The Tor Browser: security/nss/lib/ckfw/nssckmdt.h@b8a032363ba2 (annotated)

security/nss/lib/ckfw/nssckmdt.h@b8a032363ba2 (annotated)

security/nss/lib/ckfw/nssckmdt.h

Thu, 22 Jan 2015 13:21:57 +0100

author: Michael Schloh von Bennewitz <michael@schloh.com>
date: Thu, 22 Jan 2015 13:21:57 +0100
branch: TOR_BUG_9701
changeset 15: b8a032363ba2
permissions: -rw-r--r--

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #ifndef NSSCKMDT_H
 #define NSSCKMDT_H
 /*
  * nssckmdt.h
  *
  * This file specifies the basic types that must be implemented by
  * any Module using the NSS Cryptoki Framework.
  */
 #ifndef NSSBASET_H
 #include "nssbaset.h"
 #endif /* NSSBASET_H */
 #ifndef NSSCKT_H
 #include "nssckt.h"
 #endif /* NSSCKT_H */
 #ifndef NSSCKFWT_H
 #include "nssckfwt.h"
 #endif /* NSSCKFWT_H */
 typedef struct NSSCKMDInstanceStr NSSCKMDInstance;
 typedef struct NSSCKMDSlotStr NSSCKMDSlot;
 typedef struct NSSCKMDTokenStr NSSCKMDToken;
 typedef struct NSSCKMDSessionStr NSSCKMDSession;
 typedef struct NSSCKMDCryptoOperationStr NSSCKMDCryptoOperation;
 typedef struct NSSCKMDFindObjectsStr NSSCKMDFindObjects;
 typedef struct NSSCKMDMechanismStr NSSCKMDMechanism;
 typedef struct NSSCKMDObjectStr NSSCKMDObject;
 /*
  * NSSCKFWItem
  *
  * This is a structure used by modules to return object attributes.
  * The needsFreeing bit indicates whether the object needs to be freed.
  * If so, the framework will call the FreeAttribute function on the item
  * after it is done using it.
  *
  */
 typedef struct {
   PRBool needsFreeing;
   NSSItem* item;
 } NSSCKFWItem ;
 /*
  * NSSCKMDInstance
  *
  * This is the basic handle for an instance of a PKCS#11 Module.
  * It is returned by the Module's CreateInstance routine, and
  * may be obtained from the corresponding NSSCKFWInstance object.
  * It contains a pointer for use by the Module, to store any
  * instance-related data, and it contains the EPV for a set of
  * routines which the Module may implement for use by the Framework.
  * Some of these routines are optional; others are mandatory.
  */
 struct NSSCKMDInstanceStr {
   /*
    * The Module may use this pointer for its own purposes.
    */
   void *etc;
   /*
    * This routine is called by the Framework to initialize
    * the Module.  This routine is optional; if unimplemented,
    * it won't be called.  If this routine returns an error,
    * then the initialization will fail.
    */
   CK_RV (PR_CALLBACK *Initialize)(
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSUTF8 *configurationData
   );
   /*
    * This routine is called when the Framework is finalizing
    * the PKCS#11 Module.  It is the last thing called before
    * the NSSCKFWInstance's NSSArena is destroyed.  This routine
    * is optional; if unimplemented, it merely won't be called.
    */
   void (PR_CALLBACK *Finalize)(
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine gets the number of slots.  This value must
    * never change, once the instance is initialized.  This
    * routine must be implemented.  It may return zero on error.
    */
   CK_ULONG (PR_CALLBACK *GetNSlots)(
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_RV *pError
   );
   /*
    * This routine returns the version of the Cryptoki standard
    * to which this Module conforms.  This routine is optional;
    * if unimplemented, the Framework uses the version to which
    * ~it~ was implemented.
    */
   CK_VERSION (PR_CALLBACK *GetCryptokiVersion)(
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns a pointer to a UTF8-encoded string
    * containing the manufacturer ID for this Module.  Only
    * the characters completely encoded in the first thirty-
    * two bytes are significant.  This routine is optional.
    * The string returned is never freed; if dynamically generated,
    * the space for it should be allocated from the NSSArena
    * that may be obtained from the NSSCKFWInstance.  This
    * routine may return NULL upon error; however if *pError
    * is CKR_OK, the NULL will be considered the valid response.
    */
   NSSUTF8 *(PR_CALLBACK *GetManufacturerID)(
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_RV *pError
   );
   /*
    * This routine returns a pointer to a UTF8-encoded string
    * containing a description of this Module library.  Only
    * the characters completely encoded in the first thirty-
    * two bytes are significant.  This routine is optional.
    * The string returned is never freed; if dynamically generated,
    * the space for it should be allocated from the NSSArena
    * that may be obtained from the NSSCKFWInstance.  This
    * routine may return NULL upon error; however if *pError
    * is CKR_OK, the NULL will be considered the valid response.
    */
   NSSUTF8 *(PR_CALLBACK *GetLibraryDescription)(
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_RV *pError
   );
   /*
    * This routine returns the version of this Module library.
    * This routine is optional; if unimplemented, the Framework
    * will assume a Module library version of 0.1.
    */
   CK_VERSION (PR_CALLBACK *GetLibraryVersion)(
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns CK_TRUE if the Module wishes to
    * handle session objects.  This routine is optional.
    * If this routine is NULL, or if it exists but returns
    * CK_FALSE, the Framework will assume responsibility
    * for managing session objects.
    */
   CK_BBOOL (PR_CALLBACK *ModuleHandlesSessionObjects)(
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine stuffs pointers to NSSCKMDSlot objects into
    * the specified array; one for each slot supported by this
    * instance.  The Framework will determine the size needed
    * for the array by calling GetNSlots.  This routine is
    * required.
    */
   CK_RV (PR_CALLBACK *GetSlots)(
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSCKMDSlot *slots[]
   );
   /*
    * This call returns a pointer to the slot in which an event
    * has occurred.  If the block argument is CK_TRUE, the call
    * should block until a slot event occurs; if CK_FALSE, it
    * should check to see if an event has occurred, occurred,
    * but return NULL (and set *pError to CK_NO_EVENT) if one
    * hasn't.  This routine is optional; if unimplemented, the
    * Framework will assume that no event has happened.  This
    * routine may return NULL upon error.
    */
   NSSCKMDSlot *(PR_CALLBACK *WaitForSlotEvent)(
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_BBOOL block,
     CK_RV *pError
   );
   /*
    * This object may be extended in future versions of the
    * NSS Cryptoki Framework.  To allow for some flexibility
    * in the area of binary compatibility, this field should
    * be NULL.
    */
   void *null;
 };
 /*
  * NSSCKMDSlot
  *
  * This is the basic handle for a PKCS#11 Module Slot.  It is
  * created by the NSSCKMDInstance->GetSlots call, and may be
  * obtained from the Framework's corresponding NSSCKFWSlot
  * object.  It contains a pointer for use by the Module, to
  * store any slot-related data, and it contains the EPV for
  * a set of routines which the Module may implement for use
  * by the Framework.  Some of these routines are optional.
  */
 struct NSSCKMDSlotStr {
   /*
    * The Module may use this pointer for its own purposes.
    */
   void *etc;
   /*
    * This routine is called during the Framework initialization
    * step, after the Framework Instance has obtained the list
    * of slots (by calling NSSCKMDInstance->GetSlots).  Any slot-
    * specific initialization can be done here.  This routine is
    * optional; if unimplemented, it won't be called.  Note that
    * if this routine returns an error, the entire Framework
    * initialization for this Module will fail.
    */
   CK_RV (PR_CALLBACK *Initialize)(
     NSSCKMDSlot *mdSlot,
     NSSCKFWSlot *fwSlot,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine is called when the Framework is finalizing
    * the PKCS#11 Module.  This call (for each of the slots)
    * is the last thing called before NSSCKMDInstance->Finalize.
    * This routine is optional; if unimplemented, it merely
    * won't be called.  Note: In the rare circumstance that
    * the Framework initialization cannot complete (due to,
    * for example, memory limitations), this can be called with
    * a NULL value for fwSlot.
    */
   void (PR_CALLBACK *Destroy)(
     NSSCKMDSlot *mdSlot,
     NSSCKFWSlot *fwSlot,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns a pointer to a UTF8-encoded string
    * containing a description of this slot.  Only the characters
    * completely encoded in the first sixty-four bytes are
    * significant.  This routine is optional.  The string
    * returned is never freed; if dynamically generated,
    * the space for it should be allocated from the NSSArena
    * that may be obtained from the NSSCKFWInstance.  This
    * routine may return NULL upon error; however if *pError
    * is CKR_OK, the NULL will be considered the valid response.
    */
   NSSUTF8 *(PR_CALLBACK *GetSlotDescription)(
     NSSCKMDSlot *mdSlot,
     NSSCKFWSlot *fwSlot,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_RV *pError
   );
   /*
    * This routine returns a pointer to a UTF8-encoded string
    * containing a description of the manufacturer of this slot.
    * Only the characters completely encoded in the first thirty-
    * two bytes are significant.  This routine is optional.
    * The string  returned is never freed; if dynamically generated,
    * the space for it should be allocated from the NSSArena
    * that may be obtained from the NSSCKFWInstance.  This
    * routine may return NULL upon error; however if *pError
    * is CKR_OK, the NULL will be considered the valid response.
    */
   NSSUTF8 *(PR_CALLBACK *GetManufacturerID)(
     NSSCKMDSlot *mdSlot,
     NSSCKFWSlot *fwSlot,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_RV *pError
   );
   /*
    * This routine returns CK_TRUE if a token is present in this
    * slot.  This routine is optional; if unimplemented, CK_TRUE
    * is assumed.
    */
   CK_BBOOL (PR_CALLBACK *GetTokenPresent)(
     NSSCKMDSlot *mdSlot,
     NSSCKFWSlot *fwSlot,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns CK_TRUE if the slot supports removable
    * tokens.  This routine is optional; if unimplemented, CK_FALSE
    * is assumed.
    */
   CK_BBOOL (PR_CALLBACK *GetRemovableDevice)(
     NSSCKMDSlot *mdSlot,
     NSSCKFWSlot *fwSlot,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns CK_TRUE if this slot is a hardware
    * device, or CK_FALSE if this slot is a software device.  This
    * routine is optional; if unimplemented, CK_FALSE is assumed.
    */
   CK_BBOOL (PR_CALLBACK *GetHardwareSlot)(
     NSSCKMDSlot *mdSlot,
     NSSCKFWSlot *fwSlot,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns the version of this slot's hardware.
    * This routine is optional; if unimplemented, the Framework
    * will assume a hardware version of 0.1.
    */
   CK_VERSION (PR_CALLBACK *GetHardwareVersion)(
     NSSCKMDSlot *mdSlot,
     NSSCKFWSlot *fwSlot,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns the version of this slot's firmware.
    * This routine is optional; if unimplemented, the Framework
    * will assume a hardware version of 0.1.
    */
   CK_VERSION (PR_CALLBACK *GetFirmwareVersion)(
     NSSCKMDSlot *mdSlot,
     NSSCKFWSlot *fwSlot,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine should return a pointer to an NSSCKMDToken
    * object corresponding to the token in the specified slot.
    * The NSSCKFWToken object passed in has an NSSArena
    * available which is dedicated for this token.  This routine
    * must be implemented.  This routine may return NULL upon
    * error.
    */
   NSSCKMDToken *(PR_CALLBACK *GetToken)(
     NSSCKMDSlot *mdSlot,
     NSSCKFWSlot *fwSlot,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_RV *pError
   );
   /*
    * This object may be extended in future versions of the
    * NSS Cryptoki Framework.  To allow for some flexibility
    * in the area of binary compatibility, this field should
    * be NULL.
    */
   void *null;
 };
 /*
  * NSSCKMDToken
  *
  * This is the basic handle for a PKCS#11 Token.  It is created by
  * the NSSCKMDSlot->GetToken call, and may be obtained from the
  * Framework's corresponding NSSCKFWToken object.  It contains a
  * pointer for use by the Module, to store any token-related
  * data, and it contains the EPV for a set of routines which the
  * Module may implement for use by the Framework.  Some of these
  * routines are optional.
  */
 struct NSSCKMDTokenStr {
   /*
    * The Module may use this pointer for its own purposes.
    */
   void *etc;
   /*
    * This routine is used to prepare a Module token object for
    * use.  It is called after the NSSCKMDToken object is obtained
    * from NSSCKMDSlot->GetToken.  It is named "Setup" here because
    * Cryptoki already defines "InitToken" to do the process of
    * wiping out any existing state on a token and preparing it for
    * a new use.  This routine is optional; if unimplemented, it
    * merely won't be called.
    */
   CK_RV (PR_CALLBACK *Setup)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine is called by the Framework whenever it notices
    * that the token object is invalid.  (Typically this is when a
    * routine indicates an error such as CKR_DEVICE_REMOVED).  This
    * call is the last thing called before the NSSArena in the
    * corresponding NSSCKFWToken is destroyed.  This routine is
    * optional; if unimplemented, it merely won't be called.
    */
   void (PR_CALLBACK *Invalidate)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine initialises the token in the specified slot.
    * This routine is optional; if unimplemented, the Framework
    * will fail this operation with an error of CKR_DEVICE_ERROR.
    */
   CK_RV (PR_CALLBACK *InitToken)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSItem *pin,
     NSSUTF8 *label
   );
   /*
    * This routine returns a pointer to a UTF8-encoded string
    * containing this token's label.  Only the characters
    * completely encoded in the first thirty-two bytes are
    * significant.  This routine is optional.  The string
    * returned is never freed; if dynamically generated,
    * the space for it should be allocated from the NSSArena
    * that may be obtained from the NSSCKFWInstance.  This
    * routine may return NULL upon error; however if *pError
    * is CKR_OK, the NULL will be considered the valid response.
    */
   NSSUTF8 *(PR_CALLBACK *GetLabel)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_RV *pError
   );
   /*
    * This routine returns a pointer to a UTF8-encoded string
    * containing this token's manufacturer ID.  Only the characters
    * completely encoded in the first thirty-two bytes are
    * significant.  This routine is optional.  The string
    * returned is never freed; if dynamically generated,
    * the space for it should be allocated from the NSSArena
    * that may be obtained from the NSSCKFWInstance.  This
    * routine may return NULL upon error; however if *pError
    * is CKR_OK, the NULL will be considered the valid response.
    */
   NSSUTF8 *(PR_CALLBACK *GetManufacturerID)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_RV *pError
   );
   /*
    * This routine returns a pointer to a UTF8-encoded string
    * containing this token's model name.  Only the characters
    * completely encoded in the first thirty-two bytes are
    * significant.  This routine is optional.  The string
    * returned is never freed; if dynamically generated,
    * the space for it should be allocated from the NSSArena
    * that may be obtained from the NSSCKFWInstance.  This
    * routine may return NULL upon error; however if *pError
    * is CKR_OK, the NULL will be considered the valid response.
    */
   NSSUTF8 *(PR_CALLBACK *GetModel)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_RV *pError
   );
   /*
    * This routine returns a pointer to a UTF8-encoded string
    * containing this token's serial number.  Only the characters
    * completely encoded in the first thirty-two bytes are
    * significant.  This routine is optional.  The string
    * returned is never freed; if dynamically generated,
    * the space for it should be allocated from the NSSArena
    * that may be obtained from the NSSCKFWInstance.  This
    * routine may return NULL upon error; however if *pError
    * is CKR_OK, the NULL will be considered the valid response.
    */
   NSSUTF8 *(PR_CALLBACK *GetSerialNumber)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_RV *pError
   );
   /*
    * This routine returns CK_TRUE if the token has its own
    * random number generator.  This routine is optional; if
    * unimplemented, CK_FALSE is assumed.
    */
   CK_BBOOL (PR_CALLBACK *GetHasRNG)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns CK_TRUE if this token is write-protected.
    * This routine is optional; if unimplemented, CK_FALSE is
    * assumed.
    */
   CK_BBOOL (PR_CALLBACK *GetIsWriteProtected)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns CK_TRUE if this token requires a login.
    * This routine is optional; if unimplemented, CK_FALSE is
    * assumed.
    */
   CK_BBOOL (PR_CALLBACK *GetLoginRequired)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns CK_TRUE if the normal user's PIN on this
    * token has been initialised.  This routine is optional; if
    * unimplemented, CK_FALSE is assumed.
    */
   CK_BBOOL (PR_CALLBACK *GetUserPinInitialized)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns CK_TRUE if a successful save of a
    * session's cryptographic operations state ~always~ contains
    * all keys needed to restore the state of the session.  This
    * routine is optional; if unimplemented, CK_FALSE is assumed.
    */
   CK_BBOOL (PR_CALLBACK *GetRestoreKeyNotNeeded)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns CK_TRUE if the token has its own
    * hardware clock.  This routine is optional; if unimplemented,
    * CK_FALSE is assumed.
    */
   CK_BBOOL (PR_CALLBACK *GetHasClockOnToken)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns CK_TRUE if the token has a protected
    * authentication path.  This routine is optional; if
    * unimplemented, CK_FALSE is assumed.
    */
   CK_BBOOL (PR_CALLBACK *GetHasProtectedAuthenticationPath)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns CK_TRUE if the token supports dual
    * cryptographic operations within a single session.  This
    * routine is optional; if unimplemented, CK_FALSE is assumed.
    */
   CK_BBOOL (PR_CALLBACK *GetSupportsDualCryptoOperations)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * XXX fgmr-- should we have a call to return all the flags
    * at once, for folks who already know about Cryptoki?
    */
   /*
    * This routine returns the maximum number of sessions that
    * may be opened on this token.  This routine is optional;
    * if unimplemented, the special value CK_UNAVAILABLE_INFORMATION
    * is assumed.  XXX fgmr-- or CK_EFFECTIVELY_INFINITE?
    */
   CK_ULONG (PR_CALLBACK *GetMaxSessionCount)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns the maximum number of read/write
    * sesisons that may be opened on this token.  This routine
    * is optional; if unimplemented, the special value
    * CK_UNAVAILABLE_INFORMATION is assumed.  XXX fgmr-- or
    * CK_EFFECTIVELY_INFINITE?
    */
   CK_ULONG (PR_CALLBACK *GetMaxRwSessionCount)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns the maximum PIN code length that is
    * supported on this token.  This routine is optional;
    * if unimplemented, the special value CK_UNAVAILABLE_INFORMATION
    * is assumed.
    */
   CK_ULONG (PR_CALLBACK *GetMaxPinLen)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns the minimum PIN code length that is
    * supported on this token.  This routine is optional; if
    * unimplemented, the special value CK_UNAVAILABLE_INFORMATION
    *  is assumed.  XXX fgmr-- or 0?
    */
   CK_ULONG (PR_CALLBACK *GetMinPinLen)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns the total amount of memory on the token
    * in which public objects may be stored.  This routine is
    * optional; if unimplemented, the special value
    * CK_UNAVAILABLE_INFORMATION is assumed.
    */
   CK_ULONG (PR_CALLBACK *GetTotalPublicMemory)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns the amount of unused memory on the
    * token in which public objects may be stored.  This routine
    * is optional; if unimplemented, the special value
    * CK_UNAVAILABLE_INFORMATION is assumed.
    */
   CK_ULONG (PR_CALLBACK *GetFreePublicMemory)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns the total amount of memory on the token
    * in which private objects may be stored.  This routine is
    * optional; if unimplemented, the special value
    * CK_UNAVAILABLE_INFORMATION is assumed.
    */
   CK_ULONG (PR_CALLBACK *GetTotalPrivateMemory)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns the amount of unused memory on the
    * token in which private objects may be stored.  This routine
    * is optional; if unimplemented, the special value
    * CK_UNAVAILABLE_INFORMATION is assumed.
    */
   CK_ULONG (PR_CALLBACK *GetFreePrivateMemory)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns the version number of this token's
    * hardware.  This routine is optional; if unimplemented,
    * the value 0.1 is assumed.
    */
   CK_VERSION (PR_CALLBACK *GetHardwareVersion)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns the version number of this token's
    * firmware.  This routine is optional; if unimplemented,
    * the value 0.1 is assumed.
    */
   CK_VERSION (PR_CALLBACK *GetFirmwareVersion)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine stuffs the current UTC time, as obtained from
    * the token, into the sixteen-byte buffer in the form
    * YYYYMMDDhhmmss00.  This routine need only be implemented
    * by token which indicate that they have a real-time clock.
    * XXX fgmr-- think about time formats.
    */
   CK_RV (PR_CALLBACK *GetUTCTime)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_CHAR utcTime[16]
   );
   /*
    * This routine creates a session on the token, and returns
    * the corresponding NSSCKMDSession object.  The value of
    * rw will be CK_TRUE if the session is to be a read/write
    * session, or CK_FALSE otherwise.  An NSSArena dedicated to
    * the new session is available from the specified NSSCKFWSession.
    * This routine may return NULL upon error.
    */
   NSSCKMDSession *(PR_CALLBACK *OpenSession)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSCKFWSession *fwSession,
     CK_BBOOL rw,
     CK_RV *pError
   );
   /*
    * This routine returns the number of PKCS#11 Mechanisms
    * supported by this token.  This routine is optional; if
    * unimplemented, zero is assumed.
    */
   CK_ULONG (PR_CALLBACK *GetMechanismCount)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine stuffs into the specified array the types
    * of the mechanisms supported by this token.  The Framework
    * determines the size of the array by calling GetMechanismCount.
    */
   CK_RV (PR_CALLBACK *GetMechanismTypes)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_MECHANISM_TYPE types[]
   );
   /*
    * This routine returns a pointer to a Module mechanism
    * object corresponding to a specified type.  This routine
    * need only exist for tokens implementing at least one
    * mechanism.
    */
   NSSCKMDMechanism *(PR_CALLBACK *GetMechanism)(
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_MECHANISM_TYPE which,
     CK_RV *pError
   );
   /*
    * This object may be extended in future versions of the
    * NSS Cryptoki Framework.  To allow for some flexibility
    * in the area of binary compatibility, this field should
    * be NULL.
    */
   void *null;
 };
 /*
  * NSSCKMDSession
  *
  * This is the basic handle for a session on a PKCS#11 Token.  It
  * is created by NSSCKMDToken->OpenSession, and may be obtained
  * from the Framework's corresponding NSSCKFWSession object.  It
  * contains a pointer for use by the Module, to store any session-
  * realted data, and it contains the EPV for a set of routines
  * which the Module may implement for use by the Framework.  Some
  * of these routines are optional.
  */
 struct NSSCKMDSessionStr {
   /*
    * The Module may use this pointer for its own purposes.
    */
   void *etc;
   /*
    * This routine is called by the Framework when a session is
    * closed.  This call is the last thing called before the
    * NSSArena in the correspoinding NSSCKFWSession is destroyed.
    * This routine is optional; if unimplemented, it merely won't
    * be called.
    */
   void (PR_CALLBACK *Close)(
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine is used to get any device-specific error.
    * This routine is optional.
    */
   CK_ULONG (PR_CALLBACK *GetDeviceError)(
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine is used to log in a user to the token.  This
    * routine is optional, since the Framework's NSSCKFWSession
    * object keeps track of the login state.
    */
   CK_RV (PR_CALLBACK *Login)(
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_USER_TYPE userType,
     NSSItem *pin,
     CK_STATE oldState,
     CK_STATE newState
   );
   /*
    * This routine is used to log out a user from the token.  This
    * routine is optional, since the Framework's NSSCKFWSession
    * object keeps track of the login state.
    */
   CK_RV (PR_CALLBACK *Logout)(
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_STATE oldState,
     CK_STATE newState
   );
   /*
    * This routine is used to initialize the normal user's PIN or
    * password.  This will only be called in the "read/write
    * security officer functions" state.  If this token has a
    * protected authentication path, then the pin argument will
    * be NULL.  This routine is optional; if unimplemented, the
    * Framework will return the error CKR_TOKEN_WRITE_PROTECTED.
    */
   CK_RV (PR_CALLBACK *InitPIN)(
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSItem *pin
   );
   /*
    * This routine is used to modify a user's PIN or password.  This
    * routine will only be called in the "read/write security officer
    * functions" or "read/write user functions" state.  If this token
    * has a protected authentication path, then the pin arguments
    * will be NULL.  This routine is optional; if unimplemented, the
    * Framework will return the error CKR_TOKEN_WRITE_PROTECTED.
    */
   CK_RV (PR_CALLBACK *SetPIN)(
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSItem *oldPin,
     NSSItem *newPin
   );
   /*
    * This routine is used to find out how much space would be required
    * to save the current operational state.  This routine is optional;
    * if unimplemented, the Framework will reject any attempts to save
    * the operational state with the error CKR_STATE_UNSAVEABLE.  This
    * routine may return zero on error.
    */
   CK_ULONG (PR_CALLBACK *GetOperationStateLen)(
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_RV *pError
   );
   /*
    * This routine is used to store the current operational state.  This
    * routine is only required if GetOperationStateLen is implemented
    * and can return a nonzero value.  The buffer in the specified item
    * will be pre-allocated, and the length will specify the amount of
    * space available (which may be more than GetOperationStateLen
    * asked for, but which will not be smaller).
    */
   CK_RV (PR_CALLBACK *GetOperationState)(
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSItem *buffer
   );
   /*
    * This routine is used to restore an operational state previously
    * obtained with GetOperationState.  The Framework will take pains
    * to be sure that the state is (or was at one point) valid; if the
    * Module notices that the state is invalid, it should return an
    * error, but it is not required to be paranoid about the issue.
    * [XXX fgmr-- should (can?) the framework verify the keys match up?]
    * This routine is required only if GetOperationState is implemented.
    */
   CK_RV (PR_CALLBACK *SetOperationState)(
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSItem *state,
     NSSCKMDObject *mdEncryptionKey,
     NSSCKFWObject *fwEncryptionKey,
     NSSCKMDObject *mdAuthenticationKey,
     NSSCKFWObject *fwAuthenticationKey
   );
   /*
    * This routine is used to create an object.  The specified template
    * will only specify a session object if the Module has indicated
    * that it wishes to handle its own session objects.  This routine
    * is optional; if unimplemented, the Framework will reject the
    * operation with the error CKR_TOKEN_WRITE_PROTECTED.  Space for
    * token objects should come from the NSSArena available from the
    * NSSCKFWToken object; space for session objects (if supported)
    * should come from the NSSArena available from the NSSCKFWSession
    * object.  The appropriate NSSArena pointer will, as a convenience,
    * be passed as the handyArenaPointer argument.  This routine may
    * return NULL upon error.
    */
   NSSCKMDObject *(PR_CALLBACK *CreateObject)(
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSArena *handyArenaPointer,
     CK_ATTRIBUTE_PTR pTemplate,
     CK_ULONG ulAttributeCount,
     CK_RV *pError
   );
   /*
    * This routine is used to make a copy of an object.  It is entirely
    * optional; if unimplemented, the Framework will try to use
    * CreateObject instead.  If the Module has indicated that it does
    * not wish to handle session objects, then this routine will only
    * be called to copy a token object to another token object.
    * Otherwise, either the original object or the new may be of
    * either the token or session variety.  As with CreateObject, the
    * handyArenaPointer will point to the appropriate arena for the
    * new object.  This routine may return NULL upon error.
    */
   NSSCKMDObject *(PR_CALLBACK *CopyObject)(
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSCKMDObject *mdOldObject,
     NSSCKFWObject *fwOldObject,
     NSSArena *handyArenaPointer,
     CK_ATTRIBUTE_PTR pTemplate,
     CK_ULONG ulAttributeCount,
     CK_RV *pError
   );
   /*
    * This routine is used to begin an object search.  This routine may
    * be unimplemented only if the Module does not handle session
    * objects, and if none of its tokens have token objects.  The
    * NSSCKFWFindObjects pointer has an NSSArena that may be used for
    * storage for the life of this "find" operation.  This routine may
    * return NULL upon error.  If the Module can determine immediately
    * that the search will not find any matching objects, it may return
    * NULL, and specify CKR_OK as the error.
    */
   NSSCKMDFindObjects *(PR_CALLBACK *FindObjectsInit)(
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_ATTRIBUTE_PTR pTemplate,
     CK_ULONG ulAttributeCount,
     CK_RV *pError
   );
   /*
    * This routine seeds the random-number generator.  It is
    * optional, even if GetRandom is implemented.  If unimplemented,
    * the Framework will issue the error CKR_RANDOM_SEED_NOT_SUPPORTED.
    */
   CK_RV (PR_CALLBACK *SeedRandom)(
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSItem *seed
   );
   /*
    * This routine gets random data.  It is optional.  If unimplemented,
    * the Framework will issue the error CKR_RANDOM_NO_RNG.
    */
   CK_RV (PR_CALLBACK *GetRandom)(
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSItem *buffer
   );
   /*
    * This object may be extended in future versions of the
    * NSS Cryptoki Framework.  To allow for some flexibility
    * in the area of binary compatibility, this field should
    * be NULL.
    */
   void *null;
 };
 /*
  * NSSCKMDFindObjects
  *
  * This is the basic handle for an object search.  It is
  * created by NSSCKMDSession->FindObjectsInit, and may be
  * obtained from the Framework's corresponding object.
  * It contains a pointer for use by the Module, to store
  * any search-related data, and it contains the EPV for a
  * set of routines which the Module may implement for use
  * by the Framework.  Some of these routines are optional.
  */
 struct NSSCKMDFindObjectsStr {
   /*
    * The Module may use this pointer for its own purposes.
    */
   void *etc;
   /*
    * This routine is called by the Framework to finish a
    * search operation.  Note that the Framework may finish
    * a search before it has completed.  This routine is
    * optional; if unimplemented, it merely won't be called.
    */
   void (PR_CALLBACK *Final)(
     NSSCKMDFindObjects *mdFindObjects,
     NSSCKFWFindObjects *fwFindObjects,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine is used to obtain another pointer to an
    * object matching the search criteria.  This routine is
    * required.  If no (more) objects match the search, it
    * should return NULL and set the error to CKR_OK.
    */
   NSSCKMDObject *(PR_CALLBACK *Next)(
     NSSCKMDFindObjects *mdFindObjects,
     NSSCKFWFindObjects *fwFindObjects,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSArena *arena,
     CK_RV *pError
   );
   /*
    * This object may be extended in future versions of the
    * NSS Cryptoki Framework.  To allow for some flexibility
    * in the area of binary compatibility, this field should
    * be NULL.
    */
   void *null;
 };
 /*
  * NSSCKMDCryptoOperaion
  *
  * This is the basic handle for an encryption, decryption,
  * sign, verify, or hash opertion.
  * created by NSSCKMDMechanism->XXXXInit, and may be
  * obtained from the Framework's corresponding object.
  * It contains a pointer for use by the Module, to store
  * any intermediate data, and it contains the EPV for a
  * set of routines which the Module may implement for use
  * by the Framework.  Some of these routines are optional.
  */
 struct NSSCKMDCryptoOperationStr {
   /*
    * The Module may use this pointer for its own purposes.
    */
   void *etc;
   /*
    * This routine is called by the Framework clean up the mdCryptoOperation
    * structure.
    * This routine is optional; if unimplemented, it will be ignored.
    */
   void (PR_CALLBACK *Destroy)(
     NSSCKMDCryptoOperation *mdCryptoOperation,
     NSSCKFWCryptoOperation *fwCryptoOperation,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * how many bytes do we need to finish this buffer?
    * must be implemented if Final is implemented.
    */
   CK_ULONG (PR_CALLBACK *GetFinalLength)(
     NSSCKMDCryptoOperation *mdCryptoOperation,
     NSSCKFWCryptoOperation *fwCryptoOperation,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_RV *pError
   );
   /*
    * how many bytes do we need to complete the next operation.
    * used in both Update and UpdateFinal.
    */
   CK_ULONG (PR_CALLBACK *GetOperationLength)(
     NSSCKMDCryptoOperation *mdCryptoOperation,
     NSSCKFWCryptoOperation *fwCryptoOperation,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     const NSSItem   *inputBuffer,
     CK_RV *pError
   );
   /*
    * This routine is called by the Framework to finish a
    * search operation.  Note that the Framework may finish
    * a search before it has completed.  This routine is
    * optional; if unimplemented, it merely won't be called.
    * The respective final call with fail with CKR_FUNCTION_FAILED
    * Final should not free the mdCryptoOperation.
    */
   CK_RV(PR_CALLBACK *Final)(
     NSSCKMDCryptoOperation *mdCryptoOperation,
     NSSCKFWCryptoOperation *fwCryptoOperation,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSItem       *outputBuffer
   );
   /*
    * This routine is called by the Framework to complete the
    * next step in an encryption/decryption operation.
    * This routine is optional; if unimplemented, the respective
    * update call with fail with CKR_FUNCTION_FAILED.
    * Update should not be implemented for signing/verification/digest
    * mechanisms.
    */
   CK_RV(PR_CALLBACK *Update)(
     NSSCKMDCryptoOperation *mdCryptoOperation,
     NSSCKFWCryptoOperation *fwCryptoOperation,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     const NSSItem   *inputBuffer,
     NSSItem   *outputBuffer
   );
   /*
    * This routine is called by the Framework to complete the
    * next step in a signing/verification/digest operation.
    * This routine is optional; if unimplemented, the respective
    * update call with fail with CKR_FUNCTION_FAILED
    * Update should not be implemented for encryption/decryption
    * mechanisms.
    */
   CK_RV(PR_CALLBACK *DigestUpdate)(
     NSSCKMDCryptoOperation *mdCryptoOperation,
     NSSCKFWCryptoOperation *fwCryptoOperation,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     const NSSItem   *inputBuffer
   );
   /*
    * This routine is called by the Framework to complete a
    * single step operation. This routine is optional; if unimplemented,
    * the framework will use the Update and Final functions to complete
    * the operation.
    */
   CK_RV(PR_CALLBACK *UpdateFinal)(
     NSSCKMDCryptoOperation *mdCryptoOperation,
     NSSCKFWCryptoOperation *fwCryptoOperation,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     const NSSItem   *inputBuffer,
     NSSItem   *outputBuffer
   );
   /*
    * This routine is called by the Framework to complete next
    * step in a combined operation. The Decrypt/Encrypt mechanism
    * should define and drive the combo step.
    * This routine is optional; if unimplemented,
    * the framework will use the appropriate Update functions to complete
    * the operation.
    */
   CK_RV(PR_CALLBACK *UpdateCombo)(
     NSSCKMDCryptoOperation *mdCryptoOperation,
     NSSCKFWCryptoOperation *fwCryptoOperation,
     NSSCKMDCryptoOperation *mdPeerCryptoOperation,
     NSSCKFWCryptoOperation *fwPeerCryptoOperation,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     const NSSItem   *inputBuffer,
     NSSItem   *outputBuffer
   );
   /*
    * Hash a key directly into the digest
    */
   CK_RV(PR_CALLBACK *DigestKey)(
     NSSCKMDCryptoOperation *mdCryptoOperation,
     NSSCKFWCryptoOperation *fwCryptoOperation,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSCKMDObject *mdKey,
     NSSCKFWObject *fwKey
   );
   /*
    * This object may be extended in future versions of the
    * NSS Cryptoki Framework.  To allow for some flexibility
    * in the area of binary compatibility, this field should
    * be NULL.
    */
   void *null;
 };
 /*
  * NSSCKMDMechanism
  *
  */
 struct NSSCKMDMechanismStr {
   /*
    * The Module may use this pointer for its own purposes.
    */
   void *etc;
   /*
    * This also frees the fwMechanism if appropriate.
    * If it is not supplied, the Framework will assume that the Token
    * Manages a static list of mechanisms and the function will not be called.
    */
   void (PR_CALLBACK *Destroy)(
     NSSCKMDMechanism *mdMechanism,
     NSSCKFWMechanism *fwMechanism,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns the minimum key size allowed for
    * this mechanism.  This routine is optional; if unimplemented,
    * zero will be assumed.  This routine may return zero on
    * error; if the error is CKR_OK, zero will be accepted as
    * a valid response.
    */
   CK_ULONG (PR_CALLBACK *GetMinKeySize)(
     NSSCKMDMechanism *mdMechanism,
     NSSCKFWMechanism *fwMechanism,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_RV *pError
   );
   /*
    * This routine returns the maximum key size allowed for
    * this mechanism.  This routine is optional; if unimplemented,
    * zero will be assumed.  This routine may return zero on
    * error; if the error is CKR_OK, zero will be accepted as
    * a valid response.
    */
   CK_ULONG (PR_CALLBACK *GetMaxKeySize)(
     NSSCKMDMechanism *mdMechanism,
     NSSCKFWMechanism *fwMechanism,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_RV *pError
   );
   /*
    * This routine is called to determine if the mechanism is
    * implemented in hardware or software.  It returns CK_TRUE
    * if it is done in hardware.
    */
   CK_BBOOL (PR_CALLBACK *GetInHardware)(
     NSSCKMDMechanism *mdMechanism,
     NSSCKFWMechanism *fwMechanism,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_RV *pError
   );
   /*
    * The crypto routines themselves.  Most crypto operations may
    * be performed in two ways, streaming and single-part.  The
    * streaming operations involve the use of (typically) three
    * calls-- an Init method to set up the operation, an Update
    * method to feed data to the operation, and a Final method to
    * obtain the final result.  Single-part operations involve
    * one method, to perform the crypto operation all at once.
    *
    * The NSS Cryptoki Framework can implement the single-part
    * operations in terms of the streaming operations on behalf
    * of the Module.  There are a few variances.
    *
    * Only the Init Functions are defined by the mechanism. Each
    * init function will return a NSSCKFWCryptoOperation which
    * can supply update, final, the single part updateFinal, and
    * the combo updateCombo functions.
    *
    * For simplicity, the routines are listed in summary here:
    *
    *  EncryptInit,
    *  DecryptInit,
    *  DigestInit,
    *  SignInit,
    *  SignRecoverInit;
    *  VerifyInit,
    *  VerifyRecoverInit;
    *
    * The key-management routines are
    *
    *  GenerateKey
    *  GenerateKeyPair
    *  WrapKey
    *  UnwrapKey
    *  DeriveKey
    *
    * All of these routines based on the Cryptoki API;
    * see PKCS#11 for further information.
    */
   /*
    */
   NSSCKMDCryptoOperation * (PR_CALLBACK *EncryptInit)(
     NSSCKMDMechanism *mdMechanism,
     NSSCKFWMechanism *fwMechanism,
     CK_MECHANISM_PTR  pMechanism,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSCKMDObject *mdKey,
     NSSCKFWObject *fwKey,
     CK_RV *pError
   );
   /*
    */
   NSSCKMDCryptoOperation * (PR_CALLBACK *DecryptInit)(
     NSSCKMDMechanism *mdMechanism,
     NSSCKFWMechanism *fwMechanism,
     CK_MECHANISM_PTR  pMechanism,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSCKMDObject *mdKey,
     NSSCKFWObject *fwKey,
     CK_RV *pError
   );
   /*
    */
   NSSCKMDCryptoOperation * (PR_CALLBACK *DigestInit)(
     NSSCKMDMechanism *mdMechanism,
     NSSCKFWMechanism *fwMechanism,
     CK_MECHANISM_PTR  pMechanism,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_RV *pError
   );
   /*
    */
   NSSCKMDCryptoOperation * (PR_CALLBACK *SignInit)(
     NSSCKMDMechanism *mdMechanism,
     NSSCKFWMechanism *fwMechanism,
     CK_MECHANISM_PTR  pMechanism,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSCKMDObject *mdKey,
     NSSCKFWObject *fwKey,
     CK_RV *pError
   );
   /*
    */
   NSSCKMDCryptoOperation * (PR_CALLBACK *VerifyInit)(
     NSSCKMDMechanism *mdMechanism,
     NSSCKFWMechanism *fwMechanism,
     CK_MECHANISM_PTR  pMechanism,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSCKMDObject *mdKey,
     NSSCKFWObject *fwKey,
     CK_RV *pError
   );
   /*
    */
   NSSCKMDCryptoOperation * (PR_CALLBACK *SignRecoverInit)(
     NSSCKMDMechanism *mdMechanism,
     NSSCKFWMechanism *fwMechanism,
     CK_MECHANISM_PTR  pMechanism,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSCKMDObject *mdKey,
     NSSCKFWObject *fwKey,
     CK_RV *pError
   );
   /*
    */
   NSSCKMDCryptoOperation * (PR_CALLBACK *VerifyRecoverInit)(
     NSSCKMDMechanism *mdMechanism,
     NSSCKFWMechanism *fwMechanism,
     CK_MECHANISM_PTR  pMechanism,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSCKMDObject *mdKey,
     NSSCKFWObject *fwKey,
     CK_RV *pError
   );
   /*
    * Key management operations.
    */
   /*
    * This routine generates a key.  This routine may return NULL
    * upon error.
    */
   NSSCKMDObject *(PR_CALLBACK *GenerateKey)(
     NSSCKMDMechanism *mdMechanism,
     NSSCKFWMechanism *fwMechanism,
     CK_MECHANISM_PTR  pMechanism,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_ATTRIBUTE_PTR pTemplate,
     CK_ULONG ulAttributeCount,
     CK_RV *pError
   );
   /*
    * This routine generates a key pair.
    */
   CK_RV (PR_CALLBACK *GenerateKeyPair)(
     NSSCKMDMechanism *mdMechanism,
     NSSCKFWMechanism *fwMechanism,
     CK_MECHANISM_PTR  pMechanism,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_ATTRIBUTE_PTR pPublicKeyTemplate,
     CK_ULONG ulPublicKeyAttributeCount,
     CK_ATTRIBUTE_PTR pPrivateKeyTemplate,
     CK_ULONG ulPrivateKeyAttributeCount,
     NSSCKMDObject **pPublicKey,
     NSSCKMDObject **pPrivateKey
   );
   /*
    * This routine wraps a key.
    */
   CK_ULONG (PR_CALLBACK *GetWrapKeyLength)(
     NSSCKMDMechanism *mdMechanism,
     NSSCKFWMechanism *fwMechanism,
     CK_MECHANISM_PTR  pMechanism,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSCKMDObject *mdWrappingKey,
     NSSCKFWObject *fwWrappingKey,
     NSSCKMDObject *mdWrappedKey,
     NSSCKFWObject *fwWrappedKey,
     CK_RV *pError
   );
   /*
    * This routine wraps a key.
    */
   CK_RV (PR_CALLBACK *WrapKey)(
     NSSCKMDMechanism *mdMechanism,
     NSSCKFWMechanism *fwMechanism,
     CK_MECHANISM_PTR  pMechanism,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSCKMDObject *mdWrappingKey,
     NSSCKFWObject *fwWrappingKey,
     NSSCKMDObject *mdKeyObject,
     NSSCKFWObject *fwKeyObject,
     NSSItem *wrappedKey
   );
   /*
    * This routine unwraps a key.  This routine may return NULL
    * upon error.
    */
   NSSCKMDObject *(PR_CALLBACK *UnwrapKey)(
     NSSCKMDMechanism *mdMechanism,
     NSSCKFWMechanism *fwMechanism,
     CK_MECHANISM_PTR  pMechanism,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSCKMDObject *mdWrappingKey,
     NSSCKFWObject *fwWrappingKey,
     NSSItem *wrappedKey,
     CK_ATTRIBUTE_PTR pTemplate,
     CK_ULONG ulAttributeCount,
     CK_RV *pError
   );
   /*
    * This routine derives a key.  This routine may return NULL
    * upon error.
    */
   NSSCKMDObject *(PR_CALLBACK *DeriveKey)(
     NSSCKMDMechanism *mdMechanism,
     NSSCKFWMechanism *fwMechanism,
     CK_MECHANISM_PTR  pMechanism,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     NSSCKMDObject *mdBaseKey,
     NSSCKFWObject *fwBaseKey,
     CK_ATTRIBUTE_PTR pTemplate,
     CK_ULONG ulAttributeCount,
     CK_RV *pError
   );
   /*
    * This object may be extended in future versions of the
    * NSS Cryptoki Framework.  To allow for some flexibility
    * in the area of binary compatibility, this field should
    * be NULL.
    */
   void *null;
 };
 /*
  * NSSCKMDObject
  *
  * This is the basic handle for any object used by a PKCS#11 Module.
  * Modules must implement it if they support their own objects, and
  * the Framework supports it for Modules that do not handle session
  * objects.  This type contains a pointer for use by the implementor,
  * to store any object-specific data, and it contains an EPV for a
  * set of routines used to access the object.
  */
 struct NSSCKMDObjectStr {
   /*
    * The implementation my use this pointer for its own purposes.
    */
   void *etc;
   /*
    * This routine is called by the Framework when it is letting
    * go of an object handle.  It can be used by the Module to
    * free any resources tied up by an object "in use."  It is
    * optional.
    */
   void (PR_CALLBACK *Finalize)(
     NSSCKMDObject *mdObject,
     NSSCKFWObject *fwObject,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine is used to completely destroy an object.
    * It is optional.  The parameter fwObject might be NULL
    * if the framework runs out of memory at the wrong moment.
    */
   CK_RV (PR_CALLBACK *Destroy)(
     NSSCKMDObject *mdObject,
     NSSCKFWObject *fwObject,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This helper routine is used by the Framework, and is especially
    * useful when it is managing session objects on behalf of the
    * Module.  This routine is optional; if unimplemented, the
    * Framework will actually look up the CKA_TOKEN attribute.  In the
    * event of an error, just make something up-- the Framework will
    * find out soon enough anyway.
    */
   CK_BBOOL (PR_CALLBACK *IsTokenObject)(
     NSSCKMDObject *mdObject,
     NSSCKFWObject *fwObject,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance
   );
   /*
    * This routine returns the number of attributes of which this
    * object consists.  It is mandatory.  It can return zero on
    * error.
    */
   CK_ULONG (PR_CALLBACK *GetAttributeCount)(
     NSSCKMDObject *mdObject,
     NSSCKFWObject *fwObject,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_RV *pError
   );
   /*
    * This routine stuffs the attribute types into the provided array.
    * The array size (as obtained from GetAttributeCount) is passed in
    * as a check; return CKR_BUFFER_TOO_SMALL if the count is wrong
    * (either too big or too small).
    */
   CK_RV (PR_CALLBACK *GetAttributeTypes)(
     NSSCKMDObject *mdObject,
     NSSCKFWObject *fwObject,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_ATTRIBUTE_TYPE_PTR typeArray,
     CK_ULONG ulCount
   );
   /*
    * This routine returns the size (in bytes) of the specified
    * attribute.  It can return zero on error.
    */
   CK_ULONG (PR_CALLBACK *GetAttributeSize)(
     NSSCKMDObject *mdObject,
     NSSCKFWObject *fwObject,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_ATTRIBUTE_TYPE attribute,
     CK_RV *pError
   );
   /*
    * This routine returns an NSSCKFWItem structure.
    * The item pointer points to an NSSItem containing the attribute value.
    * The needsFreeing bit tells the framework whether to call the
    * FreeAttribute function . Upon error, an NSSCKFWItem structure
    * with a NULL NSSItem item pointer will be returned
    */
   NSSCKFWItem (PR_CALLBACK *GetAttribute)(
     NSSCKMDObject *mdObject,
     NSSCKFWObject *fwObject,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_ATTRIBUTE_TYPE attribute,
     CK_RV *pError
   );
   /*
    * This routine returns CKR_OK if the attribute could be freed.
    */
   CK_RV (PR_CALLBACK *FreeAttribute)(
     NSSCKFWItem * item
   );
   /*
    * This routine changes the specified attribute.  If unimplemented,
    * the object will be considered read-only.
    */
   CK_RV (PR_CALLBACK *SetAttribute)(
     NSSCKMDObject *mdObject,
     NSSCKFWObject *fwObject,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_ATTRIBUTE_TYPE attribute,
     NSSItem *value
   );
   /*
    * This routine returns the storage requirements of this object,
    * in bytes.  Cryptoki doesn't strictly define the definition,
    * but it should relate to the values returned by the "Get Memory"
    * routines of the NSSCKMDToken.  This routine is optional; if
    * unimplemented, the Framework will consider this information
    * sensitive.  This routine may return zero on error.  If the
    * specified error is CKR_OK, zero will be accepted as a valid
    * response.
    */
   CK_ULONG (PR_CALLBACK *GetObjectSize)(
     NSSCKMDObject *mdObject,
     NSSCKFWObject *fwObject,
     NSSCKMDSession *mdSession,
     NSSCKFWSession *fwSession,
     NSSCKMDToken *mdToken,
     NSSCKFWToken *fwToken,
     NSSCKMDInstance *mdInstance,
     NSSCKFWInstance *fwInstance,
     CK_RV *pError
   );
   /*
    * This object may be extended in future versions of the
    * NSS Cryptoki Framework.  To allow for some flexibility
    * in the area of binary compatibility, this field should
    * be NULL.
    */
   void *null;
 };
 #endif /* NSSCKMDT_H */

The Tor Browser / annotate

security/nss/lib/ckfw/nssckmdt.h@b8a032363ba2 (annotated)

security/nss/lib/ckfw/nssckmdt.h