  buffer[SharedSecret->len] = 0;
  buffer[SharedSecret->len + 1] = 0;
  buffer[SharedSecret->len + 2] = 0;
  buffer[SharedSecret->len + 3] = 1;
  if (SharedInfo) {
      PORT_Memcpymemcpy(&buffer[SharedSecret->len + 4], SharedInfo, SharedInfoLen);
  }

  for (i = 0; i < max_counter; i++) {
      rv = Hash(&output_buffer[i * HashLen], buffer, buffer_len);
      if (rv != SECSuccess) {
          /* 'Hash' should not fail. */
          crv = CKR_FUNCTION_FAILED0x00000006UL;
          goto loser;
      }

      /* Increment counter (assumes max_counter < 255) */
      buffer[SharedSecret->len + 3]++;
  }

  PORT_ZFreePORT_ZFree_Util(buffer, buffer_len);
  if (key_len < max_counter * HashLen) {
      PORT_Memsetmemset(output_buffer + key_len, 0, max_counter * HashLen - key_len);
  }
  *key = output_buffer;

  return CKR_OK0x00000000UL;

7053loser:
  if (buffer) {
      PORT_ZFreePORT_ZFree_Util(buffer, buffer_len);
  }
  if (output_buffer) {
      PORT_ZFreePORT_ZFree_Util(output_buffer, max_counter * HashLen);
  }
  return crv;
7061}

7063static CK_RV
7064sftk_ANSI_X9_63_kdf(CK_BYTE **key, CK_ULONG key_len,
                  SECItem *SharedSecret,
                  CK_BYTE_PTR SharedInfo, CK_ULONG SharedInfoLen,
                  CK_EC_KDF_TYPE kdf)
7068{
  if (kdf == CKD_SHA1_KDF0x00000002UL)
      return sftk_compute_ANSI_X9_63_kdf(key, key_len, SharedSecret, SharedInfo,
                                         SharedInfoLen, SHA1_HashBuf, SHA1_LENGTH20);
  else if (kdf == CKD_SHA224_KDF0x00000005UL)
      return sftk_compute_ANSI_X9_63_kdf(key, key_len, SharedSecret, SharedInfo,
                                         SharedInfoLen, SHA224_HashBuf, SHA224_LENGTH28);
  else if (kdf == CKD_SHA256_KDF0x00000006UL)
      return sftk_compute_ANSI_X9_63_kdf(key, key_len, SharedSecret, SharedInfo,
                                         SharedInfoLen, SHA256_HashBuf, SHA256_LENGTH32);
  else if (kdf == CKD_SHA384_KDF0x00000007UL)
      return sftk_compute_ANSI_X9_63_kdf(key, key_len, SharedSecret, SharedInfo,
                                         SharedInfoLen, SHA384_HashBuf, SHA384_LENGTH48);
  else if (kdf == CKD_SHA512_KDF0x00000008UL)
      return sftk_compute_ANSI_X9_63_kdf(key, key_len, SharedSecret, SharedInfo,
                                         SharedInfoLen, SHA512_HashBuf, SHA512_LENGTH64);
  else
      return CKR_MECHANISM_INVALID0x00000070UL;
7086}

7088/*
*  Handle the derive from a block encryption cipher
*/
7091CK_RV
7092sftk_DeriveEncrypt(SFTKCipher encrypt, void *cipherInfo,
                 int blockSize, SFTKObject *key, CK_ULONG keySize,
                 unsigned char *data, CK_ULONG len)
7095{
  /* large enough for a 512-bit key */
  unsigned char tmpdata[SFTK_MAX_DERIVE_KEY_SIZE64];
  SECStatus rv;
  unsigned int outLen;
  CK_RV crv;

  if ((len % blockSize) != 0) {
      return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
  }
  if (len > SFTK_MAX_DERIVE_KEY_SIZE64) {
      return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
  }
  if (keySize && (len < keySize)) {
      return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
  }
  if (keySize == 0) {
      keySize = len;
  }

  rv = (*encrypt)(cipherInfo, &tmpdata, &outLen, len, data, len);
  if (rv != SECSuccess) {
      crv = sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
      return crv;
  }

  crv = sftk_forceAttribute(key, CKA_VALUE0x00000011UL, tmpdata, keySize);
  PORT_Memsetmemset(tmpdata, 0, sizeof tmpdata);
  return crv;
7124}

7126CK_RV
7127sftk_HKDF(CK_HKDF_PARAMS_PTR params, CK_SESSION_HANDLE hSession,
        SFTKObject *sourceKey, const unsigned char *sourceKeyBytes,
        int sourceKeyLen, SFTKObject *key, unsigned char *outKeyBytes,
        int keySize, PRBool canBeData, PRBool isFIPS)
7131{
  SFTKSession *session;
  SFTKAttribute *saltKey_att = NULL((void*)0);
  const SECHashObject *rawHash;
  unsigned hashLen;
  unsigned genLen = 0;
  unsigned char hashbuf[HASH_LENGTH_MAX64];
  unsigned char keyBlock[9 * SFTK_MAX_MAC_LENGTH64];
  unsigned char *keyBlockAlloc = NULL((void*)0);    /* allocated keyBlock */
  unsigned char *keyBlockData = keyBlock; /* pointer to current keyBlock */
  const unsigned char *prk;               /* psuedo-random key */
  CK_ULONG prkLen;
  const unsigned char *okm; /* output keying material */
  HASH_HashType hashType = sftk_GetHashTypeFromMechanism(params->prfHashMechanism);
  SFTKObject *saltKey = NULL((void*)0);
  CK_RV crv = CKR_OK0x00000000UL;

  /* Spec says it should be the base hash, but also accept the HMAC */
  if (hashType == HASH_AlgNULL) {
      hashType = sftk_HMACMechanismToHash(params->prfHashMechanism);
  }
  rawHash = HASH_GetRawHashObject(hashType);
  if (rawHash == NULL((void*)0) || rawHash->length > sizeof(hashbuf)) {
      return CKR_MECHANISM_INVALID0x00000070UL;
  }
  hashLen = rawHash->length;

  if ((!params->bExpand && !params->bExtract) ||
      (params->bExtract && params->ulSaltLen > 0 && !params->pSalt) ||
      (params->bExpand && params->ulInfoLen > 0 && !params->pInfo)) {
      return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
  }
  if ((params->bExpand && keySize == 0) ||
      (!params->bExpand && keySize > hashLen) ||
      (params->bExpand && keySize > 255 * hashLen)) {
      return CKR_TEMPLATE_INCONSISTENT0x000000D1UL;
  }

  /* sourceKey is NULL if we are called from the POST, skip the
   * sensitiveCheck */
  if (sourceKey != NULL((void*)0)) {
      crv = sftk_DeriveSensitiveCheck(sourceKey, key, canBeData);
      if (crv != CKR_OK0x00000000UL)
          return crv;
  }

  /* HKDF-Extract(salt, base key value) */
  if (params->bExtract) {
      CK_BYTE *salt;
      CK_ULONG saltLen;
      HMACContext *hmac;
      unsigned int bufLen;

      switch (params->ulSaltType) {
          case CKF_HKDF_SALT_NULL0x00000001UL:
              saltLen = hashLen;
              salt = hashbuf;
              memset(salt, 0, saltLen);
              break;
          case CKF_HKDF_SALT_DATA0x00000002UL:
              salt = params->pSalt;
              saltLen = params->ulSaltLen;
              if ((salt == NULL((void*)0)) || (params->ulSaltLen == 0)) {
                  return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              }
              break;
          case CKF_HKDF_SALT_KEY0x00000004UL:
              /* lookup key */
              session = sftk_SessionFromHandle(hSession);
              if (session == NULL((void*)0)) {
                  return CKR_SESSION_HANDLE_INVALID0x000000B3UL;
              }

              saltKey = sftk_ObjectFromHandle(params->hSaltKey, session);
              sftk_FreeSession(session);
              if (saltKey == NULL((void*)0)) {
                  return CKR_KEY_HANDLE_INVALID0x00000060UL;
              }
              /* if the base key is not fips, but the salt key is, the
               * resulting key can be fips */
              if (isFIPS && (key->isFIPS == 0) && (saltKey->isFIPS == 1)) {
                  CK_MECHANISM mech;
                  mech.mechanism = CKM_HKDF_DERIVE0x0000402aUL;
                  mech.pParameter = params;
                  mech.ulParameterLen = sizeof(*params);
                  key->isFIPS = sftk_operationIsFIPS(saltKey->slot, &mech,
                                                     CKA_DERIVE0x0000010CUL, saltKey);
              }
              saltKey_att = sftk_FindAttribute(saltKey, CKA_VALUE0x00000011UL);
              if (saltKey_att == NULL((void*)0)) {
                  sftk_FreeObject(saltKey);
                  return CKR_KEY_HANDLE_INVALID0x00000060UL;
              }
              /* save the resulting salt */
              salt = saltKey_att->attrib.pValue;
              saltLen = saltKey_att->attrib.ulValueLen;
              break;
          default:
              return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
      }

      hmac = HMAC_Create(rawHash, salt, saltLen, isFIPS);
      if (saltKey_att) {
          sftk_FreeAttribute(saltKey_att);
      }
      if (saltKey) {
          sftk_FreeObject(saltKey);
      }
      if (!hmac) {
          return CKR_HOST_MEMORY0x00000002UL;
      }
      HMAC_Begin(hmac);
      HMAC_Update(hmac, sourceKeyBytes, sourceKeyLen);
      HMAC_Finish(hmac, hashbuf, &bufLen, sizeof(hashbuf));
      HMAC_Destroy(hmac, PR_TRUE1);
      PORT_Assert(bufLen == rawHash->length)((bufLen == rawHash->length)?((void)0):PR_Assert("bufLen == rawHash->length"
,"pkcs11c.c",7247));
      prk = hashbuf;
      prkLen = bufLen;
  } else {
      /* PRK = base key value */
      prk = sourceKeyBytes;
      prkLen = sourceKeyLen;
  }

  /* HKDF-Expand */
  if (!params->bExpand) {
      okm = prk;
      keySize = genLen = hashLen;
  } else {
      /* T(1) = HMAC-Hash(prk, "" | info | 0x01)
       * T(n) = HMAC-Hash(prk, T(n-1) | info | n
       * key material = T(1) | ... | T(n)
       */
      HMACContext *hmac;
      CK_BYTE bi;
      unsigned iterations;

      genLen = PR_ROUNDUP(keySize, hashLen)((((keySize)+((hashLen)-1))/(hashLen))*(hashLen));
      iterations = genLen / hashLen;

      if (genLen > sizeof(keyBlock)) {
          keyBlockAlloc = PORT_AllocPORT_Alloc_Util(genLen);
          if (keyBlockAlloc == NULL((void*)0)) {
              return CKR_HOST_MEMORY0x00000002UL;
          }
          keyBlockData = keyBlockAlloc;
      }
      hmac = HMAC_Create(rawHash, prk, prkLen, isFIPS);
      if (hmac == NULL((void*)0)) {
          PORT_FreePORT_Free_Util(keyBlockAlloc);
          return CKR_HOST_MEMORY0x00000002UL;
      }
      for (bi = 1; bi <= iterations && bi > 0; ++bi) {
          unsigned len;
          HMAC_Begin(hmac);
          if (bi > 1) {
              HMAC_Update(hmac, &keyBlockData[(bi - 2) * hashLen], hashLen);
          }
          if (params->ulInfoLen != 0) {
              HMAC_Update(hmac, params->pInfo, params->ulInfoLen);
          }
          HMAC_Update(hmac, &bi, 1);
          HMAC_Finish(hmac, &keyBlockData[(bi - 1) * hashLen], &len,
                      hashLen);
          PORT_Assert(len == hashLen)((len == hashLen)?((void)0):PR_Assert("len == hashLen","pkcs11c.c"
,7296));
      }
      HMAC_Destroy(hmac, PR_TRUE1);
      okm = &keyBlockData[0];
  }
  /* key material = okm */
  crv = CKR_OK0x00000000UL;
  if (key) {
      crv = sftk_forceAttribute(key, CKA_VALUE0x00000011UL, okm, keySize);
  } else {
      PORT_Assert(outKeyBytes != NULL)((outKeyBytes != ((void*)0))?((void)0):PR_Assert("outKeyBytes != NULL"
,"pkcs11c.c",7306));
      PORT_Memcpymemcpy(outKeyBytes, okm, keySize);
  }
  PORT_Memsetmemset(keyBlockData, 0, genLen);
  PORT_Memsetmemset(hashbuf, 0, sizeof(hashbuf));
  PORT_FreePORT_Free_Util(keyBlockAlloc);
  return crv;
7313}

7315/*
* SSL Key generation given pre master secret
*/
7318#define NUM_MIXERS9 9
7319static const char *const mixers[NUM_MIXERS9] = {
  "A",
  "BB",
  "CCC",
  "DDDD",
  "EEEEE",
  "FFFFFF",
  "GGGGGGG",
  "HHHHHHHH",
  "IIIIIIIII"
7329};
7330#define SSL3_PMS_LENGTH48 48
7331#define SSL3_MASTER_SECRET_LENGTH48 48
7332#define SSL3_RANDOM_LENGTH32 32

7334/* NSC_DeriveKey derives a key from a base key, creating a new key object. */
7335CK_RV
7336NSC_DeriveKey(CK_SESSION_HANDLE hSession,
            CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hBaseKey,
            CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulAttributeCount,
            CK_OBJECT_HANDLE_PTR phKey)
7340{
  SFTKSession *session;
  SFTKSlot *slot = sftk_SlotFromSessionHandle(hSession);
  SFTKObject *key;
  SFTKObject *sourceKey;
  SFTKAttribute *att = NULL((void*)0);
  SFTKAttribute *att2 = NULL((void*)0);
  unsigned char *buf;
  SHA1Context *sha;
  MD5Context *md5;
  MD2Context *md2;
  CK_ULONG macSize;
  CK_ULONG tmpKeySize;
  CK_ULONG IVSize;
  CK_ULONG keySize = 0;
  CK_RV crv = CKR_OK0x00000000UL;
  CK_BBOOL cktrue = CK_TRUE1;
  CK_BBOOL ckfalse = CK_FALSE0;
  CK_KEY_TYPE keyType = CKK_GENERIC_SECRET0x00000010UL;
  CK_OBJECT_CLASS classType = CKO_SECRET_KEY0x00000004UL;
  CK_KEY_DERIVATION_STRING_DATA *stringPtr;
  PRBool isTLS = PR_FALSE0;
  PRBool isDH = PR_FALSE0;
  HASH_HashType tlsPrfHash = HASH_AlgNULL;
  SECStatus rv;
  int i;
  unsigned int outLen;
  unsigned char sha_out[SHA1_LENGTH20];
  unsigned char key_block[NUM_MIXERS9 * SFTK_MAX_MAC_LENGTH64];
  PRBool isFIPS;
  HASH_HashType hashType;
  CK_MECHANISM_TYPE hashMech;
  PRBool extractValue = PR_TRUE1;
  CK_NSS_IKE1_APP_B_PRF_DERIVE_PARAMS ikeAppB;
  CK_NSS_IKE1_APP_B_PRF_DERIVE_PARAMS *pIkeAppB;

  CHECK_FORK();

  if (!slot) {
      return CKR_SESSION_HANDLE_INVALID0x000000B3UL;
  }
  if (!pMechanism) {
      return CKR_MECHANISM_PARAM_INVALID0x00000071UL;
  }
  CK_MECHANISM_TYPE mechanism = pMechanism->mechanism;

  /*
   * now lets create an object to hang the attributes off of
   */
  if (phKey)
      *phKey = CK_INVALID_HANDLE0;

  key = sftk_NewObject(slot); /* fill in the handle later */
  if (key == NULL((void*)0)) {
      return CKR_HOST_MEMORY0x00000002UL;
  }
  isFIPS = sftk_isFIPS(slot->slotID)(((slot->slotID) == 3) || ((slot->slotID) >= 101));

  /*
   * load the template values into the object
   */
  for (i = 0; i < (int)ulAttributeCount; i++) {
      crv = sftk_AddAttributeType(key, sftk_attr_expand(&pTemplate[i])(&pTemplate[i])->type, (&pTemplate[i])->pValue,
 (&pTemplate[i])->ulValueLen);
      if (crv != CKR_OK0x00000000UL)
          break;

      if (pTemplate[i].type == CKA_KEY_TYPE0x00000100UL) {
          keyType = *(CK_KEY_TYPE *)pTemplate[i].pValue;
      }
      if (pTemplate[i].type == CKA_VALUE_LEN0x00000161UL) {
          keySize = *(CK_ULONG *)pTemplate[i].pValue;
      }
  }
  if (crv != CKR_OK0x00000000UL) {
      sftk_FreeObject(key);
      return crv;
  }

  if (keySize == 0) {
      keySize = sftk_MapKeySize(keyType);
  }

  switch (mechanism) {
      case CKM_NSS_JPAKE_ROUND2_SHA1((0x80000000UL | 0x4E534350) + 11):   /* fall through */
      case CKM_NSS_JPAKE_ROUND2_SHA256((0x80000000UL | 0x4E534350) + 12): /* fall through */
      case CKM_NSS_JPAKE_ROUND2_SHA384((0x80000000UL | 0x4E534350) + 13): /* fall through */
      case CKM_NSS_JPAKE_ROUND2_SHA512((0x80000000UL | 0x4E534350) + 14):
          extractValue = PR_FALSE0;
          classType = CKO_PRIVATE_KEY0x00000003UL;
          break;
      case CKM_NSS_PUB_FROM_PRIV((0x80000000UL | 0x4E534350) + 40):
          extractValue = PR_FALSE0;
          classType = CKO_PUBLIC_KEY0x00000002UL;
          break;
      case CKM_HKDF_DATA0x0000402bUL:                              /* fall through */
      case CKM_NSS_SP800_108_COUNTER_KDF_DERIVE_DATA((0x80000000UL | 0x4E534350) + 42):  /* fall through */
      case CKM_NSS_SP800_108_FEEDBACK_KDF_DERIVE_DATA((0x80000000UL | 0x4E534350) + 43): /* fall through */
      case CKM_NSS_SP800_108_DOUBLE_PIPELINE_KDF_DERIVE_DATA((0x80000000UL | 0x4E534350) + 44):
          classType = CKO_DATA0x00000000UL;
          break;
      case CKM_NSS_JPAKE_FINAL_SHA1((0x80000000UL | 0x4E534350) + 15):   /* fall through */
      case CKM_NSS_JPAKE_FINAL_SHA256((0x80000000UL | 0x4E534350) + 16): /* fall through */
      case CKM_NSS_JPAKE_FINAL_SHA384((0x80000000UL | 0x4E534350) + 17): /* fall through */
      case CKM_NSS_JPAKE_FINAL_SHA512((0x80000000UL | 0x4E534350) + 18):
          extractValue = PR_FALSE0;
      /* fall through */
      default:
          classType = CKO_SECRET_KEY0x00000004UL;
  }

  crv = sftk_forceAttribute(key, CKA_CLASS0x00000000UL, &classType, sizeof(classType));
  if (crv != CKR_OK0x00000000UL) {
      sftk_FreeObject(key);
      return crv;
  }

  /* look up the base key we're deriving with */
  session = sftk_SessionFromHandle(hSession);
  if (session == NULL((void*)0)) {
      sftk_FreeObject(key);
      return CKR_SESSION_HANDLE_INVALID0x000000B3UL;
  }

  sourceKey = sftk_ObjectFromHandle(hBaseKey, session);
  sftk_FreeSession(session);
  /* is this eventually succeeds, lastOpWasFIPS will be set the resulting key's
   * FIPS state below. */
  session->lastOpWasFIPS = PR_FALSE0;
  if (sourceKey == NULL((void*)0)) {
      sftk_FreeObject(key);
      return CKR_KEY_HANDLE_INVALID0x00000060UL;
  }

  if (extractValue) {
      /* get the value of the base key */
      att = sftk_FindAttribute(sourceKey, CKA_VALUE0x00000011UL);
      if (att == NULL((void*)0)) {
          sftk_FreeObject(key);
          sftk_FreeObject(sourceKey);
          return CKR_KEY_HANDLE_INVALID0x00000060UL;
      }
  }
  key->isFIPS = sftk_operationIsFIPS(slot, pMechanism, CKA_DERIVE0x0000010CUL, sourceKey);

  switch (mechanism) {
      /* get a public key from a private key. nsslowkey_ConvertToPublickey()
       * will generate the public portion if it doesn't already exist. */
      case CKM_NSS_PUB_FROM_PRIV((0x80000000UL | 0x4E534350) + 40): {
          NSSLOWKEYPrivateKey *privKey;
          NSSLOWKEYPublicKey *pubKey;
          int error;

          crv = sftk_GetULongAttribute(sourceKey, CKA_KEY_TYPE0x00000100UL, &keyType);
          if (crv != CKR_OK0x00000000UL) {
              break;
          }

          /* privKey is stored in sourceKey and will be destroyed when
           * the sourceKey is freed. */
          privKey = sftk_GetPrivKey(sourceKey, keyType, &crv);
          if (privKey == NULL((void*)0)) {
              break;
          }
          pubKey = nsslowkey_ConvertToPublicKey(privKey);
          if (pubKey == NULL((void*)0)) {
              error = PORT_GetErrorPORT_GetError_Util();
              crv = sftk_MapCryptError(error);
              break;
          }
          crv = sftk_PutPubKey(key, sourceKey, keyType, pubKey);
          nsslowkey_DestroyPublicKey(pubKey);
          break;
      }
      case CKM_NSS_IKE_PRF_DERIVE((0x80000000UL | 0x4E534350) + 35):
          if (pMechanism->ulParameterLen !=
              sizeof(CK_NSS_IKE_PRF_DERIVE_PARAMS)) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          crv = sftk_ike_prf(hSession, att,
                             (CK_NSS_IKE_PRF_DERIVE_PARAMS *)pMechanism->pParameter, key);
          break;
      case CKM_NSS_IKE1_PRF_DERIVE((0x80000000UL | 0x4E534350) + 36):
          if (pMechanism->ulParameterLen !=
              sizeof(CK_NSS_IKE1_PRF_DERIVE_PARAMS)) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          crv = sftk_ike1_prf(hSession, att,
                              (CK_NSS_IKE1_PRF_DERIVE_PARAMS *)pMechanism->pParameter,
                              key, keySize);
          break;
      case CKM_NSS_IKE1_APP_B_PRF_DERIVE((0x80000000UL | 0x4E534350) + 37):
          pIkeAppB = (CK_NSS_IKE1_APP_B_PRF_DERIVE_PARAMS *)pMechanism->pParameter;
          if (pMechanism->ulParameterLen ==
              sizeof(CK_MECHANISM_TYPE)) {
              ikeAppB.prfMechanism = *(CK_MECHANISM_TYPE *)pMechanism->pParameter;
              ikeAppB.bHasKeygxy = PR_FALSE0;
              ikeAppB.hKeygxy = CK_INVALID_HANDLE0;
              ikeAppB.pExtraData = NULL((void*)0);
              ikeAppB.ulExtraDataLen = 0;
              pIkeAppB = &ikeAppB;
          } else if (pMechanism->ulParameterLen !=
                     sizeof(CK_NSS_IKE1_APP_B_PRF_DERIVE_PARAMS)) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          crv = sftk_ike1_appendix_b_prf(hSession, att, pIkeAppB, key,
                                         keySize);
          break;
      case CKM_NSS_IKE_PRF_PLUS_DERIVE((0x80000000UL | 0x4E534350) + 34):
          if (pMechanism->ulParameterLen !=
              sizeof(CK_NSS_IKE_PRF_PLUS_DERIVE_PARAMS)) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          crv = sftk_ike_prf_plus(hSession, att,
                                  (CK_NSS_IKE_PRF_PLUS_DERIVE_PARAMS *)pMechanism->pParameter,
                                  key, keySize);
          break;
      /*
       * generate the master secret
       */
      case CKM_TLS12_MASTER_KEY_DERIVE0x000003E0UL:
      case CKM_TLS12_MASTER_KEY_DERIVE_DH0x000003E2UL:
      case CKM_NSS_TLS_MASTER_KEY_DERIVE_SHA256((0x80000000UL | 0x4E534350) + 22):
      case CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256((0x80000000UL | 0x4E534350) + 24):
      case CKM_TLS_MASTER_KEY_DERIVE0x00000375UL:
      case CKM_TLS_MASTER_KEY_DERIVE_DH0x00000377UL:
      case CKM_SSL3_MASTER_KEY_DERIVE0x00000371UL:
      case CKM_SSL3_MASTER_KEY_DERIVE_DH0x00000373UL: {
          CK_SSL3_MASTER_KEY_DERIVE_PARAMS *ssl3_master;
          SSL3RSAPreMasterSecret *rsa_pms;
          unsigned char crsrdata[SSL3_RANDOM_LENGTH32 * 2];

          if ((mechanism == CKM_TLS12_MASTER_KEY_DERIVE0x000003E0UL) ||
              (mechanism == CKM_TLS12_MASTER_KEY_DERIVE_DH0x000003E2UL)) {
              if (BAD_PARAM_CAST(pMechanism, sizeof(CK_TLS12_MASTER_KEY_DERIVE_PARAMS))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_TLS12_MASTER_KEY_DERIVE_PARAMS))) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
              CK_TLS12_MASTER_KEY_DERIVE_PARAMS *tls12_master =
                  (CK_TLS12_MASTER_KEY_DERIVE_PARAMS *)pMechanism->pParameter;
              tlsPrfHash = sftk_GetHashTypeFromMechanism(tls12_master->prfHashMechanism);
              if (tlsPrfHash == HASH_AlgNULL) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
          } else if ((mechanism == CKM_NSS_TLS_MASTER_KEY_DERIVE_SHA256((0x80000000UL | 0x4E534350) + 22)) ||
                     (mechanism == CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256((0x80000000UL | 0x4E534350) + 24))) {
              tlsPrfHash = HASH_AlgSHA256;
          }

          if ((mechanism != CKM_SSL3_MASTER_KEY_DERIVE0x00000371UL) &&
              (mechanism != CKM_SSL3_MASTER_KEY_DERIVE_DH0x00000373UL)) {
              isTLS = PR_TRUE1;
          }
          if ((mechanism == CKM_SSL3_MASTER_KEY_DERIVE_DH0x00000373UL) ||
              (mechanism == CKM_TLS_MASTER_KEY_DERIVE_DH0x00000377UL) ||
              (mechanism == CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256((0x80000000UL | 0x4E534350) + 24)) ||
              (mechanism == CKM_TLS12_MASTER_KEY_DERIVE_DH0x000003E2UL)) {
              isDH = PR_TRUE1;
          }

          /* first do the consistency checks */
          if (!isDH && (att->attrib.ulValueLen != SSL3_PMS_LENGTH48)) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          att2 = sftk_FindAttribute(sourceKey, CKA_KEY_TYPE0x00000100UL);
          if ((att2 == NULL((void*)0)) || (*(CK_KEY_TYPE *)att2->attrib.pValue !=
                                 CKK_GENERIC_SECRET0x00000010UL)) {
              if (att2)
                  sftk_FreeAttribute(att2);
              crv = CKR_KEY_FUNCTION_NOT_PERMITTED0x00000068UL;
              break;
          }
          sftk_FreeAttribute(att2);
          if (keyType != CKK_GENERIC_SECRET0x00000010UL) {
              crv = CKR_KEY_FUNCTION_NOT_PERMITTED0x00000068UL;
              break;
          }
          if ((keySize != 0) && (keySize != SSL3_MASTER_SECRET_LENGTH48)) {
              crv = CKR_KEY_FUNCTION_NOT_PERMITTED0x00000068UL;
              break;
          }

          /* finally do the key gen */
          ssl3_master = (CK_SSL3_MASTER_KEY_DERIVE_PARAMS *)
                            pMechanism->pParameter;

          if (ssl3_master->pVersion) {
              SFTKSessionObject *sessKey = sftk_narrowToSessionObject(key);
              rsa_pms = (SSL3RSAPreMasterSecret *)att->attrib.pValue;
              /* don't leak more key material then necessary for SSL to work */
              if ((sessKey == NULL((void*)0)) || sessKey->wasDerived) {
                  ssl3_master->pVersion->major = 0xff;
                  ssl3_master->pVersion->minor = 0xff;
              } else {
                  ssl3_master->pVersion->major = rsa_pms->client_version[0];
                  ssl3_master->pVersion->minor = rsa_pms->client_version[1];
              }
          }
          if (ssl3_master->RandomInfo.ulClientRandomLen != SSL3_RANDOM_LENGTH32) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          if (ssl3_master->RandomInfo.ulServerRandomLen != SSL3_RANDOM_LENGTH32) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          PORT_Memcpymemcpy(crsrdata,
                      ssl3_master->RandomInfo.pClientRandom, SSL3_RANDOM_LENGTH32);
          PORT_Memcpymemcpy(crsrdata + SSL3_RANDOM_LENGTH32,
                      ssl3_master->RandomInfo.pServerRandom, SSL3_RANDOM_LENGTH32);

          if (isTLS) {
              SECStatus status;
              SECItem crsr = { siBuffer, NULL((void*)0), 0 };
              SECItem master = { siBuffer, NULL((void*)0), 0 };
              SECItem pms = { siBuffer, NULL((void*)0), 0 };

              crsr.data = crsrdata;
              crsr.len = sizeof crsrdata;
              master.data = key_block;
              master.len = SSL3_MASTER_SECRET_LENGTH48;
              pms.data = (unsigned char *)att->attrib.pValue;
              pms.len = att->attrib.ulValueLen;

              if (tlsPrfHash != HASH_AlgNULL) {
                  status = TLS_P_hash(tlsPrfHash, &pms, "master secret",
                                      &crsr, &master, isFIPS);
              } else {
                  status = TLS_PRF(&pms, "master secret", &crsr, &master, isFIPS);
              }
              if (status != SECSuccess) {
                  PORT_Memsetmemset(crsrdata, 0, sizeof crsrdata);
                  crv = CKR_FUNCTION_FAILED0x00000006UL;
                  break;
              }
          } else {
              /* now allocate the hash contexts */
              md5 = MD5_NewContext();
              if (md5 == NULL((void*)0)) {
                  PORT_Memsetmemset(crsrdata, 0, sizeof crsrdata);
                  crv = CKR_HOST_MEMORY0x00000002UL;
                  break;
              }
              sha = SHA1_NewContext();
              if (sha == NULL((void*)0)) {
                  PORT_Memsetmemset(crsrdata, 0, sizeof crsrdata);
                  PORT_FreePORT_Free_Util(md5);
                  crv = CKR_HOST_MEMORY0x00000002UL;
                  break;
              }
              for (i = 0; i < 3; i++) {
                  SHA1_Begin(sha);
                  SHA1_Update(sha, (unsigned char *)mixers[i], strlen(mixers[i]));
                  SHA1_Update(sha, (const unsigned char *)att->attrib.pValue,
                              att->attrib.ulValueLen);
                  SHA1_Update(sha, crsrdata, sizeof crsrdata);
                  SHA1_End(sha, sha_out, &outLen, SHA1_LENGTH20);
                  PORT_Assert(outLen == SHA1_LENGTH)((outLen == 20)?((void)0):PR_Assert("outLen == SHA1_LENGTH","pkcs11c.c"
,7702));

                  MD5_Begin(md5);
                  MD5_Update(md5, (const unsigned char *)att->attrib.pValue,
                             att->attrib.ulValueLen);
                  MD5_Update(md5, sha_out, outLen);
                  MD5_End(md5, &key_block[i * MD5_LENGTH16], &outLen, MD5_LENGTH16);
                  PORT_Assert(outLen == MD5_LENGTH)((outLen == 16)?((void)0):PR_Assert("outLen == MD5_LENGTH","pkcs11c.c"
,7709));
              }
              PORT_FreePORT_Free_Util(md5);
              PORT_FreePORT_Free_Util(sha);
              PORT_Memsetmemset(crsrdata, 0, sizeof crsrdata);
              PORT_Memsetmemset(sha_out, 0, sizeof sha_out);
          }

          /* store the results */
          crv = sftk_forceAttribute(key, CKA_VALUE0x00000011UL, key_block, SSL3_MASTER_SECRET_LENGTH48);
          PORT_Memsetmemset(key_block, 0, sizeof key_block);
          if (crv != CKR_OK0x00000000UL)
              break;
          keyType = CKK_GENERIC_SECRET0x00000010UL;
          crv = sftk_forceAttribute(key, CKA_KEY_TYPE0x00000100UL, &keyType, sizeof(keyType));
          if (isTLS) {
              /* TLS's master secret is used to "sign" finished msgs with PRF. */
              /* XXX This seems like a hack.   But SFTK_Derive only accepts
               * one "operation" argument. */
              crv = sftk_forceAttribute(key, CKA_SIGN0x00000108UL, &cktrue, sizeof(CK_BBOOL));
              if (crv != CKR_OK0x00000000UL)
                  break;
              crv = sftk_forceAttribute(key, CKA_VERIFY0x0000010AUL, &cktrue, sizeof(CK_BBOOL));
              if (crv != CKR_OK0x00000000UL)
                  break;
              /* While we're here, we might as well force this, too. */
              crv = sftk_forceAttribute(key, CKA_DERIVE0x0000010CUL, &cktrue, sizeof(CK_BBOOL));
              if (crv != CKR_OK0x00000000UL)
                  break;
          }
          break;
      }

      /* Extended master key derivation [draft-ietf-tls-session-hash] */
      case CKM_NSS_TLS_EXTENDED_MASTER_KEY_DERIVE((0x80000000UL | 0x4E534350) + 25):
      case CKM_NSS_TLS_EXTENDED_MASTER_KEY_DERIVE_DH((0x80000000UL | 0x4E534350) + 26): {
          CK_NSS_TLS_EXTENDED_MASTER_KEY_DERIVE_PARAMS *ems_params;
          SSL3RSAPreMasterSecret *rsa_pms;
          SECStatus status;
          SECItem pms = { siBuffer, NULL((void*)0), 0 };
          SECItem seed = { siBuffer, NULL((void*)0), 0 };
          SECItem master = { siBuffer, NULL((void*)0), 0 };

          ems_params = (CK_NSS_TLS_EXTENDED_MASTER_KEY_DERIVE_PARAMS *)
                           pMechanism->pParameter;

          /* First do the consistency checks */
          if ((mechanism == CKM_NSS_TLS_EXTENDED_MASTER_KEY_DERIVE((0x80000000UL | 0x4E534350) + 25)) &&
              (att->attrib.ulValueLen != SSL3_PMS_LENGTH48)) {
              crv = CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
              break;
          }
          att2 = sftk_FindAttribute(sourceKey, CKA_KEY_TYPE0x00000100UL);
          if ((att2 == NULL((void*)0)) ||
              (*(CK_KEY_TYPE *)att2->attrib.pValue != CKK_GENERIC_SECRET0x00000010UL)) {
              if (att2)
                  sftk_FreeAttribute(att2);
              crv = CKR_KEY_FUNCTION_NOT_PERMITTED0x00000068UL;
              break;
          }
          sftk_FreeAttribute(att2);
          if (keyType != CKK_GENERIC_SECRET0x00000010UL) {
              crv = CKR_KEY_FUNCTION_NOT_PERMITTED0x00000068UL;
              break;
          }
          if ((keySize != 0) && (keySize != SSL3_MASTER_SECRET_LENGTH48)) {
              crv = CKR_KEY_FUNCTION_NOT_PERMITTED0x00000068UL;
              break;
          }

          /* Do the key derivation */
          pms.data = (unsigned char *)att->attrib.pValue;
          pms.len = att->attrib.ulValueLen;
          seed.data = ems_params->pSessionHash;
          seed.len = ems_params->ulSessionHashLen;
          master.data = key_block;
          master.len = SSL3_MASTER_SECRET_LENGTH48;
          if (ems_params->prfHashMechanism == CKM_TLS_PRF0x00000378UL) {
              /*
               * In this case, the session hash is the concatenation of SHA-1
               * and MD5, so it should be 36 bytes long.
               */
              if (seed.len != MD5_LENGTH16 + SHA1_LENGTH20) {
                  crv = CKR_TEMPLATE_INCONSISTENT0x000000D1UL;
                  break;
              }

              status = TLS_PRF(&pms, "extended master secret",
                               &seed, &master, isFIPS);
          } else {
              const SECHashObject *hashObj;

              tlsPrfHash = sftk_GetHashTypeFromMechanism(ems_params->prfHashMechanism);
              if (tlsPrfHash == HASH_AlgNULL) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }

              hashObj = HASH_GetRawHashObject(tlsPrfHash);
              if (seed.len != hashObj->length) {
                  crv = CKR_TEMPLATE_INCONSISTENT0x000000D1UL;
                  break;
              }

              status = TLS_P_hash(tlsPrfHash, &pms, "extended master secret",
                                  &seed, &master, isFIPS);
          }
          if (status != SECSuccess) {
              crv = CKR_FUNCTION_FAILED0x00000006UL;
              break;
          }

          /* Reflect the version if required */
          if (ems_params->pVersion) {
              SFTKSessionObject *sessKey = sftk_narrowToSessionObject(key);
              rsa_pms = (SSL3RSAPreMasterSecret *)att->attrib.pValue;
              /* don't leak more key material than necessary for SSL to work */
              if ((sessKey == NULL((void*)0)) || sessKey->wasDerived) {
                  ems_params->pVersion->major = 0xff;
                  ems_params->pVersion->minor = 0xff;
              } else {
                  ems_params->pVersion->major = rsa_pms->client_version[0];
                  ems_params->pVersion->minor = rsa_pms->client_version[1];
              }
          }

          /* Store the results */
          crv = sftk_forceAttribute(key, CKA_VALUE0x00000011UL, key_block,
                                    SSL3_MASTER_SECRET_LENGTH48);
          PORT_Memsetmemset(key_block, 0, sizeof key_block);
          break;
      }

      case CKM_TLS12_KEY_AND_MAC_DERIVE0x000003E1UL:
      case CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256((0x80000000UL | 0x4E534350) + 23):
      case CKM_TLS_KEY_AND_MAC_DERIVE0x00000376UL:
      case CKM_SSL3_KEY_AND_MAC_DERIVE0x00000372UL: {
          CK_SSL3_KEY_MAT_PARAMS *ssl3_keys;
          CK_SSL3_KEY_MAT_OUT *ssl3_keys_out;
          CK_ULONG effKeySize;
          unsigned int block_needed;
          unsigned char srcrdata[SSL3_RANDOM_LENGTH32 * 2];

          if (mechanism == CKM_TLS12_KEY_AND_MAC_DERIVE0x000003E1UL) {
              if (BAD_PARAM_CAST(pMechanism, sizeof(CK_TLS12_KEY_MAT_PARAMS))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_TLS12_KEY_MAT_PARAMS))) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
              CK_TLS12_KEY_MAT_PARAMS *tls12_keys =
                  (CK_TLS12_KEY_MAT_PARAMS *)pMechanism->pParameter;
              tlsPrfHash = sftk_GetHashTypeFromMechanism(tls12_keys->prfHashMechanism);
              if (tlsPrfHash == HASH_AlgNULL) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
          } else if (mechanism == CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256((0x80000000UL | 0x4E534350) + 23)) {
              tlsPrfHash = HASH_AlgSHA256;
          }

          if (mechanism != CKM_SSL3_KEY_AND_MAC_DERIVE0x00000372UL) {
              isTLS = PR_TRUE1;
          }

          crv = sftk_DeriveSensitiveCheck(sourceKey, key, PR_FALSE0);
          if (crv != CKR_OK0x00000000UL)
              break;

          if (att->attrib.ulValueLen != SSL3_MASTER_SECRET_LENGTH48) {
              crv = CKR_KEY_FUNCTION_NOT_PERMITTED0x00000068UL;
              break;
          }
          att2 = sftk_FindAttribute(sourceKey, CKA_KEY_TYPE0x00000100UL);
          if ((att2 == NULL((void*)0)) || (*(CK_KEY_TYPE *)att2->attrib.pValue !=
                                 CKK_GENERIC_SECRET0x00000010UL)) {
              if (att2)
                  sftk_FreeAttribute(att2);
              crv = CKR_KEY_FUNCTION_NOT_PERMITTED0x00000068UL;
              break;
          }
          sftk_FreeAttribute(att2);
          md5 = MD5_NewContext();
          if (md5 == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          sha = SHA1_NewContext();
          if (sha == NULL((void*)0)) {
              MD5_DestroyContext(md5, PR_TRUE1);
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }

          if (BAD_PARAM_CAST(pMechanism, sizeof(CK_SSL3_KEY_MAT_PARAMS))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_SSL3_KEY_MAT_PARAMS))) {
              MD5_DestroyContext(md5, PR_TRUE1);
              SHA1_DestroyContext(sha, PR_TRUE1);
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          ssl3_keys = (CK_SSL3_KEY_MAT_PARAMS *)pMechanism->pParameter;

          PORT_Memcpymemcpy(srcrdata,
                      ssl3_keys->RandomInfo.pServerRandom, SSL3_RANDOM_LENGTH32);
          PORT_Memcpymemcpy(srcrdata + SSL3_RANDOM_LENGTH32,
                      ssl3_keys->RandomInfo.pClientRandom, SSL3_RANDOM_LENGTH32);

          /*
           * clear out our returned keys so we can recover on failure
           */
          ssl3_keys_out = ssl3_keys->pReturnedKeyMaterial;
          ssl3_keys_out->hClientMacSecret = CK_INVALID_HANDLE0;
          ssl3_keys_out->hServerMacSecret = CK_INVALID_HANDLE0;
          ssl3_keys_out->hClientKey = CK_INVALID_HANDLE0;
          ssl3_keys_out->hServerKey = CK_INVALID_HANDLE0;

          /*
           * How much key material do we need?
           */
          macSize = ssl3_keys->ulMacSizeInBits / 8;
          effKeySize = ssl3_keys->ulKeySizeInBits / 8;
          IVSize = ssl3_keys->ulIVSizeInBits / 8;
          if (keySize == 0) {
              effKeySize = keySize;
          }

          /* bIsExport must be false. */
          if (ssl3_keys->bIsExport) {
              MD5_DestroyContext(md5, PR_TRUE1);
              SHA1_DestroyContext(sha, PR_TRUE1);
              PORT_Memsetmemset(srcrdata, 0, sizeof srcrdata);
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }

          block_needed = 2 * (macSize + effKeySize + IVSize);
          PORT_Assert(block_needed <= sizeof key_block)((block_needed <= sizeof key_block)?((void)0):PR_Assert("block_needed <= sizeof key_block"
,"pkcs11c.c",7943));
          if (block_needed > sizeof key_block)
              block_needed = sizeof key_block;

          /*
           * generate the key material: This looks amazingly similar to the
           * PMS code, and is clearly crying out for a function to provide it.
           */
          if (isTLS) {
              SECStatus status;
              SECItem srcr = { siBuffer, NULL((void*)0), 0 };
              SECItem keyblk = { siBuffer, NULL((void*)0), 0 };
              SECItem master = { siBuffer, NULL((void*)0), 0 };

              srcr.data = srcrdata;
              srcr.len = sizeof srcrdata;
              keyblk.data = key_block;
              keyblk.len = block_needed;
              master.data = (unsigned char *)att->attrib.pValue;
              master.len = att->attrib.ulValueLen;

              if (tlsPrfHash != HASH_AlgNULL) {
                  status = TLS_P_hash(tlsPrfHash, &master, "key expansion",
                                      &srcr, &keyblk, isFIPS);
              } else {
                  status = TLS_PRF(&master, "key expansion", &srcr, &keyblk,
                                   isFIPS);
              }
              if (status != SECSuccess) {
                  goto key_and_mac_derive_fail;
              }
          } else {
              unsigned int block_bytes = 0;
              /* key_block =
               *     MD5(master_secret + SHA('A' + master_secret +
               *                      ServerHello.random + ClientHello.random)) +
               *     MD5(master_secret + SHA('BB' + master_secret +
               *                      ServerHello.random + ClientHello.random)) +
               *     MD5(master_secret + SHA('CCC' + master_secret +
               *                      ServerHello.random + ClientHello.random)) +
               *     [...];
               */
              for (i = 0; i < NUM_MIXERS9 && block_bytes < block_needed; i++) {
                  SHA1_Begin(sha);
                  SHA1_Update(sha, (unsigned char *)mixers[i], strlen(mixers[i]));
                  SHA1_Update(sha, (const unsigned char *)att->attrib.pValue,
                              att->attrib.ulValueLen);
                  SHA1_Update(sha, srcrdata, sizeof srcrdata);
                  SHA1_End(sha, sha_out, &outLen, SHA1_LENGTH20);
                  PORT_Assert(outLen == SHA1_LENGTH)((outLen == 20)?((void)0):PR_Assert("outLen == SHA1_LENGTH","pkcs11c.c"
,7992));
                  MD5_Begin(md5);
                  MD5_Update(md5, (const unsigned char *)att->attrib.pValue,
                             att->attrib.ulValueLen);
                  MD5_Update(md5, sha_out, outLen);
                  MD5_End(md5, &key_block[i * MD5_LENGTH16], &outLen, MD5_LENGTH16);
                  PORT_Assert(outLen == MD5_LENGTH)((outLen == 16)?((void)0):PR_Assert("outLen == MD5_LENGTH","pkcs11c.c"
,7998));
                  block_bytes += outLen;
              }
              PORT_Memsetmemset(sha_out, 0, sizeof sha_out);
          }

          /*
           * Put the key material where it goes.
           */
          i = 0; /* now shows how much consumed */

          /*
           * The key_block is partitioned as follows:
           * client_write_MAC_secret[CipherSpec.hash_size]
           */
          crv = sftk_buildSSLKey(hSession, key, PR_TRUE1, &key_block[i], macSize,
                                 &ssl3_keys_out->hClientMacSecret);
          if (crv != CKR_OK0x00000000UL)
              goto key_and_mac_derive_fail;

          i += macSize;

          /*
           * server_write_MAC_secret[CipherSpec.hash_size]
           */
          crv = sftk_buildSSLKey(hSession, key, PR_TRUE1, &key_block[i], macSize,
                                 &ssl3_keys_out->hServerMacSecret);
          if (crv != CKR_OK0x00000000UL) {
              goto key_and_mac_derive_fail;
          }
          i += macSize;

          if (keySize) {
              /*
              ** Generate Domestic write keys and IVs.
              ** client_write_key[CipherSpec.key_material]
              */
              crv = sftk_buildSSLKey(hSession, key, PR_FALSE0, &key_block[i],
                                     keySize, &ssl3_keys_out->hClientKey);
              if (crv != CKR_OK0x00000000UL) {
                  goto key_and_mac_derive_fail;
              }
              i += keySize;

              /*
              ** server_write_key[CipherSpec.key_material]
              */
              crv = sftk_buildSSLKey(hSession, key, PR_FALSE0, &key_block[i],
                                     keySize, &ssl3_keys_out->hServerKey);
              if (crv != CKR_OK0x00000000UL) {
                  goto key_and_mac_derive_fail;
              }
              i += keySize;

              /*
              ** client_write_IV[CipherSpec.IV_size]
              */
              if (IVSize > 0) {
                  PORT_Memcpymemcpy(ssl3_keys_out->pIVClient,
                              &key_block[i], IVSize);
                  i += IVSize;
              }

              /*
              ** server_write_IV[CipherSpec.IV_size]
              */
              if (IVSize > 0) {
                  PORT_Memcpymemcpy(ssl3_keys_out->pIVServer,
                              &key_block[i], IVSize);
                  i += IVSize;
              }
              PORT_Assert(i <= sizeof key_block)((i <= sizeof key_block)?((void)0):PR_Assert("i <= sizeof key_block"
,"pkcs11c.c",8069));
          }

          crv = CKR_OK0x00000000UL;

          if (0) {
          key_and_mac_derive_fail:
              if (crv == CKR_OK0x00000000UL)
                  crv = CKR_FUNCTION_FAILED0x00000006UL;
              sftk_freeSSLKeys(hSession, ssl3_keys_out);
          }
          PORT_Memsetmemset(srcrdata, 0, sizeof srcrdata);
          PORT_Memsetmemset(key_block, 0, sizeof key_block);
          MD5_DestroyContext(md5, PR_TRUE1);
          SHA1_DestroyContext(sha, PR_TRUE1);
          sftk_FreeObject(key);
          key = NULL((void*)0);
          break;
      }

      case CKM_DES3_ECB_ENCRYPT_DATA0x00001102UL:
      case CKM_DES3_CBC_ENCRYPT_DATA0x00001103UL: {
          void *cipherInfo;
          unsigned char des3key[MAX_DES3_KEY_SIZE24];
          CK_DES_CBC_ENCRYPT_DATA_PARAMS *desEncryptPtr;
          int mode;
          unsigned char *iv;
          unsigned char *data;
          CK_ULONG len;

          if (mechanism == CKM_DES3_ECB_ENCRYPT_DATA0x00001102UL) {
              if (BAD_PARAM_CAST(pMechanism, sizeof(CK_KEY_DERIVATION_STRING_DATA))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_KEY_DERIVATION_STRING_DATA))) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
              stringPtr = (CK_KEY_DERIVATION_STRING_DATA *)
                              pMechanism->pParameter;
              mode = NSS_DES_EDE32;
              iv = NULL((void*)0);
              data = stringPtr->pData;
              len = stringPtr->ulLen;
          } else {
              mode = NSS_DES_EDE3_CBC3;
              desEncryptPtr =
                  (CK_DES_CBC_ENCRYPT_DATA_PARAMS *)
                      pMechanism->pParameter;
              iv = desEncryptPtr->iv;
              data = desEncryptPtr->pData;
              len = desEncryptPtr->length;
          }
          if (att->attrib.ulValueLen == 16) {
              PORT_Memcpymemcpy(des3key, att->attrib.pValue, 16);
              PORT_Memcpymemcpy(des3key + 16, des3key, 8);
          } else if (att->attrib.ulValueLen == 24) {
              PORT_Memcpymemcpy(des3key, att->attrib.pValue, 24);
          } else {
              crv = CKR_KEY_SIZE_RANGE0x00000062UL;
              break;
          }
          cipherInfo = DES_CreateContext(des3key, iv, mode, PR_TRUE1);
          PORT_Memsetmemset(des3key, 0, 24);
          if (cipherInfo == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          crv = sftk_DeriveEncrypt((SFTKCipher)DES_Encrypt,
                                   cipherInfo, 8, key, keySize,
                                   data, len);
          DES_DestroyContext(cipherInfo, PR_TRUE1);
          break;
      }

      case CKM_AES_ECB_ENCRYPT_DATA0x00001104UL:
      case CKM_AES_CBC_ENCRYPT_DATA0x00001105UL: {
          void *cipherInfo;
          CK_AES_CBC_ENCRYPT_DATA_PARAMS *aesEncryptPtr;
          int mode;
          unsigned char *iv;
          unsigned char *data;
          CK_ULONG len;

          if (mechanism == CKM_AES_ECB_ENCRYPT_DATA0x00001104UL) {
              mode = NSS_AES0;
              iv = NULL((void*)0);
              if (BAD_PARAM_CAST(pMechanism, sizeof(CK_KEY_DERIVATION_STRING_DATA))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_KEY_DERIVATION_STRING_DATA))) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
              stringPtr = (CK_KEY_DERIVATION_STRING_DATA *)pMechanism->pParameter;
              data = stringPtr->pData;
              len = stringPtr->ulLen;
          } else {
              if (BAD_PARAM_CAST(pMechanism, sizeof(CK_AES_CBC_ENCRYPT_DATA_PARAMS))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_AES_CBC_ENCRYPT_DATA_PARAMS))) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
              aesEncryptPtr =
                  (CK_AES_CBC_ENCRYPT_DATA_PARAMS *)pMechanism->pParameter;
              mode = NSS_AES_CBC1;
              iv = aesEncryptPtr->iv;
              data = aesEncryptPtr->pData;
              len = aesEncryptPtr->length;
          }

          cipherInfo = AES_CreateContext((unsigned char *)att->attrib.pValue,
                                         iv, mode, PR_TRUE1,
                                         att->attrib.ulValueLen, 16);
          if (cipherInfo == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          crv = sftk_DeriveEncrypt((SFTKCipher)AES_Encrypt,
                                   cipherInfo, 16, key, keySize,
                                   data, len);
          AES_DestroyContext(cipherInfo, PR_TRUE1);
          break;
      }

      case CKM_CAMELLIA_ECB_ENCRYPT_DATA0x00000556UL:
      case CKM_CAMELLIA_CBC_ENCRYPT_DATA0x00000557UL: {
          void *cipherInfo;
          CK_AES_CBC_ENCRYPT_DATA_PARAMS *aesEncryptPtr;
          int mode;
          unsigned char *iv;
          unsigned char *data;
          CK_ULONG len;

          if (mechanism == CKM_CAMELLIA_ECB_ENCRYPT_DATA0x00000556UL) {
              if (BAD_PARAM_CAST(pMechanism, sizeof(CK_KEY_DERIVATION_STRING_DATA))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_KEY_DERIVATION_STRING_DATA))) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
              stringPtr = (CK_KEY_DERIVATION_STRING_DATA *)
                              pMechanism->pParameter;
              aesEncryptPtr = NULL((void*)0);
              mode = NSS_CAMELLIA0;
              data = stringPtr->pData;
              len = stringPtr->ulLen;
              iv = NULL((void*)0);
          } else {
              if (BAD_PARAM_CAST(pMechanism, sizeof(CK_AES_CBC_ENCRYPT_DATA_PARAMS))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_AES_CBC_ENCRYPT_DATA_PARAMS))) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
              stringPtr = NULL((void*)0);
              aesEncryptPtr = (CK_AES_CBC_ENCRYPT_DATA_PARAMS *)
                                  pMechanism->pParameter;
              mode = NSS_CAMELLIA_CBC1;
              iv = aesEncryptPtr->iv;
              data = aesEncryptPtr->pData;
              len = aesEncryptPtr->length;
          }

          cipherInfo = Camellia_CreateContext((unsigned char *)att->attrib.pValue,
                                              iv, mode, PR_TRUE1,
                                              att->attrib.ulValueLen);
          if (cipherInfo == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          crv = sftk_DeriveEncrypt((SFTKCipher)Camellia_Encrypt,
                                   cipherInfo, 16, key, keySize,
                                   data, len);
          Camellia_DestroyContext(cipherInfo, PR_TRUE1);
          break;
      }

8236#ifndef NSS_DISABLE_DEPRECATED_SEED
      case CKM_SEED_ECB_ENCRYPT_DATA0x00000656UL:
      case CKM_SEED_CBC_ENCRYPT_DATA0x00000657UL: {
          void *cipherInfo;
          CK_AES_CBC_ENCRYPT_DATA_PARAMS *aesEncryptPtr;
          int mode;
          unsigned char *iv;
          unsigned char *data;
          CK_ULONG len;

          if (mechanism == CKM_SEED_ECB_ENCRYPT_DATA0x00000656UL) {
              if (BAD_PARAM_CAST(pMechanism, sizeof(CK_KEY_DERIVATION_STRING_DATA))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_KEY_DERIVATION_STRING_DATA))) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
              mode = NSS_SEED0;
              stringPtr = (CK_KEY_DERIVATION_STRING_DATA *)
                              pMechanism->pParameter;
              aesEncryptPtr = NULL((void*)0);
              data = stringPtr->pData;
              len = stringPtr->ulLen;
              iv = NULL((void*)0);
          } else {
              if (BAD_PARAM_CAST(pMechanism, sizeof(CK_AES_CBC_ENCRYPT_DATA_PARAMS))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_AES_CBC_ENCRYPT_DATA_PARAMS))) {
                  crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
                  break;
              }
              mode = NSS_SEED_CBC1;
              aesEncryptPtr = (CK_AES_CBC_ENCRYPT_DATA_PARAMS *)
                                  pMechanism->pParameter;
              iv = aesEncryptPtr->iv;
              data = aesEncryptPtr->pData;
              len = aesEncryptPtr->length;
          }

          cipherInfo = SEED_CreateContext((unsigned char *)att->attrib.pValue,
                                          iv, mode, PR_TRUE1);
          if (cipherInfo == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          crv = sftk_DeriveEncrypt((SFTKCipher)SEED_Encrypt,
                                   cipherInfo, 16, key, keySize,
                                   data, len);
          SEED_DestroyContext(cipherInfo, PR_TRUE1);
          break;
      }
8283#endif /* NSS_DISABLE_DEPRECATED_SEED */

      case CKM_CONCATENATE_BASE_AND_KEY0x00000360UL: {
          SFTKObject *paramKey;

          crv = sftk_DeriveSensitiveCheck(sourceKey, key, PR_FALSE0);
          if (crv != CKR_OK0x00000000UL)
              break;

          session = sftk_SessionFromHandle(hSession);
          if (session == NULL((void*)0)) {
              crv = CKR_SESSION_HANDLE_INVALID0x000000B3UL;
              break;
          }

          paramKey = sftk_ObjectFromHandle(*(CK_OBJECT_HANDLE *)
                                                pMechanism->pParameter,
                                           session);
          sftk_FreeSession(session);
          if (paramKey == NULL((void*)0)) {
              crv = CKR_KEY_HANDLE_INVALID0x00000060UL;
              break;
          }

          if (sftk_isTrue(paramKey, CKA_SENSITIVE0x00000103UL)) {
              crv = sftk_forceAttribute(key, CKA_SENSITIVE0x00000103UL, &cktrue,
                                        sizeof(CK_BBOOL));
              if (crv != CKR_OK0x00000000UL) {
                  sftk_FreeObject(paramKey);
                  break;
              }
          }

          if (sftk_hasAttribute(paramKey, CKA_EXTRACTABLE0x00000162UL) && !sftk_isTrue(paramKey, CKA_EXTRACTABLE0x00000162UL)) {
              crv = sftk_forceAttribute(key, CKA_EXTRACTABLE0x00000162UL, &ckfalse, sizeof(CK_BBOOL));
              if (crv != CKR_OK0x00000000UL) {
                  sftk_FreeObject(paramKey);
                  break;
              }
          }

          att2 = sftk_FindAttribute(paramKey, CKA_VALUE0x00000011UL);
          if (att2 == NULL((void*)0)) {
              sftk_FreeObject(paramKey);
              crv = CKR_KEY_HANDLE_INVALID0x00000060UL;
              break;
          }
          tmpKeySize = att->attrib.ulValueLen + att2->attrib.ulValueLen;
          if (keySize == 0)
              keySize = tmpKeySize;
          if (keySize > tmpKeySize) {
              sftk_FreeObject(paramKey);
              sftk_FreeAttribute(att2);
              crv = CKR_TEMPLATE_INCONSISTENT0x000000D1UL;
              break;
          }
          buf = (unsigned char *)PORT_AllocPORT_Alloc_Util(tmpKeySize);
          if (buf == NULL((void*)0)) {
              sftk_FreeAttribute(att2);
              sftk_FreeObject(paramKey);
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }

          PORT_Memcpymemcpy(buf, att->attrib.pValue, att->attrib.ulValueLen);
          PORT_Memcpymemcpy(buf + att->attrib.ulValueLen,
                      att2->attrib.pValue, att2->attrib.ulValueLen);

          crv = sftk_forceAttribute(key, CKA_VALUE0x00000011UL, buf, keySize);
          PORT_ZFreePORT_ZFree_Util(buf, tmpKeySize);
          sftk_FreeAttribute(att2);
          sftk_FreeObject(paramKey);
          break;
      }

      case CKM_CONCATENATE_BASE_AND_DATA0x00000362UL:
          crv = sftk_DeriveSensitiveCheck(sourceKey, key, PR_FALSE0);
          if (crv != CKR_OK0x00000000UL)
              break;

          if (BAD_PARAM_CAST(pMechanism, sizeof(CK_KEY_DERIVATION_STRING_DATA))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_KEY_DERIVATION_STRING_DATA))) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          stringPtr = (CK_KEY_DERIVATION_STRING_DATA *)pMechanism->pParameter;
          tmpKeySize = att->attrib.ulValueLen + stringPtr->ulLen;
          if (keySize == 0)
              keySize = tmpKeySize;
          if (keySize > tmpKeySize) {
              crv = CKR_TEMPLATE_INCONSISTENT0x000000D1UL;
              break;
          }
          buf = (unsigned char *)PORT_AllocPORT_Alloc_Util(tmpKeySize);
          if (buf == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }

          PORT_Memcpymemcpy(buf, att->attrib.pValue, att->attrib.ulValueLen);
          PORT_Memcpymemcpy(buf + att->attrib.ulValueLen, stringPtr->pData,
                      stringPtr->ulLen);

          crv = sftk_forceAttribute(key, CKA_VALUE0x00000011UL, buf, keySize);
          PORT_ZFreePORT_ZFree_Util(buf, tmpKeySize);
          break;
      case CKM_CONCATENATE_DATA_AND_BASE0x00000363UL:
          crv = sftk_DeriveSensitiveCheck(sourceKey, key, PR_FALSE0);
          if (crv != CKR_OK0x00000000UL)
              break;

          if (BAD_PARAM_CAST(pMechanism, sizeof(CK_KEY_DERIVATION_STRING_DATA))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_KEY_DERIVATION_STRING_DATA))) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          stringPtr = (CK_KEY_DERIVATION_STRING_DATA *)pMechanism->pParameter;
          tmpKeySize = att->attrib.ulValueLen + stringPtr->ulLen;
          if (keySize == 0)
              keySize = tmpKeySize;
          if (keySize > tmpKeySize) {
              crv = CKR_TEMPLATE_INCONSISTENT0x000000D1UL;
              break;
          }
          buf = (unsigned char *)PORT_AllocPORT_Alloc_Util(tmpKeySize);
          if (buf == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }

          PORT_Memcpymemcpy(buf, stringPtr->pData, stringPtr->ulLen);
          PORT_Memcpymemcpy(buf + stringPtr->ulLen, att->attrib.pValue,
                      att->attrib.ulValueLen);

          crv = sftk_forceAttribute(key, CKA_VALUE0x00000011UL, buf, keySize);
          PORT_ZFreePORT_ZFree_Util(buf, tmpKeySize);
          break;
      case CKM_XOR_BASE_AND_DATA0x00000364UL:
          crv = sftk_DeriveSensitiveCheck(sourceKey, key, PR_FALSE0);
          if (crv != CKR_OK0x00000000UL)
              break;

          if (BAD_PARAM_CAST(pMechanism, sizeof(CK_KEY_DERIVATION_STRING_DATA))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_KEY_DERIVATION_STRING_DATA))) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          stringPtr = (CK_KEY_DERIVATION_STRING_DATA *)pMechanism->pParameter;
          tmpKeySize = PR_MIN(att->attrib.ulValueLen, stringPtr->ulLen)((att->attrib.ulValueLen)<(stringPtr->ulLen)?(att->
attrib.ulValueLen):(stringPtr->ulLen));
          if (keySize == 0)
              keySize = tmpKeySize;
          if (keySize > tmpKeySize) {
              crv = CKR_TEMPLATE_INCONSISTENT0x000000D1UL;
              break;
          }
          buf = (unsigned char *)PORT_AllocPORT_Alloc_Util(keySize);
          if (buf == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }

          PORT_Memcpymemcpy(buf, att->attrib.pValue, keySize);
          for (i = 0; i < (int)keySize; i++) {
              buf[i] ^= stringPtr->pData[i];
          }

          crv = sftk_forceAttribute(key, CKA_VALUE0x00000011UL, buf, keySize);
          PORT_ZFreePORT_ZFree_Util(buf, keySize);
          break;

      case CKM_EXTRACT_KEY_FROM_KEY0x00000365UL: {
          if (BAD_PARAM_CAST(pMechanism, sizeof(CK_EXTRACT_PARAMS))(!pMechanism->pParameter || pMechanism->ulParameterLen <
 sizeof(CK_EXTRACT_PARAMS))) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          /* the following assumes 8 bits per byte */
          CK_ULONG extract = *(CK_EXTRACT_PARAMS *)pMechanism->pParameter;
          CK_ULONG shift = extract & 0x7; /* extract mod 8 the fast way */
          CK_ULONG offset = extract >> 3; /* extract div 8 the fast way */

          crv = sftk_DeriveSensitiveCheck(sourceKey, key, PR_FALSE0);
          if (crv != CKR_OK0x00000000UL)
              break;

          if (keySize == 0) {
              crv = CKR_TEMPLATE_INCOMPLETE0x000000D0UL;
              break;
          }
          /* make sure we have enough bits in the original key */
          if (att->attrib.ulValueLen <
              (offset + keySize + ((shift != 0) ? 1 : 0))) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          buf = (unsigned char *)PORT_AllocPORT_Alloc_Util(keySize);
          if (buf == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }

          /* copy the bits we need into the new key */
          for (i = 0; i < (int)keySize; i++) {
              unsigned char *value =
                  ((unsigned char *)att->attrib.pValue) + offset + i;
              if (shift) {
                  buf[i] = (value[0] << (shift)) | (value[1] >> (8 - shift));
              } else {
                  buf[i] = value[0];
              }
          }

          crv = sftk_forceAttribute(key, CKA_VALUE0x00000011UL, buf, keySize);
          PORT_ZFreePORT_ZFree_Util(buf, keySize);
          break;
      }
      case CKM_MD2_KEY_DERIVATION0x00000391UL:
          if (keySize == 0)
              keySize = MD2_LENGTH16;
          if (keySize > MD2_LENGTH16) {
              crv = CKR_TEMPLATE_INCONSISTENT0x000000D1UL;
              break;
          }
          /* now allocate the hash contexts */
          md2 = MD2_NewContext();
          if (md2 == NULL((void*)0)) {
              crv = CKR_HOST_MEMORY0x00000002UL;
              break;
          }
          MD2_Begin(md2);
          MD2_Update(md2, (const unsigned char *)att->attrib.pValue,
                     att->attrib.ulValueLen);
          MD2_End(md2, key_block, &outLen, MD2_LENGTH16);
          MD2_DestroyContext(md2, PR_TRUE1);

          crv = sftk_forceAttribute(key, CKA_VALUE0x00000011UL, key_block, keySize);
          PORT_Memsetmemset(key_block, 0, MD2_LENGTH16);
          break;
8517#define DERIVE_KEY_HASH(hash)case CKM_hash_KEY_DERIVATION: if (keySize == 0) keySize = hash_LENGTH
; if (keySize > hash_LENGTH) { crv = 0x000000D1UL; break; }
 hash_HashBuf(key_block, (const unsigned char *)att->attrib
.pValue, att->attrib.ulValueLen); crv = sftk_forceAttribute
(key, 0x00000011UL, key_block, keySize); memset(key_block, 0,
 hash_LENGTH); break;                                                \
  case CKM_##hash##_KEY_DERIVATION:                                        \
      if (keySize == 0)                                                    \
          keySize = hash##_LENGTH;                                         \
      if (keySize > hash##_LENGTH) {                                       \
          crv = CKR_TEMPLATE_INCONSISTENT0x000000D1UL;                                 \
          break;                                                           \
      }                                                                    \
      hash##_HashBuf(key_block, (const unsigned char *)att->attrib.pValue, \
                     att->attrib.ulValueLen);                              \
      crv = sftk_forceAttribute(key, CKA_VALUE0x00000011UL, key_block, keySize);       \
      PORT_Memsetmemset(key_block, 0, hash##_LENGTH);                            \
      break;
          DERIVE_KEY_HASH(MD5)case 0x00000390UL: if (keySize == 0) keySize = 16; if (keySize
 > 16) { crv = 0x000000D1UL; break; } MD5_HashBuf(key_block
, (const unsigned char *)att->attrib.pValue, att->attrib
.ulValueLen); crv = sftk_forceAttribute(key, 0x00000011UL, key_block
, keySize); memset(key_block, 0, 16); break;
          DERIVE_KEY_HASH(SHA1)case 0x00000392UL: if (keySize == 0) keySize = 20; if (keySize
 > 20) { crv = 0x000000D1UL; break; } SHA1_HashBuf(key_block
, (const unsigned char *)att->attrib.pValue, att->attrib
.ulValueLen); crv = sftk_forceAttribute(key, 0x00000011UL, key_block
, keySize); memset(key_block, 0, 20); break;
          DERIVE_KEY_HASH(SHA224)case 0x00000396UL: if (keySize == 0) keySize = 28; if (keySize
 > 28) { crv = 0x000000D1UL; break; } SHA224_HashBuf(key_block
, (const unsigned char *)att->attrib.pValue, att->attrib
.ulValueLen); crv = sftk_forceAttribute(key, 0x00000011UL, key_block
, keySize); memset(key_block, 0, 28); break;
          DERIVE_KEY_HASH(SHA256)case 0x00000393UL: if (keySize == 0) keySize = 32; if (keySize
 > 32) { crv = 0x000000D1UL; break; } SHA256_HashBuf(key_block
, (const unsigned char *)att->attrib.pValue, att->attrib
.ulValueLen); crv = sftk_forceAttribute(key, 0x00000011UL, key_block
, keySize); memset(key_block, 0, 32); break;
          DERIVE_KEY_HASH(SHA384)case 0x00000394UL: if (keySize == 0) keySize = 48; if (keySize
 > 48) { crv = 0x000000D1UL; break; } SHA384_HashBuf(key_block
, (const unsigned char *)att->attrib.pValue, att->attrib
.ulValueLen); crv = sftk_forceAttribute(key, 0x00000011UL, key_block
, keySize); memset(key_block, 0, 48); break;
          DERIVE_KEY_HASH(SHA512)case 0x00000395UL: if (keySize == 0) keySize = 64; if (keySize
 > 64) { crv = 0x000000D1UL; break; } SHA512_HashBuf(key_block
, (const unsigned char *)att->attrib.pValue, att->attrib
.ulValueLen); crv = sftk_forceAttribute(key, 0x00000011UL, key_block
, keySize); memset(key_block, 0, 64); break;
          DERIVE_KEY_HASH(SHA3_224)case 0x00000398UL: if (keySize == 0) keySize = 28; if (keySize
 > 28) { crv = 0x000000D1UL; break; } SHA3_224_HashBuf(key_block
, (const unsigned char *)att->attrib.pValue, att->attrib
.ulValueLen); crv = sftk_forceAttribute(key, 0x00000011UL, key_block
, keySize); memset(key_block, 0, 28); break;
          DERIVE_KEY_HASH(SHA3_256)case 0x00000397UL: if (keySize == 0) keySize = 32; if (keySize
 > 32) { crv = 0x000000D1UL; break; } SHA3_256_HashBuf(key_block
, (const unsigned char *)att->attrib.pValue, att->attrib
.ulValueLen); crv = sftk_forceAttribute(key, 0x00000011UL, key_block
, keySize); memset(key_block, 0, 32); break;
          DERIVE_KEY_HASH(SHA3_384)case 0x00000399UL: if (keySize == 0) keySize = 48; if (keySize
 > 48) { crv = 0x000000D1UL; break; } SHA3_384_HashBuf(key_block
, (const unsigned char *)att->attrib.pValue, att->attrib
.ulValueLen); crv = sftk_forceAttribute(key, 0x00000011UL, key_block
, keySize); memset(key_block, 0, 48); break;
          DERIVE_KEY_HASH(SHA3_512)case 0x0000039AUL: if (keySize == 0) keySize = 64; if (keySize
 > 64) { crv = 0x000000D1UL; break; } SHA3_512_HashBuf(key_block
, (const unsigned char *)att->attrib.pValue, att->attrib
.ulValueLen); crv = sftk_forceAttribute(key, 0x00000011UL, key_block
, keySize); memset(key_block, 0, 64); break;

      case CKM_DH_PKCS_DERIVE0x00000021UL: {
          SECItem derived, dhPublic;
          SECItem dhPrime, dhValue;
          const SECItem *subPrime;
          /* sourceKey - values for the local existing low key */
          /* get prime and value attributes */
          crv = sftk_Attribute2SecItem(NULL((void*)0), &dhPrime, sourceKey, CKA_PRIME0x00000130UL);
          if (crv != CKR_OK0x00000000UL)
              break;

          dhPublic.data = pMechanism->pParameter;
          dhPublic.len = pMechanism->ulParameterLen;

          /* if the prime is an approved prime, we can skip all the other
           * checks. */
          subPrime = sftk_VerifyDH_Prime(&dhPrime, isFIPS);
          if (subPrime == NULL((void*)0)) {
              SECItem dhSubPrime;
              /* If the caller set the subprime value, it means that
               * either the caller knows the subprime value and wants us
               * to validate the key against the subprime, or that the
               * caller wants us to verify that the prime is a safe prime
               * by passing in subprime = (prime-1)/2 */
              dhSubPrime.data = NULL((void*)0);
              dhSubPrime.len = 0;
              crv = sftk_Attribute2SecItem(NULL((void*)0), &dhSubPrime,
                                           sourceKey, CKA_SUBPRIME0x00000131UL);
              /* we ignore the value of crv here, We treat a valid
              * return of len = 0 and a failure to find a subrime the same
              * NOTE: we free the subprime in both cases depending on
              * PORT_Free of NULL to be a noop */
              if (dhSubPrime.len != 0) {
                  PRBool isSafe = PR_FALSE0;

                  /* Callers can set dhSubPrime to q=(p-1)/2 to force
                   * checks for safe primes. If so we only need to check
                   * q and p for primality and skip the group test.  */
                  rv = sftk_IsSafePrime(&dhPrime, &dhSubPrime, &isSafe);
                  if (rv != SECSuccess) {
                      /* either p or q was even and therefore not prime,
                       * we can stop processing here and fail now */
                      crv = CKR_ARGUMENTS_BAD0x00000007UL;
                      SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhPrime, PR_FALSE0);
                      SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhSubPrime, PR_FALSE0);
                      break;
                  }

                  /* first make sure the primes are really prime */
                  if (!KEA_PrimeCheck(&dhPrime)) {
                      crv = CKR_ARGUMENTS_BAD0x00000007UL;
                      SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhPrime, PR_FALSE0);
                      SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhSubPrime, PR_FALSE0);
                      break;
                  }
                  if (!KEA_PrimeCheck(&dhSubPrime)) {
                      crv = CKR_ARGUMENTS_BAD0x00000007UL;
                      SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhPrime, PR_FALSE0);
                      SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhSubPrime, PR_FALSE0);
                      break;
                  }
                  if (isFIPS || !isSafe) {
                      /* With safe primes, there is only one other small
                       * subgroup. As long as y isn't 0, 1, or -1 mod p,
                       * any other y is safe. Only do the full check for
                       * non-safe primes, except in FIPS mode we need
                       * to do this check on all primes in which
                       * we receive the subprime value */
                      if (!KEA_Verify(&dhPublic, &dhPrime, &dhSubPrime)) {
                          crv = CKR_ARGUMENTS_BAD0x00000007UL;
                          SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhPrime, PR_FALSE0);
                          SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhSubPrime, PR_FALSE0);
                          break;
                      }
                  }
              } else if (isFIPS) {
                  /* In FIPS mode we only accept approved primes, or
                   * primes with the full subprime value */
                  crv = CKR_ARGUMENTS_BAD0x00000007UL;
                  SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhPrime, PR_FALSE0);
                  break;
              }
              /* checks are complete, no need for the subPrime any longer */
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhSubPrime, PR_FALSE0);
          }

          /* now that the prime is validated, get the private value */
          crv = sftk_Attribute2SecItem(NULL((void*)0), &dhValue, sourceKey, CKA_VALUE0x00000011UL);
          if (crv != CKR_OK0x00000000UL) {
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhPrime, PR_FALSE0);
              break;
          }

          /* calculate private value - oct */
          rv = DH_Derive(&dhPublic, &dhPrime, &dhValue, &derived, keySize);

          SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhPrime, PR_FALSE0);
          SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&dhValue, PR_FALSE0);

          if (rv == SECSuccess) {
              sftk_forceAttribute(key, CKA_VALUE0x00000011UL, derived.data, derived.len);
              SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&derived, PR_FALSE0);
              crv = CKR_OK0x00000000UL;
          } else
              crv = CKR_HOST_MEMORY0x00000002UL;

          break;
      }

      case CKM_ECDH1_DERIVE0x00001050UL:
      case CKM_ECDH1_COFACTOR_DERIVE0x00001051UL: {
          SECItem ecScalar, ecPoint;
          SECItem tmp;
          PRBool withCofactor = PR_FALSE0;
          unsigned char *secret;
          unsigned char *keyData = NULL((void*)0);
          unsigned int secretlen, pubKeyLen;
          CK_ECDH1_DERIVE_PARAMS *mechParams;
          NSSLOWKEYPrivateKey *privKey;
          PLArenaPool *arena = NULL((void*)0);

          /* Check mechanism parameters */
          mechParams = (CK_ECDH1_DERIVE_PARAMS *)pMechanism->pParameter;
          if ((pMechanism->ulParameterLen != sizeof(CK_ECDH1_DERIVE_PARAMS)) ||
              ((mechParams->kdf == CKD_NULL0x00000001UL) &&
               ((mechParams->ulSharedDataLen != 0) ||
                (mechParams->pSharedData != NULL((void*)0))))) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }

          privKey = sftk_GetPrivKey(sourceKey, CKK_EC0x00000003UL, &crv);
          if (privKey == NULL((void*)0)) {
              break;
          }

          /* Now we are working with a non-NULL private key */
          SECITEM_CopyItemSECITEM_CopyItem_Util(NULL((void*)0), &ecScalar, &privKey->u.ec.privateValue);

          ecPoint.data = mechParams->pPublicData;
          ecPoint.len = mechParams->ulPublicDataLen;

          pubKeyLen = EC_GetPointSize(&privKey->u.ec.ecParams);

          /* if the len is too large, might be an encoded point */
          if (ecPoint.len > pubKeyLen) {
              SECItem newPoint;

              arena = PORT_NewArenaPORT_NewArena_Util(DER_DEFAULT_CHUNKSIZE(2048));
              if (arena == NULL((void*)0)) {
                  goto ec_loser;
              }

              rv = SEC_QuickDERDecodeItemSEC_QuickDERDecodeItem_Util(arena, &newPoint,
                                          SEC_ASN1_GET(SEC_OctetStringTemplate)SEC_OctetStringTemplate_Util,
                                          &ecPoint);
              if (rv != SECSuccess) {
                  goto ec_loser;
              }
              ecPoint = newPoint;
          }

          if (mechanism == CKM_ECDH1_COFACTOR_DERIVE0x00001051UL) {
              withCofactor = PR_TRUE1;
          }

          rv = ECDH_Derive(&ecPoint, &privKey->u.ec.ecParams, &ecScalar,
                           withCofactor, &tmp);
          SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&ecScalar, PR_FALSE0);
          ecScalar.data = NULL((void*)0);
          if (privKey != sourceKey->objectInfo) {
              nsslowkey_DestroyPrivateKey(privKey);
              privKey = NULL((void*)0);
          }
          if (arena) {
              PORT_FreeArenaPORT_FreeArena_Util(arena, PR_FALSE0);
              arena = NULL((void*)0);
          }

          if (rv != SECSuccess) {
              crv = sftk_MapCryptError(PORT_GetErrorPORT_GetError_Util());
              break;
          }

          /*
           * apply the kdf function.
           */
          if (mechParams->kdf == CKD_NULL0x00000001UL) {
              /*
           * tmp is the raw data created by ECDH_Derive,
           * secret and secretlen are the values we will
           * eventually pass as our generated key.
           */
              secret = tmp.data;
              secretlen = tmp.len;
          } else {
              secretlen = keySize;
              crv = sftk_ANSI_X9_63_kdf(&secret, keySize,
                                        &tmp, mechParams->pSharedData,
                                        mechParams->ulSharedDataLen, mechParams->kdf);
              PORT_ZFreePORT_ZFree_Util(tmp.data, tmp.len);
              if (crv != CKR_OK0x00000000UL) {
                  break;
              }
              tmp.data = secret;
              tmp.len = secretlen;
          }

          /*
           * if keySize is supplied, then we are generating a key of a specific
           * length. This is done by taking the least significant 'keySize'
           * bytes from the unsigned value calculated by ECDH. Note: this may
           * mean padding temp with extra leading zeros from what ECDH_Derive
           * already returned (which itself may contain leading zeros).
           */
          if (keySize) {
              if (secretlen < keySize) {
                  keyData = PORT_ZAllocPORT_ZAlloc_Util(keySize);
                  if (!keyData) {
                      PORT_ZFreePORT_ZFree_Util(tmp.data, tmp.len);
                      crv = CKR_HOST_MEMORY0x00000002UL;
                      break;
                  }
                  PORT_Memcpymemcpy(&keyData[keySize - secretlen], secret, secretlen);
                  secret = keyData;
              } else {
                  secret += (secretlen - keySize);
              }
              secretlen = keySize;
          }

          sftk_forceAttribute(key, CKA_VALUE0x00000011UL, secret, secretlen);
          PORT_ZFreePORT_ZFree_Util(tmp.data, tmp.len);
          if (keyData) {
              PORT_ZFreePORT_ZFree_Util(keyData, keySize);
          }
          break;

      ec_loser:
          crv = CKR_ARGUMENTS_BAD0x00000007UL;
          SECITEM_ZfreeItemSECITEM_ZfreeItem_Util(&ecScalar, PR_FALSE0);
          if (privKey != sourceKey->objectInfo)
              nsslowkey_DestroyPrivateKey(privKey);
          if (arena) {
              PORT_FreeArenaPORT_FreeArena_Util(arena, PR_TRUE1);
          }
          break;
      }
      /* See RFC 5869 and CK_NSS_HKDFParams for documentation. */
      case CKM_NSS_HKDF_SHA1((0x80000000UL | 0x4E534350) + 3):
          hashMech = CKM_SHA_10x00000220UL;
          goto hkdf;
      case CKM_NSS_HKDF_SHA256((0x80000000UL | 0x4E534350) + 4):
          hashMech = CKM_SHA2560x00000250UL;
          goto hkdf;
      case CKM_NSS_HKDF_SHA384((0x80000000UL | 0x4E534350) + 5):
          hashMech = CKM_SHA3840x00000260UL;
          goto hkdf;
      case CKM_NSS_HKDF_SHA512((0x80000000UL | 0x4E534350) + 6):
          hashMech = CKM_SHA5120x00000270UL;
          goto hkdf;
      hkdf : {
          const CK_NSS_HKDFParams *params =
              (const CK_NSS_HKDFParams *)pMechanism->pParameter;
          CK_HKDF_PARAMS hkdfParams;

          if (pMechanism->ulParameterLen != sizeof(CK_NSS_HKDFParams)) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          hkdfParams.bExtract = params->bExtract;
          hkdfParams.bExpand = params->bExpand;
          if (params->pSalt) {
              hkdfParams.ulSaltType = CKF_HKDF_SALT_DATA0x00000002UL;
          } else {
              hkdfParams.ulSaltType = CKF_HKDF_SALT_NULL0x00000001UL;
          }
          hkdfParams.pSalt = params->pSalt;
          hkdfParams.ulSaltLen = params->ulSaltLen;
          hkdfParams.hSaltKey = CK_INVALID_HANDLE0;
          hkdfParams.pInfo = params->pInfo;
          hkdfParams.ulInfoLen = params->ulInfoLen;
          hkdfParams.prfHashMechanism = hashMech;

          crv = sftk_HKDF(&hkdfParams, hSession, sourceKey,
                          att->attrib.pValue, att->attrib.ulValueLen,
                          key, NULL((void*)0), keySize, PR_FALSE0, isFIPS);
      } break;
      case CKM_HKDF_DERIVE0x0000402aUL:
      case CKM_HKDF_DATA0x0000402bUL: /* only difference is the class of key */
          if ((pMechanism->pParameter == NULL((void*)0)) ||
              (pMechanism->ulParameterLen != sizeof(CK_HKDF_PARAMS))) {
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
              break;
          }
          crv = sftk_HKDF((CK_HKDF_PARAMS_PTR)pMechanism->pParameter,
                          hSession, sourceKey, att->attrib.pValue,
                          att->attrib.ulValueLen, key, NULL((void*)0), keySize, PR_TRUE1,
                          isFIPS);
          break;
      case CKM_NSS_JPAKE_ROUND2_SHA1((0x80000000UL | 0x4E534350) + 11):
          hashType = HASH_AlgSHA1;
          goto jpake2;
      case CKM_NSS_JPAKE_ROUND2_SHA256((0x80000000UL | 0x4E534350) + 12):
          hashType = HASH_AlgSHA256;
          goto jpake2;
      case CKM_NSS_JPAKE_ROUND2_SHA384((0x80000000UL | 0x4E534350) + 13):
          hashType = HASH_AlgSHA384;
          goto jpake2;
      case CKM_NSS_JPAKE_ROUND2_SHA512((0x80000000UL | 0x4E534350) + 14):
          hashType = HASH_AlgSHA512;
          goto jpake2;
      jpake2:
          if (pMechanism->pParameter == NULL((void*)0) ||
              pMechanism->ulParameterLen != sizeof(CK_NSS_JPAKERound2Params))
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
          if (crv == CKR_OK0x00000000UL && sftk_isTrue(key, CKA_TOKEN0x00000001UL))
              crv = CKR_TEMPLATE_INCONSISTENT0x000000D1UL;
          if (crv == CKR_OK0x00000000UL)
              crv = sftk_DeriveSensitiveCheck(sourceKey, key, PR_FALSE0);
          if (crv == CKR_OK0x00000000UL)
              crv = jpake_Round2(hashType,
                                 (CK_NSS_JPAKERound2Params *)pMechanism->pParameter,
                                 sourceKey, key);
          break;

      case CKM_NSS_JPAKE_FINAL_SHA1((0x80000000UL | 0x4E534350) + 15):
          hashType = HASH_AlgSHA1;
          goto jpakeFinal;
      case CKM_NSS_JPAKE_FINAL_SHA256((0x80000000UL | 0x4E534350) + 16):
          hashType = HASH_AlgSHA256;
          goto jpakeFinal;
      case CKM_NSS_JPAKE_FINAL_SHA384((0x80000000UL | 0x4E534350) + 17):
          hashType = HASH_AlgSHA384;
          goto jpakeFinal;
      case CKM_NSS_JPAKE_FINAL_SHA512((0x80000000UL | 0x4E534350) + 18):
          hashType = HASH_AlgSHA512;
          goto jpakeFinal;
      jpakeFinal:
          if (pMechanism->pParameter == NULL((void*)0) ||
              pMechanism->ulParameterLen != sizeof(CK_NSS_JPAKEFinalParams))
              crv = CKR_MECHANISM_PARAM_INVALID0x00000071UL;
          /* We purposely do not do the derive sensitivity check; we want to be
             able to derive non-sensitive keys while allowing the ROUND1 and
             ROUND2 keys to be sensitive (which they always are, since they are
             in the CKO_PRIVATE_KEY class). The caller must include CKA_SENSITIVE
             in the template in order for the resultant keyblock key to be
             sensitive.
           */
          if (crv == CKR_OK0x00000000UL)
              crv = jpake_Final(hashType,
                                (CK_NSS_JPAKEFinalParams *)pMechanism->pParameter,
                                sourceKey, key);
          break;

      case CKM_NSS_SP800_108_COUNTER_KDF_DERIVE_DATA((0x80000000UL | 0x4E534350) + 42):         /* fall through */
      case CKM_NSS_SP800_108_FEEDBACK_KDF_DERIVE_DATA((0x80000000UL | 0x4E534350) + 43):        /* fall through */
      case CKM_NSS_SP800_108_DOUBLE_PIPELINE_KDF_DERIVE_DATA((0x80000000UL | 0x4E534350) + 44): /* fall through */
      case CKM_SP800_108_COUNTER_KDF0x000003acUL:                         /* fall through */
      case CKM_SP800_108_FEEDBACK_KDF0x000003adUL:                        /* fall through */
      case CKM_SP800_108_DOUBLE_PIPELINE_KDF0x000003aeUL:
          crv = sftk_DeriveSensitiveCheck(sourceKey, key, PR_FALSE0);
          if (crv != CKR_OK0x00000000UL) {
              break;
          }

          crv = kbkdf_Dispatch(mechanism, hSession, pMechanism, sourceKey, key, keySize);
          break;
      default:
          crv = CKR_MECHANISM_INVALID0x00000070UL;
  }
  if (att) {
      sftk_FreeAttribute(att);
  }
  sftk_FreeObject(sourceKey);
  if (crv != CKR_OK0x00000000UL) {
      if (key)
          sftk_FreeObject(key);
      return crv;
  }

  /* link the key object into the list */
  if (key) {
      SFTKSessionObject *sessKey = sftk_narrowToSessionObject(key);
      PORT_Assert(sessKey)((sessKey)?((void)0):PR_Assert("sessKey","pkcs11c.c",8924));
      /* get the session */
      sessKey->wasDerived = PR_TRUE1;
      session = sftk_SessionFromHandle(hSession);
      if (session == NULL((void*)0)) {
          sftk_FreeObject(key);
          return CKR_HOST_MEMORY0x00000002UL;
      }

      crv = sftk_handleObject(key, session);
      session->lastOpWasFIPS = key->isFIPS;
      sftk_FreeSession(session);
      *phKey = key->handle;
      sftk_FreeObject(key);
  }
  return crv;
8940}

8942/* NSC_GetFunctionStatus obtains an updated status of a function running
* in parallel with an application. */
8944CK_RV
8945NSC_GetFunctionStatus(CK_SESSION_HANDLE hSession)
8946{
  CHECK_FORK();

  return CKR_FUNCTION_NOT_PARALLEL0x00000051UL;
8950}

8952/* NSC_CancelFunction cancels a function running in parallel */
8953CK_RV
8954NSC_CancelFunction(CK_SESSION_HANDLE hSession)
8955{
  CHECK_FORK();

  return CKR_FUNCTION_NOT_PARALLEL0x00000051UL;
8959}

8961/* NSC_GetOperationState saves the state of the cryptographic
* operation in a session.
* NOTE: This code only works for digest functions for now. eventually need
* to add full flatten/resurect to our state stuff so that all types of state
* can be saved */
8966CK_RV
8967NSC_GetOperationState(CK_SESSION_HANDLE hSession,
                    CK_BYTE_PTR pOperationState, CK_ULONG_PTR pulOperationStateLen)
8969{
  SFTKSessionContext *context;
  SFTKSession *session;
  CK_RV crv;
  CK_ULONG pOSLen = *pulOperationStateLen;

  CHECK_FORK();

  /* make sure we're legal */
  crv = sftk_GetContext(hSession, &context, SFTK_HASH, PR_TRUE1, &session);
  if (crv != CKR_OK0x00000000UL)
      return crv;

  /* a zero cipherInfoLen signals that this context cannot be serialized */
  if (context->cipherInfoLen == 0) {
      return CKR_STATE_UNSAVEABLE0x00000180UL;
  }

  *pulOperationStateLen = context->cipherInfoLen + sizeof(CK_MECHANISM_TYPE) + sizeof(SFTKContextType);
  if (pOperationState == NULL((void*)0)) {
      sftk_FreeSession(session);
      return CKR_OK0x00000000UL;
  } else {
      if (pOSLen < *pulOperationStateLen) {
          return CKR_BUFFER_TOO_SMALL0x00000150UL;
      }
  }
  PORT_Memcpymemcpy(pOperationState, &context->type, sizeof(SFTKContextType));
  pOperationState += sizeof(SFTKContextType);
  PORT_Memcpymemcpy(pOperationState, &context->currentMech,
              sizeof(CK_MECHANISM_TYPE));
  pOperationState += sizeof(CK_MECHANISM_TYPE);
  PORT_Memcpymemcpy(pOperationState, context->cipherInfo, context->cipherInfoLen);
  sftk_FreeSession(session);
  return CKR_OK0x00000000UL;
9004}

9006#define sftk_Decrement(stateSize, len)stateSize = ((stateSize) > (CK_ULONG)(len)) ? ((stateSize)
 - (CK_ULONG)(len)) : 0; \
  stateSize = ((stateSize) > (CK_ULONG)(len)) ? ((stateSize) - (CK_ULONG)(len)) : 0;

9009/* NSC_SetOperationState restores the state of the cryptographic
* operation in a session. This is coded like it can restore lots of
* states, but it only works for truly flat cipher structures. */
9012CK_RV
9013NSC_SetOperationState(CK_SESSION_HANDLE hSession,
                    CK_BYTE_PTR pOperationState, CK_ULONG ulOperationStateLen,
                    CK_OBJECT_HANDLE hEncryptionKey, CK_OBJECT_HANDLE hAuthenticationKey)
9016{
  SFTKSessionContext *context;
  SFTKSession *session;
  SFTKContextType type;
  CK_MECHANISM mech;
  CK_RV crv = CKR_OK0x00000000UL;

  CHECK_FORK();

  while (ulOperationStateLen != 0) {
      /* get what type of state we're dealing with... */
      PORT_Memcpymemcpy(&type, pOperationState, sizeof(SFTKContextType));

      /* fix up session contexts based on type */
      session = sftk_SessionFromHandle(hSession);
      if (session == NULL((void*)0))
          return CKR_SESSION_HANDLE_INVALID0x000000B3UL;
      context = sftk_ReturnContextByType(session, type);
      sftk_SetContextByType(session, type, NULL((void*)0));
      if (context) {
          sftk_FreeContext(context);
      }
      pOperationState += sizeof(SFTKContextType);
      sftk_Decrement(ulOperationStateLen, sizeof(SFTKContextType))ulOperationStateLen = ((ulOperationStateLen) > (CK_ULONG)(
sizeof(SFTKContextType))) ? ((ulOperationStateLen) - (CK_ULONG
)(sizeof(SFTKContextType))) : 0;;

      /* get the mechanism structure */
      PORT_Memcpymemcpy(&mech.mechanism, pOperationState, sizeof(CK_MECHANISM_TYPE));
      pOperationState += sizeof(CK_MECHANISM_TYPE);
      sftk_Decrement(ulOperationStateLen, sizeof(CK_MECHANISM_TYPE))ulOperationStateLen = ((ulOperationStateLen) > (CK_ULONG)(
sizeof(CK_MECHANISM_TYPE))) ? ((ulOperationStateLen) - (CK_ULONG
)(sizeof(CK_MECHANISM_TYPE))) : 0;;
      /* should be filled in... but not necessary for hash */
      mech.pParameter = NULL((void*)0);
      mech.ulParameterLen = 0;
      switch (type) {
          case SFTK_HASH:
              crv = NSC_DigestInit(hSession, &mech);
              if (crv != CKR_OK0x00000000UL)
                  break;
              crv = sftk_GetContext(hSession, &context, SFTK_HASH, PR_TRUE1,
                                    NULL((void*)0));
              if (crv != CKR_OK0x00000000UL)
                  break;
              if (context->cipherInfoLen == 0) {
                  crv = CKR_SAVED_STATE_INVALID0x00000160UL;
                  break;
              }
              PORT_Memcpymemcpy(context->cipherInfo, pOperationState,
                          context->cipherInfoLen);
              pOperationState += context->cipherInfoLen;
              sftk_Decrement(ulOperationStateLen, context->cipherInfoLen)ulOperationStateLen = ((ulOperationStateLen) > (CK_ULONG)(
context->cipherInfoLen)) ? ((ulOperationStateLen) - (CK_ULONG
)(context->cipherInfoLen)) : 0;;
              break;
          default:
              /* do sign/encrypt/decrypt later */
              crv = CKR_SAVED_STATE_INVALID0x00000160UL;
      }
      sftk_FreeSession(session);
      if (crv != CKR_OK0x00000000UL)
          break;
  }
  return crv;
9075}

9077/* Dual-function cryptographic operations */

9079/* NSC_DigestEncryptUpdate continues a multiple-part digesting and encryption
* operation. */
9081CK_RV
9082NSC_DigestEncryptUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
                      CK_ULONG ulPartLen, CK_BYTE_PTR pEncryptedPart,
                      CK_ULONG_PTR pulEncryptedPartLen)
9085{
  CK_RV crv;

  CHECK_FORK();

  crv = NSC_EncryptUpdate(hSession, pPart, ulPartLen, pEncryptedPart,
                          pulEncryptedPartLen);
  if (crv != CKR_OK0x00000000UL)
      return crv;
  crv = NSC_DigestUpdate(hSession, pPart, ulPartLen);

  return crv;
9097}

9099/* NSC_DecryptDigestUpdate continues a multiple-part decryption and
* digesting operation. */
9101CK_RV
9102NSC_DecryptDigestUpdate(CK_SESSION_HANDLE hSession,
                      CK_BYTE_PTR pEncryptedPart, CK_ULONG ulEncryptedPartLen,
                      CK_BYTE_PTR pPart, CK_ULONG_PTR pulPartLen)
9105{
  CK_RV crv;

  CHECK_FORK();

  crv = NSC_DecryptUpdate(hSession, pEncryptedPart, ulEncryptedPartLen,
                          pPart, pulPartLen);
  if (crv != CKR_OK0x00000000UL)
      return crv;
  crv = NSC_DigestUpdate(hSession, pPart, *pulPartLen);

  return crv;
9117}

9119/* NSC_SignEncryptUpdate continues a multiple-part signing and
* encryption operation. */
9121CK_RV
9122NSC_SignEncryptUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
                    CK_ULONG ulPartLen, CK_BYTE_PTR pEncryptedPart,
                    CK_ULONG_PTR pulEncryptedPartLen)
9125{
  CK_RV crv;

  CHECK_FORK();

  crv = NSC_EncryptUpdate(hSession, pPart, ulPartLen, pEncryptedPart,
                          pulEncryptedPartLen);
  if (crv != CKR_OK0x00000000UL)
      return crv;
  crv = NSC_SignUpdate(hSession, pPart, ulPartLen);

  return crv;
9137}

9139/* NSC_DecryptVerifyUpdate continues a multiple-part decryption
* and verify operation. */
9141CK_RV
9142NSC_DecryptVerifyUpdate(CK_SESSION_HANDLE hSession,
                      CK_BYTE_PTR pEncryptedData, CK_ULONG ulEncryptedDataLen,
                      CK_BYTE_PTR pData, CK_ULONG_PTR pulDataLen)
9145{
  CK_RV crv;

  CHECK_FORK();

  crv = NSC_DecryptUpdate(hSession, pEncryptedData, ulEncryptedDataLen,
                          pData, pulDataLen);
  if (crv0.1
'crv' is equal to CKR_OK
 != CKR_OK0x00000000UL)
1
Taking false branch→
      return crv;
  crv = NSC_VerifyUpdate(hSession, pData, *pulDataLen);
2
←
Calling 'NSC_VerifyUpdate'→

  return crv;
9157}

9159/* NSC_DigestKey continues a multi-part message-digesting operation,
* by digesting the value of a secret key as part of the data already digested.
*/
9162CK_RV
9163NSC_DigestKey(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hKey)
9164{
  SFTKSession *session = NULL((void*)0);
  SFTKObject *key = NULL((void*)0);
  SFTKAttribute *att;
  CK_RV crv;

  CHECK_FORK();

  session = sftk_SessionFromHandle(hSession);
  if (session == NULL((void*)0))
      return CKR_SESSION_HANDLE_INVALID0x000000B3UL;

  key = sftk_ObjectFromHandle(hKey, session);
  sftk_FreeSession(session);
  if (key == NULL((void*)0))
      return CKR_KEY_HANDLE_INVALID0x00000060UL;

  /* PUT ANY DIGEST KEY RESTRICTION CHECKS HERE */

  /* make sure it's a valid  key for this operation */
  if (key->objclass != CKO_SECRET_KEY0x00000004UL) {
      sftk_FreeObject(key);
      return CKR_KEY_TYPE_INCONSISTENT0x00000063UL;
  }
  /* get the key value */
  att = sftk_FindAttribute(key, CKA_VALUE0x00000011UL);
  sftk_FreeObject(key);
  if (!att) {
      return CKR_KEY_HANDLE_INVALID0x00000060UL;
  }
  crv = NSC_DigestUpdate(hSession, (CK_BYTE_PTR)att->attrib.pValue,
                         att->attrib.ulValueLen);
  sftk_FreeAttribute(att);
  return crv;
9198}