C_VerifyInit

Initializes a verification operation.

CK_DECLARE_FUNCTION( CK_RV, C_VerifyInit )( CK_SESSION_HANDLE hSession,
                                            CK_MECHANISM_PTR pMechanism,
                                            CK_OBJECT_HANDLE hKey )
{
    P11Session_t * pxSession;
    CK_RV xResult = CKR_OK;
    CK_OBJECT_HANDLE xPalHandle = CK_INVALID_HANDLE;
    CK_BYTE_PTR pxLabel = NULL;
    CK_ULONG xLabelLength = 0;
    CK_BYTE_PTR pucKeyData = NULL;
    CK_ULONG ulKeyDataLength = 0;
 
    /* See explanation in prvCheckValidSessionAndModule for this exception. */
    /* coverity[misra_c_2012_rule_10_5_violation] */
    CK_BBOOL xIsPrivate = ( CK_BBOOL ) CK_TRUE;
 
    pxSession = prvSessionPointerFromHandle( hSession );
    xResult = prvCheckValidSessionAndModule( pxSession );
 
    if( NULL == pMechanism )
    {
        LogError( ( "Failed to initialize verify operation. Null verification "
                    "mechanism provided." ) );
        xResult = CKR_ARGUMENTS_BAD;
    }
 
    /* See explanation in prvCheckValidSessionAndModule for this exception. */
    /* coverity[misra_c_2012_rule_10_5_violation] */
    if( ( xResult == CKR_OK ) && ( prvOperationActive( pxSession ) == ( CK_BBOOL ) CK_TRUE ) )
    {
        LogError( ( "Failed to initialize verify operation. An operation was "
                    "already active." ) );
        xResult = CKR_OPERATION_ACTIVE;
    }
 
    if( xResult == CKR_OK )
    {
        prvFindObjectInListByHandle( hKey,
                                     &xPalHandle,
                                     &pxLabel,
                                     &xLabelLength );
 
        if( xPalHandle != CK_INVALID_HANDLE )
        {
            xResult = PKCS11_PAL_GetObjectValue( xPalHandle, &pucKeyData, &ulKeyDataLength, &xIsPrivate );
 
            if( xResult != CKR_OK )
            {
                LogError( ( "Failed to initialize verify operation. Unable to "
                            "retrieve value of public key for verification 0x%0lX.",
                            ( unsigned long int ) xResult ) );
                xResult = CKR_KEY_HANDLE_INVALID;
            }
        }
        else
        {
            LogError( ( "Failed to initialize verify operation. Couldn't find "
                        "a valid PKCS #11 PAL Handle." ) );
            xResult = CKR_KEY_HANDLE_INVALID;
        }
    }
 
    /* Retrieve key value from storage. */
    if( xResult == CKR_OK )
    {
        /* Mutex is used to protect the verification keys and contexts. */
        if( 0 == mbedtls_mutex_lock( &pxSession->xVerifyMutex ) )
        {
            switch( pMechanism->mechanism )
            {
                case CKM_RSA_X_509:
                case CKM_ECDSA:
 
                    /* See explanation in prvCheckValidSessionAndModule for this exception. */
                    /* coverity[misra_c_2012_rule_10_5_violation] */
                    if( xIsPrivate != ( CK_BBOOL ) CK_FALSE )
                    {
                        LogError( ( "Failed to initialize verify operation. Verify "
                                    "operation attempted with private key." ) );
                        xResult = CKR_KEY_TYPE_INCONSISTENT;
                    }
                    else if( ( pxSession->xVerifyKeyHandle == CK_INVALID_HANDLE ) || ( pxSession->xVerifyKeyHandle != hKey ) )
                    {
                        xResult = prvVerifyInitEC_RSAKeys( pxSession, pMechanism, hKey, pucKeyData, ulKeyDataLength );
                    }
                    else
                    {
                        /* The correct credentials are already Initialized. */
                    }
 
                    break;
 
                case CKM_SHA256_HMAC:
 
                    if( ( pxSession->xHMACKeyHandle == CK_INVALID_HANDLE ) || ( pxSession->xHMACKeyHandle != hKey ) )
                    {
                        xResult = prvVerifyInitSHA256HMAC( pxSession, hKey, pucKeyData, ulKeyDataLength );
                    }
 
                    break;
 
                case CKM_AES_CMAC:
 
                    if( ( pxSession->xCMACKeyHandle == CK_INVALID_HANDLE ) || ( pxSession->xCMACKeyHandle != hKey ) )
                    {
                        xResult = prvVerifyInitAESCMAC( pxSession, hKey, pucKeyData, ulKeyDataLength );
                    }
 
                    break;
 
                default:
                    LogError( ( "Failed to initialize verify operation. Received "
                                "an unknown or invalid mechanism." ) );
                    xResult = CKR_MECHANISM_INVALID;
                    break;
            }
 
            ( void ) mbedtls_mutex_unlock( &pxSession->xVerifyMutex );
        }
        else
        {
            LogError( ( "Verify operation failed. Could not take verify mutex." ) );
            xResult = CKR_CANT_LOCK;
        }
    }
 
    if( xPalHandle != CK_INVALID_HANDLE )
    {
        PKCS11_PAL_GetObjectValueCleanup( pucKeyData, ulKeyDataLength );
    }
 
    if( xResult == CKR_OK )
    {
        LogDebug( ( "Verify mechanism set to 0x%0lX.", ( unsigned long int ) pMechanism->mechanism ) );
        pxSession->xOperationVerifyMechanism = pMechanism->mechanism;
    }
 
    return xResult;
}

See also

C_Verify() completes verifications initiated by C_VerifyInit().

Note

C_Verify() parameters are shared by a session. Calling C_VerifyInit() & C_Verify() with the same session across different tasks may lead to unexpected results.

Parameters

[in]	hSession	Handle of a valid PKCS #11 session.
[in]	pMechanism	Mechanism used to verify signature. This port supports the following mechanisms: CKM_RSA_X_509 for RSA verifications CKM_ECDSA for elliptic curve verifications
[in]	hKey	The handle of the public key to be used for verification. Key must be compatible with the mechanism chosen by pxMechanism.

Returns

CKR_OK if successful.