RSA Security 5.2.2 manual KeypairGenParams.privateKeyAttributes.tokenFlag =, Tfprivate

Using Cryptographic Hardware

B_KEYPAIR_GEN_PARAMS keypairGenParams;

keypairGenParams.privateKeyAttributes.keyUsage =

CF_DIGITAL_SIGNATURE;

keypairGenParams.privateKeyAttributes.tokenFlag =

TF_PRIVATE;

keypairGenParams.privateKeyAttributes.start = 0; keypairGenParams.privateKeyAttributes.end = 0; keypairGenParams.publicKeyAttributes.keyUsage =

CF_DIGITAL_SIGNATURE;

keypairGenParams.publicKeyAttributes.tokenFlag = TF_RESIDE_ON_TOKEN;

keypairGenParams.publicKeyAttributes.start = 0; keypairGenParams.publicKeyAttributes.end = 0; keypairGenParams.keypairGenInfoType = AI_RSAKeyGen; keypairGenParams.keypairGenInfo = (POINTER)&keyGenParams; if ((status = B_SetAlgorithmInfo

(rsaGen, AI_KeypairGen, (POINTER)&keypairGenParams)) != 0)

break;

This AI has an associated info data struct that allows you to set attributes. See the Reference Manual for complete lists of valid flags. To set more than one attribute, OR them together.

Notice the start and end attributes. Those are for when you want to have a validity period on your key. If you want to require the user to generate a new key every so often, set the start and end dates. If not, pass in 0. The value to pass in is the number of seconds since 12:00 AM GMT, January 1, 1970. This is generally the result of the system call T_Time (or some such name). It is generally a 32-bit integer. We define it as RSA_TIME_T which is typedef'd to a 32-bit unsigned int. In the future, some platforms may decide to use a 64-bit integer for time. For those platforms, RSA_TIME_T will be typedef'd to a 64-bit integer.

If you do not use this AI to generate your key pair, Crypto-C will allow the token to decide what the attributes will be. That is, PKCS #11 defines some default attributes and defines what is the default for each token attribute that PKCS #11 does not define. However, some tokens still may not allow such a scheme. For instance, PKCS #11 defines an attribute CKA_TOKEN as false by default. If you set the token flag to TF- RESIDE_ON_TOKEN, you are overriding the default value. But if you do not specify any attributes, the token must create a non-token key pair. Some manufacturers may not allow this, so a token may not be able to perform the default behavior. Therefore, you

C h a p t e r 4 U s i n g C r y p t o - C 1 3 9