multitoken

multitoken is a simple demonstration tool that allows you to perform basic cryptographic functions on a Luna HSM. It allows you to specify an operation, and one or more “slots” or HSM Partitions on which to perform that operation. The multitoken utility runs the operations and returns a summary of the results.

NOTE   This is a general-purpose tool intended for use across Luna HSM versions. It might reference mechanisms and features that are not available on all Luna products.

Accessing multitoken

The multitoken utility is accessed via the command line.

To access the multitoken utility

1.Open a console window.

2.Go to the Luna HSM Client installation folder/directory:

Windows	C:\Program Files\SafeNet\LunaClient
Linux/Unix	/usr/safenet/lunaclient/bin
Client downloaded from Data Protection on Demand	<client_unzip_location>

3.Launch the multitoken utility:

./multitoken

Syntax

multitoken-mode <mode> {-slots <slot_list> | -nslots <slot_threads>} [options...]

Argument(s)	Shortcut	Description
-alarm <secs>	-al	Sound periodic alarm (every <secs> seconds) if error occurs.
-applytochild	-atc	Apply the PerKeyAuth settings to any child keys that are created (ie. derived or unwrapped as part of the test). [for PKA]
-assigned	-as	Generate keys as assigned (CKA_ASSIGNED=1). [for PKA]
-blob <blob_count>	-b	Number of data blobs to be signed during each multisign operation.
-curve <curve_num>	-crv	ID number of ECC curve. If user-defined (99), then must specify -parmfile.
-delayop <secs>	-do	Delay the operation performed by each thread by the specified number of seconds. Value must be larger than "0".
-destroyafter	-da	Destroys created objects on the HSM only after test completes.
-destroyafterbulk	-dab	Destroys created objects on the HSM only after test completes using DestroyMultipleObjects.
-eciesdata <filename>	-ecd	ECIES SHIM mode: Specifies the file that contains the plaintext data to use. Non-SHIM ECIES mode: Specifies the file to receive the plaintext data used. See Notes for details on using SHIM and non-SHIM ECIES modes.
-eciesenc <filename>	-ece	ECIES SHIM mode: Specifies the file that contains the encrypted data. Non-SHIM ECIES mode: Specifies the file to receive the encrypted data. See Notes for details on using SHIM and non-SHIM ECIES modes.
-ecieskey <filename>	-eck	ECIES SHIM mode: Specifies the file that contains the DER-encoded private key. Non-SHIM ECIES mode: Specifies the file to receive the DER-encoded private key. See Notes for details on using SHIM and non-SHIM ECIES modes.
-enddate <YYYYMMDD>	-end	Validity end date for key, in YYYYMMDD format.
-force	-f	Avoid prompts for responses.
-gcmaad <bytes>	-gad	Specify the length of the AAD data used for GCM/GMAC. The AAD data can not be larger than 1024 bytes.
-gcmiv <bits>	-giv	Specify the length of the IV (in bits) to be used for GCM/GMAC. Valid values: 0,96,128
-haaidhigh <value>	-hah	Specify the AppID High value.
-haaidlow <value>	-hal	Specify the AppID Low value.
-haaidoffset <value>	-hao	Specify the AppID Low value increment for each thread.
-haslot <value>	-has	Specify the slot id for the secondary.
-halogout <value>	-hat	Specify that the session should be logged out.
-haclosesess	-hac	Specify that the session should be closed.
-hacloseappid <value>	-haa	Specify the AppID that should be closed.
-help	-h	Display help information only.
-kdfchoice <kdf_index>	-kdf	Select key derivation function - specify choice list index.
-kdfscnt <counter_index>	-kds	Select key derivation session counter type - specify choice list index.
-kekreplace	-kre	Specifies that a KEK replacement should be requested after the specified number of iterations. This option only works with DES3/AES ECB/CBC tests. It will be ignored for all other test modes.
-key <key_size>	-k	Size of key: asymmetric in bits (default = 1024 for RSA, 2048 for DSA). Symmetric in bytes (i.e. 16, 24, 32 for AES/ARIA).
-keyauthtype <key_index>	-kat	Specify the type Per Key Authorization test to performed. [for PKA]   1 = Authorize the key once and use it many times 2 = Authorize the key once, use it once, rescind the key
-keyauthdata <data>	-kad	Specify the authorization data to use for the key. [for PKA]
-keychoice <key_index>	-kc	Select key type to derive/generate - specify choice list index.
-keyderiv <keysize>	-kde	Size of key to derive with (ex. 1024 for X9.42 Diffie Hellman).
-kwicv	-kiv	Use external ICV for the key wrap mechanism.
-limitedco <keysize>	-lco	Login as the Limited Crypto Officer (default is Crypto Officer).
-logfile <filename>	-l	File for results logging.
-mode <mode>	-m	Operating mode. See mode values available below.
-multipartsig	-msig	Use multipart signatures.
-nodec	-nod	Decryption operation will not be performed. Only symmetric and asymmetric encryption will be performed and measured.
-nodestroy	-n	Leaves created objects on the HSM after test completes.
-noenc	-noe	Perform only one encryption operation. Only symmetric and asymmetric decryption will be performed and measured.
-nosign	-nos	Perform only one sign operation. Only verify will be performed and measured.
-nounwrap	-nou	Unwrapping operation will not be performed. Only wrapping will be performed and measured.
-noverify	-nov	Verify operation will not be performed. Only sign will be performed and measured.
-noverifyr	-nvr	Do not verify decryption results.
-nowrap	-now	Perform only one wrapping operation. Only unwrapping will be performed and measured.
-nslots <slot_threads>	-ns	Create multiple threads on the same slot(s). Specify <slot>x<number of threads>, with multiple slots separated by commas. The example below creates 5 threads on slot 1 and 20 threads on slot 2: Example: -nslots 1x5,2x20 You must specify either this option or -slots. See -slots <slots>.
-objcount <objnum>	-obj	Interpretation of this parameter depends on test mode. If this is a find objects test, it specifies the number of objects to create. If this parameter is unspecified, a default of 1000 is used. For symgen operations, this specifies the total number of objects to create. If this parameter is unspecified, a default of 0 is used, which means 'unlimited'. For rsakeygen operations, this specifies the total number of key pairs to create. Again, if this parameter is unspecified, a default of 0 is used, which means 'unlimited'.
-outputlen <length-in-bytes>	-ol	Size of output length in bytes for SHAKE.
-packet <packet_size>	-p	Size of packet used in operation.
-parmfile <param_file>	-prm	File for EC curve parameters or OAEP source data (0 = none for OAEP).
-password <password>	-pwd	Specify password to use for token.
-pbkd2prf		Specify the type of PRF to use for PBKD2-based key derivation.
-ped <0/1>	-ped	Specifies the type of PED connection. This applies only to the first HSM slot to be specified using the -slots option. Valid values:0(local),1(remote)
-prftype <type>	-prf	Specify the type of PRF to use for PRF based key derivation.
-scroll	-scr	Scroll the output instead of overwriting it each time.
-session	-ses	Use session objects instead of token objects.
-sharefile <filename>	-shf	Shared data file used for operation.
-silent	-sil	Disables system "beep" that is generated when a error occurs.
-slots <slots>	-s	List of slots to use (slot numbers separated by commas). List the same slot multiple times to create multiple threads on that slot. The example below creates 2 threads on slot 1 and 3 threads on slot 2: Example: -slots 1,1,2,2,2 To create many threads on the same slot, use -nslots instead. See -nslots <slot_threads>.
-startdate <YYYYMMDD>	-sta	Validity start date for key in format <YYYYMMDD>.
-subprime <size>	-sub	Size of the subprime in bits.
-sym_c_u_d <value>	-scud	For each test loop, create the key(s), use the key(s) and then delete the key(s). Only supported for symmetric enc/dec/sig/verifywhen -nosign, -noverify, -noenc and -nodec are NOT used. This argument takes a value that indicates how many times the key(s) should be used before it is deleted and a new key(s) is created. This value must be 1 or larger.
-symm <mechanism>	-sym	Select symmetric key mechanism for symderive/pbegen or key choice for symgen (can also use -keychoice).
-template	-tp	Attaches a generic unwrap template or derive template for the wrapunwrap or symderive mode respectively.
-timed <secs>	-t	Fixed amount of time to run (seconds).
-usage <uses>	-u	Number of times a key is allowed to be used.
-verbose	-v	Show all thread performances. Default is only first and last threads.

Operating Modes

The following table lists the available operating modes for the multitoken utility. The operating mode is specified using the -mode parameter.

Mode	Description
aescmac	AES CMAC sign
aesenc	AES ECB encrypt
aesenccbc	AES CBC encrypt
aesenccfb8	AES CFB8 encrypt
aesenccfb128	AES CFB128 encrypt
aesencctr	AES CTR encrypt
aesencgcm	AES GCM encrypt
aesenckw	AES KW encrypt
aesenckwp	AES KWP encrypt
aesencofb	AES OFB encrypt
aesgmac	AES GMAC sign
aesmac	AES MAC sign
aeswrapkw	AES KW wrap
aeswrapkwp	AES KWP wrap
aesxts	AES XTS encrypt
ariacmac	ARIA CMAC sign
ariaenc	ARIA ECB encrypt
ariaenccbc	ARIA CBC encrypt
ariaenccfb8	ARIA CFB8 encrypt
ariaenccfb128	ARIA CFB128 encrypt
ariaencctr	ARIA CTR encrypt
ariaencofb	ARIA OFB encrypt
ariamac	ARIA MAC sign
bip32childkeyderive	BIP32 Child Key (Normal) Derivation
bip32childkeyhardenedderive	BIP32 Child Key (Hardened) Derivation
bip32childkeypublicderive	BIP32 Child Key (public to public) Derivation
bip32gbcssha256sigver	SHA256 BIP32-GBCS sign
bip32masterkeyderive	BIP32 Master Key Derivation
bip32sha1sigver	SHA1 BIP32 sign
bip32sha224sigver	SHA224 BIP32 sign
bip32sha256sigver	SHA256 BIP32 sign
bip32sha384sigver	SHA384 BIP32 sign
bip32sha512sigver	SHA512 BIP32 sign
bip32sigver	BIP32 sign
des3enccfb8	DES3 CFB8 encrypt
des3enccfb64	DES3 CFB64 encrypt
des3encctr	DES3 CTR encrypt
des3encofb	DES3 OFB encrypt
descmac	DES3 CMAC sign
desenc	DES3 ECB encrypt
desenccbc	DES3 CBC encrypt
desmac	DES3 MAC sign
desx919mac	DES3 X919 MAC sign
dhparamsgen	DH Domain Parameter Generation
dsakeygen	DSA Key Generation
dsaparamsgen	DSA Domain Parameter Generation
dsasigver	DSA bare sign
dukptderive	DUKPT key derivation
ecdhcderive	ECDH Cofactor derive key
ecdhderive	ECDH derive key
ecdhderivewrapnew	ECDH derive and wrap new
ecdhderivewrapold	ECDH derive and wrap old
ecdsagbcssha256sigver	SHA256 ECDSA-GBCS sign
ecdsakeygen	ECDSA Key Generation
ecdsakeygenwextrabits	ECDSA Key Gen with Extra Bits
ecdsasha1sigver	SHA1 ECDSA sign
ecdsasha224sigver	SHA224 ECDSA sign
ecdsasha256sigver	SHA256 ECDSA sign
ecdsasha384sigver	SHA384 ECDSA sign
ecdsasha512sigver	SHA512 ECDSA sign
ecdsasha3-224sigver	SHA3-224 ECDSA sign
ecdsasha3-256sigver	SHA3-256 ECDSA sign
ecdsasha3-384sigver	SHA3-384 ECDSA sign
ecdsasha3-512sigver	SHA3-512 ECDSA sign
ecdsasigver	ECDSA sign
ecedwardskeygen	EC Edwards Key Generation
eciesaes128hmacsha256	ECIES AES-128 enc/dec with HMAC SHA256
eciesaes128hmacsha256shared	ECIES AES-128 enc/dec with HMAC SHA256 and shared data
eciesaes192hmacsha384	ECIES AES-192 enc/dec with HMAC SHA384
eciesaes192hmacsha384shared	ECIES AES-192 enc/dec with HMAC SHA384 and shared data
eciesaes256hmacsha512	ECIES AES-256 enc/dec with HMAC SHA512
eciesaes256hmacsha512shared	ECIES AES-256 enc/dec with HMAC SHA512 and shared data
eciesdes3hmacsha224	ECIES DES3 enc/dec with HMAC SHA224
eciesdes3hmacsha224shared	ECIES DES3 enc/dec with HMAC SHA224 and shared data
eciesshimaes128hmacsha256	ECIES AES-128 with HMAC SHA256 decrypt
eciesshimaes128hmacsha256shared	ECIES AES-128 with HMAC SHA256 and shared data decrypt
eciesshimaes192hmacsha384	ECIES AES-192 with HMAC SHA384 decrypt
eciesshimaes192hmacsha384shared	ECIES AES-192 with HMAC SHA384 and shared data decrypt
eciesshimaes256hmacsha512	ECIES AES-256 with HMAC SHA512 decrypt
eciesshimaes256hmacsha512shared	ECIES AES-256 with HMAC SHA512 and shared data decrypt
eciesshimdes3hmacsha224	ECIES DES3 with HMAC SHA224 decrypt
eciesshimdes3hmacsha224shared	ECIES DES3 with HMAC SHA224 and shared data decrypt
eciesshimxorhmacsha1	ECIES XOR with HMAC SHA1 decrypt
eciesshimxorhmacsha1shared	ECIES XOR with HMAC SHA1 and shared data decrypt
eciesxorhmacsha1	ECIES XOR enc/dec with HMAC SHA1
eciesxorhmacsha1shared	ECIES XOR enc/dec with HMAC SHA1 and shared data
ecmontkeygen	EC Montgomery Key Generation
eddsanaclsha1sigver	SHA1 EDDSA NaCl sign
eddsanaclsha224sigver	SHA224 EDDSA NaCl sign
eddsanaclsha256sigver	SHA256 EDDSA NaCl sign
eddsanaclsha384sigver	SHA384 EDDSA NaCl sign
eddsanaclsha512sigver	SHA512 EDDSA NaCl sign
eddsanaclsigver	EDDSA NaCl sign
eddsasha1sigver	SHA1 EDDSA sign
eddsasha224sigver	SHA224 EDDSA sign
eddsasha256sigver	SHA256 EDDSA sign
eddsasha384sigver	SHA384 EDDSA sign
eddsasha512sigver	SHA512 EDDSA sign
eddsaphsigver	EDDSA PH sign
eddsasigver	EDDSA sign
extractinsert	Extract Insert masked objects
findobject	Find objects
haLogin	HA Login
kcdsakeygen	KCDSA Key Generation
kcdsasha1sigver	SHA51 KCDSA sign
kcdsasha1sigvernopad	SHA1 KCDSA NO-PAD sign
kcdsasha224sigver	SHA224 KCDSA sign
kcdsasha224sigvernopad	SHA224 KCDSA NO-PAD sign
kcdsasha256sigver	SHA256 KCDSA sign
kcdsasha256sigvernopad	SHA256 KCDSA NO-PAD sign
kcdsasha384sigver	SHA384 KCDSA sign
kcdsasha384sigvernopad	SHA384 KCDSA NO-PAD sign
kcdsasha512sigver	SHA512 KCDSA sign
kcdsasha512sigvernopad	SHA512 KCDSA NO-PAD sign
kcdsasigver	HAS160 KCDSA 1024-bit sign
kcdsasigvernopad	HAS160 KCDSA NO-PAD 1024-bit sign
keccak-224	KECCAK-224 Hashing
keccak-256	KECCAK-256 Hashing
keccak-384	KECCAK-384 Hashing
keccak-512	KECCAK-512 Hashing
md5	MD5 Hashing
milenage	3GPP Milenage AUTN
multisignvalue	Multisign w/ masked key   NOTE: not used; deprecated.
ntlsEcho	Test NTLS/SSL Throughput
objectcreation	Create/delete object
openclosesession	Open/close session
pbegen	PBE key generation
randgen	Random number generation
rc4enc	RC4 encrypt
rsa1863auxprimekeygen	RSA FIPS 186-3 using Auxiliary Primes key generation
rsa1863primekeygen	RSA FIPS 186-3 using Primes key generation
rsaenc	RSA encrypt
rsakeygen	RSA key generation
rsaoaepenc	RSA OAEP encrypt
rsapkcsenc	RSA PKCS encrypt / decrypt
rsasigver	RSA sign
rsax931keygen	RSA X9.31 key generation
rsax931sigver	X9.31 RSA sign
seedcmac	SEED CMAC sign
seedenc	SEED ECB encrypt
seedenccbc	SEED CBC encrypt
seedencctr	SEED CTR encrypt
seedmac	SEED MAC sign
sha1	SHA-1 Hashing
sha1dsasigver	SHA1 DSA sign
sha1hmac	SHA1 HMAC sign
sha1rsapsssigver	SHA1 RSA PSS sign
sha1rsasigver	SHA1 with RSA sign
sha1rsax931sigver	SHA1 X9.31 RSA sign
sha224	SHA-224 Hashing
sha224dsasigver	SHA224 DSA sign
sha224hmac	SHA224 HMAC sign
sha224rsaoaepenc	SHA224 RSA OAEP encrypt
sha224rsapsssigver	SHA224 RSA PSS sign
sha224rsasigver	SHA224 with RSA sign
sha224rsax931sigver	SHA224 X9.31 RSA sign
sha256	SHA-256 Hashing
sha256dsasigver	SHA256 DSA sign
sha256hmac	SHA256 HMAC sign
sha256rsaoaepenc	SHA256 RSA OAEP encrypt
sha256rsapsssigver	SHA256 RSA PSS sign
sha256rsasigver	SHA256 with RSA sign
sha256rsax931sigver	SHA256 X9.31 RSA sign
sha384	SHA-384 Hashing
sha384hmac	SHA384 HMAC sign
sha384rsaoaepenc	SHA384 RSA OAEP encrypt
sha384rsapsssigver	SHA384 RSA PSS sign
sha384rsasigver	SHA384 with RSA sign
sha384rsax931sigver	SHA384 X9.31 RSA sign
sha512	SHA-512 Hashing
sha512hmac	SHA512 HMAC sign
sha512rsaoaepenc	SHA512 RSA OAEP encrypt
sha512rsapsssigver	SHA512 RSA PSS sign
sha512rsasigver	SHA512 with RSA sign
sha512rsax931sigver	SHA512 X9.31 RSA sign
shake-128	SHAKE-128 Hashing
shake-256	SHAKE-256 Hashing
sim3extractinsert	SIM3 Extract Insert masked objects
simextractinsert	SIMExtract Insert masked objects
simmultisign	SIMMultisign w/ masked key
sm2dsasha1sigver	SHA1 SM2DSA sign
sm2dsasha224sigver	SHA224 SM2DSA sign
sm2dsasha256sigver	SHA256 SM2DSA sign
sm2dsasha384sigver	SHA384 SM2DSA sign
sm2dsasha512sigver	SHA512 SM2DSA sign
sm2dsasigver	SM2DSA sign
sm2dsasm3sigver	SM3 SM2DSA sign
sm3	SM3 Hashing
sm3hmac	SM3 HMAC sign
sm4enc	SM4 ECB encrypt
sm4enccbc	SM4 CBC encrypt
sm4enccbcpad	SM4 CBC PAD encrypt
symderive	Symmetric key derivation
symgen	Symmetric key generation
tuak	3GPP Tuak AUTN
wrapunwrap	Wrap/unwrap operations
x942dhderive	X9.42 DH Derive
x942dhhybridderive	X9.42 DH Hybrid Derive
x942dhkeygen	X9.42 DH Key Pair Generation
x942dhparamsgen	X9.42 DH Domain Parameter Generation

Notes

1.If you are performing RSA operations, you have the option of specifying a key size (512, 1024, 2048, 4096, 8192). If no key size is specified, the default key size of 2048 will be used. For example:

multitoken -mode rsasigver -key 512 -slots 1

2.If you are performing wrapunwrap operation, it will perform the following operations:

•Generate RSA key pair and a symmetric DES key.

•Wrap DES key with RSA public key.

•Unwrap wrapped key above with RSA private key.

• Verify the unwrapped key.

3.If you are performing a Multisign operation, you have the option of specifying a key size (512, 1024, 2048, 4096, 8192). If no key size is specified, the default key size of 1024 is used. For example:

multitoken m simmultisign -ns 6x20 -pwd userpin2 -f 

4.A thread is spawned to perform tests on each slot specified. A slot can be specified multiple times, in which
case multiple threads will be created for the slot.

5.For modes :

•sha256rsasigver - SHA256 with RSA

•sha384rsasigver - SHA384 with RSA

•sha512rsasigver - SHA512 with RSA

If you specify a keysize on the command line (-key, any of 1024, 2048 or 4096), a file called "1024" or "2048" or "4096" is created - that is the keysize parameter is parsed as a filename to which results are saved.     

6.There are two types of ECIES modes, regular modes and SHIM modes. The non-SHIM modes perform normal ECIES encryption, decryption, or both. The ECIES SHIM modes (ECIES modes with the word "shim" in them) are designed to test the ECIES SHIM implementation. The ECIES SHIM only supports decryption operations, so it requires all input (private key, encrypted data and plaintext) to be specified as input files using the parameters -ecieskey, -eciesenc and -eciesenc. The input files can be created by running the non-SHIM modes, and specifying the parameters -ecieskey, -eciesdata and -eciesenc, which are optional for the non-SHIM modes.

For non-SHIM ECIES modes:

•-ecieskey -- Specifies the file to receive the DER-encoded private key.

•-eciesdata -- Specifies the file to receive the plaintext data used.

•-eciesece -- Specifies the file to receive the encrypted data.

For ECIES SHIM modes:

•-ecieskey -- Specifies the file that contains the DER-encoded private key.

•-eciesdata -- Specifies the file that contains the plaintext data to use.

•-eciesece -- Specifies the file that contains the encrypted data.

Named and User-defined Curves

The Luna HSMs employ named and user-defined curves. Multitoken supports this option, as illustrated in the following example:

C:\Program Files\SafeNet\LunaClient>multitoken -mode ecdsasigver -s 1,1,1,1,1,1,1,1

Prime field curves:

        [0]secp112r1  [1]secp112r2  [2]secp128r1  [3]secp128r2
        [4]secp160k1  [5]secp160r1  [6]secp160r2  [7]secp192k1
        [8]secp224k1  [9]secp224r1  [10]secp256k1 [11]secp384r1(P-384)
        [12]secp521r1(P-521)
        [13]X9_62_prime192v1 [14]X9_62_prime192v2 [15]X9_62_prime192v3
        [16]X9_62_prime239v1 [17]X9_62_prime239v2 [18]X9_62_prime239v3
        [19]X9_62_prime256v1(P-256)

Characteristic two field curves:

        [20]sect113r1 [21]sect113r2 [22]sect131r1 [23]sect131r2
        [24]sect163k1 [25]sect163r1 [26]sect163r2 [27]sect193r1
        [28]sect193r2 [29]sect233k1 [30]sect233r1 [31]sect239k1
        [32]sect283k1 [33]sect283r1 [34]sect409k1 [35]sect409r1
        [36]sect571k1 [37]sect571r1
        [38]X9_62_c2pnb163v1 [39]X9_62_c2pnb163v2 [40]X9_62_c2pnb163v3
        [41]X9_62_c2pnb176v1 [42]X9_62_c2tnb191v1 [43]X9_62_c2tnb191v2
        [44]X9_62_c2tnb191v3 [45]X9_62_c2pnb208w1 [46]X9_62_c2tnb239v1
        [47]X9_62_c2tnb239v2 [48]X9_62_c2tnb239v3 [49]X9_62_c2pnb272w1
        [50]X9_62_c2pnb304w1 [51]X9_62_c2tnb359v1 [52]X9_62_c2pnb368w1
        [53]X9_62_c2tnb431r1
        [54]Brainpool_P160r1 [55]Brainpool_P160t1 [56]Brainpool_P192r1
        [57]Brainpool_P192t1 [58]Brainpool_P224r1 [59]Brainpool_P224t1
        [60]Brainpool_P256r1 [61]Brainpool_P256t1 [62]Brainpool_P320r1
        [63]Brainpool_P320t1 [64]Brainpool_P384r1 [65]Brainpool_P384t1
        [66]Brainpool_P512r1 [67]Brainpool_P512t1

User Defined curves:

        [68]Microsoft PlayReady P-160


Please pick a curve (0-67) or enter (99) for a user defined curve:99

Please enter the filename for the EC parameters:

Here, you would provide the filepath to the file specifying the Elliptical Curve parameters. The format and content of the parameter file follow industry standards, and are discussed in more detail in Named Curves and User-Defined Parameters in the SDK Reference Guide.

SKS and Per Key Auth

PerKeyAuth and/or SKS (added for HSM firmware 7.7.0 and newer) can be incorporated into other test modes.

For example

Per Key Authorization:     

The "-keyauthdata" option can be used to specify authorization data (that is CKA_AUTH_DATA) that should be applied to any key(s) created to support the test.

For example, in an ECDH test, authorization data will be applied to the ECDH keys. The "-keyauthtype" can be used to specify how the authorization data is to be used.

Two main ways to use are;

>authorize the key(s) once, and use it many times and then rescind authorization, and

>authorize the key before each use and rescind authorization after each use.

For example, in an ECDH test,

>the private key can be authorized once and used for the duration of the test,
or

>the private key can be authorized before each ECDH operation and authorization is rescinded after each operation.

For tests that use an initial set of keys and create child keys (that is, derivation or wrap/unwrap tests), "applytochild" can be used specify that the Per Key Authorization settings should also be applied to the child key(s).

For key generation test, "-keyauthdata" can be specified as the generated keys are not used. The key authorization data will be applied to the generated key.

Per Key Authorization functionality can be used only on User Partitions and only by the Crypto-Officer role.  

Scalable Key Storage (SKS)

Options used for -simblobuse

SIM insertion and keys deletion test:

1.Specify both -nodec & -noenc or both -nosign and -noverify

2.Specify any crypto mode (e.g. any encrypt/decrypt or sign/verify mode)

SIM insertion, Per Key Authorization, keys deletion test:

1.Specify both -nodec & -noenc or both -nosign and -noverify

2.Specify any crypto mode (e.g. any encrypt/decrypt or sign/verify mode)
Specify Per Key Authorization options.

SIM insertion, Per Key Authorization, crypto (enc/dec or sign/verify), keys deletion test:

1.Specify any crypto mode (e.g. any encrypt/decrypt or sign/verify mode)

2.Specify Per Key Authorization options.

Example with LCO role

[me@localhost bin]# ./multitoken m simextractinsert -ns 6x20 -lco -pwd userpin2 -f 
multitoken (64-bit) v8.0.0-161. Copyright (c) 2019 SafeNet. All rights reserved.


Warning: Key size not specified.  Using default key size of 1024.

Initializing library...Finished Initializing
...done.


Do you wish to continue?

Enter 'y' or 'n': 

Constructing thread objects.
Logging in to tokens...
  slot 6...    Serial Number 1334093726636


Please wait, creating test threads.  

Test threads created successfully. Press ENTER to terminate testing.

     SIMExtract Insert masked objects:

     Using token objects.

     Logged in as Limited Crypto Officer.

               +         xfers/sec | elapsed      
 6,  0  6, 19 |   total   average  | time (secs)  |     /sec   |     /sec
------ ------ | ------- ---------- | ------------ | ---------- | ----------
  10.0   10.0 |   206.4   211.923* |          350 |        0.0 |        0.0


Waiting for threads to terminate.

[me@localhost bin]# ./multitoken m simmultisign -ns 6x20 -lco -pwd userpin2 -f 
multitoken (64-bit) v8.0.0-161. Copyright (c) 2019 SafeNet. All rights reserved.


Warning: Blob count not specified.  Using default key size of 1.

Initializing library...Finished Initializing
...done.


Do you wish to continue?

Enter 'y' or 'n': 

Constructing thread objects.
Logging in to tokens...
  slot 6...    Serial Number 1334093726636


Please wait, creating test threads.  

Test threads created successfully. Press ENTER to terminate testing.

     SIMMultisign w/ masked key : (packet size = 16 bytes)

     Using token objects.

     Logged in as Limited Crypto Officer.

               + signatures/second | elapsed      
 6,  0  6, 19 |   total   average  | time (secs)  |     /sec   |     /sec
------ ------ | ------- ---------- | ------------ | ---------- | ----------
  92.8   92.0 |  1844.9  1843.808* |          145 |        0.0 |        0.0


Waiting for threads to terminate.
[me@localhost bin]#