Add new PKCS#11 indestructible attribute feature#404
Add new PKCS#11 indestructible attribute feature#404sahesaha wants to merge 1 commit intoOP-TEE:masterfrom
Conversation
sahesaha
force-pushed
the
add-new-pkcs11-Indestructible-attribute
branch
from
83f89d6 to
72f1d94
Compare
|
This pull request has been marked as a stale pull request because it has been open (more than) 30 days with no activity. Remove the stale label or add a comment, otherwise this pull request will automatically be closed in 5 days. Note, that you can always re-open a closed issue at any time. |
|
Commenting to keep alive. |
|
This pull request has been marked as a stale pull request because it has been open (more than) 30 days with no activity. Remove the stale label or add a comment, otherwise this pull request will automatically be closed in 5 days. Note, that you can always re-open a closed issue at any time. |
|
Ping @etienne-lms |
etienne-lms
left a comment
etienne-lms
left a comment
There was a problem hiding this comment.
Could you refine the commit message: prefix the header line + add a small description in the message body? E.g.:
libckteec: Add PKCS#11 vendor specific indestructible attribute
Add CKA_OPTEE_INDESTRUCTIBLE vendor specific attribute ID
for object that should never be destroyed, even on token re-initialization.
Signed-off-by: ...
libckteec/include/pkcs11.h
Outdated
| #define CKA_SUPPORTED_CMS_ATTRIBUTES 0x0503 | ||
| #define CKA_ALLOWED_MECHANISMS (0x0600 | CKF_ARRAY_ATTRIBUTE) | ||
| /* Vendor Defined Indestructible Attribute */ | ||
| #define CKA_INDESTRUCTIBLE 0x80000010 |
There was a problem hiding this comment.
| #define CKA_INDESTRUCTIBLE 0x80000010 | |
| #define CKA_INDESTRUCTIBLE (0x0010 | CKA_VENDOR_DEFINED) |
Also, since it is an OP-TEE specific attribute, I think it should be renamed CKA_OPTEE_INDESTRUCTIBLE.
libckteec/include/pkcs11_ta.h
Outdated
| /* Vendor extension: reserved for undefined ID (~0U) */ | ||
| PKCS11_CKA_UNDEFINED_ID = PKCS11_UNDEFINED_ID, | ||
| /* Vendor Defined Indestructible Attribute */ | ||
| PKCS11_CKA_INDESTRUCTIBLE = 0x80000010, |
There was a problem hiding this comment.
For consistency, could you keep the IDs sorted by increasing value:
+ /* Vendor Defined Indestructible Attribute */
+ PKCS11_CKA_OPTEE_INDESTRUCTIBLE = 0x80000010,
/* Vendor extension: reserved for undefined ID (~0U) */
PKCS11_CKA_UNDEFINED_ID = PKCS11_UNDEFINED_ID,I think it would be nice to introduce also PKCS11_VENDOR_DEFINED (and also PKCS11_CKA_ARRAY_ATTRIBUTE) macros:
PKCS11_CKA_OPTEE_INDESTRUCTIBLE = (PKCS11_CKA_VENDOR_DEFINED |
0x0010),
sahesaha
force-pushed
the
add-new-pkcs11-Indestructible-attribute
branch
from
72f1d94 to
8f1a5cf
Compare
|
@etienne-lms, addressed and changed the macros accordingly the macro added for this requirement in optee_ta to what you suggested there. |
sahesaha
force-pushed
the
add-new-pkcs11-Indestructible-attribute
branch
from
8f1a5cf to
2234a7a
Compare
Add CKA_OPTEE_INDESTRUCTIBLE vendor specific attribute ID for object that should never be destroyed, even on token re-initialization. Reviewed-by: Neeraj Soni <neersoni@qti.qualcomm.com> Signed-off-by: Saheli Saha <sahesaha@qti.qualcomm.com>
sahesaha
force-pushed
the
add-new-pkcs11-Indestructible-attribute
branch
from
2234a7a to
ba80ea5
Compare
|
@etienne-lms, addressed and changed the macros accordingly the macro added for this requirement in optee_ta to what you suggested there. |
| /* Vendor extension: reserved for undefined ID (~0U) */ | ||
| PKCS11_CKA_UNDEFINED_ID = PKCS11_UNDEFINED_ID, | ||
| /* Vendor Defined Indestructible Attribute */ | ||
| PKCS11_CKA_OPTEE_INDESTRUCTIBLE = 0x80000001, |
There was a problem hiding this comment.
Could you intend with tabulation, and swap the 2 IDs:
| /* Vendor extension: reserved for undefined ID (~0U) */ | |
| PKCS11_CKA_UNDEFINED_ID = PKCS11_UNDEFINED_ID, | |
| /* Vendor Defined Indestructible Attribute */ | |
| PKCS11_CKA_OPTEE_INDESTRUCTIBLE = 0x80000001, | |
| /* Vendor Defined Indestructible Attribute */ | |
| PKCS11_CKA_OPTEE_INDESTRUCTIBLE = 0x80000001, | |
| /* Vendor extension: reserved for undefined ID (~0U) */ | |
| PKCS11_CKA_UNDEFINED_ID = PKCS11_UNDEFINED_ID, |
3 participants
This change defines attributes needed for Indestructible attribute feature.