Home >	ProtectToolkit-C Programming Guide > SafeNet ProtectToolkit-C Mechanisms

SafeNet ProtectToolkit-C Mechanisms

Characteristics of all SafeNet ProtectToolkit-C mechanisms are summarized in the pages that follow. Both PKCS #11 standard mechanisms and Gemalto-proprietary mechanisms are included.

Mechanisms - Key Size Range and Parameters lists the key size range and any parameters defined for each mechanism. Continue to the individual mechanism pages for full descriptions.

Note: Functions in bold are Gemalto-proprietary. See also Vendor-Defined Error Codes.

Table 1: Mechanisms - Key Size Range and Parameters
Mechanism	Min	FIPS Min	Max	Parameter
`CKM_AES_CBC`	16	16	32	16 bytes
`CKM_AES_CBC_PAD`	16	16	32	16 bytes
`CKM_AES_CMAC`	16	N/A	32	None
`CKM_AES_CMAC_GENERAL`	16	N/A	32	None
`CKM_AES_ECB`	16	16	32	None
`CKM_AES_ECB_ENCRYPT_DATA`	16	N/A	32	Data to be encrypted
`CKM_AES_KEY_GEN`	16	16	32	None
`CKM_AES_KEY_WRAP`	16	16	32	8 bytes (optional)
`CKM_AES_KEY_WRAP_PAD`	16	16	32	8 bytes (optional
`CKM_AES_MAC`	16	N/A	32	None
`CKM_AES_MAC_GENERAL`	16	N/A	32	`CK_MAC_GENERAL_PARAMS`
`CKM_ARDFP`	0	0	0
`CKM_ARIA_CBC`	16	N/A	32	16 bytes
`CKM_ARIA_CBC_PAD`	16	N/A	32	16 bytes
`CKM_ARIA_ECB`	16	N/A	32	None
`CKM_ARIA_KEY_GEN`	16	N/A	32	None
`CKM_ARIA_MAC`	16	N/A	32	None
`CKM_ARIA_MAC_GENERAL`	16	N/A	32	`CK_MAC_GENERAL_PARAMS`
`CKM_CAST128_CBC (CKM_CAST5_CBC)`	1	N/A	16	8 bytes
`CKM_CAST128_CBC_PAD (CKM_CAST5_CBC_PAD)`	1	N/A	16	8 bytes
`CKM_CAST128_ECB (CKM_CAST5_ECB)`	1	N/A	16	None
`CKM_CAST128_ECB_PAD`	1	N/A	16	None
`CKM_CAST128_KEY_GEN (CKM_CAST5_KEY_GEN)`	1	N/A	16	None
`CKM_CAST128_MAC (CKM_CAST5_MAC)`	1	N/A	16	None
`CKM_CAST128_MAC_GENERAL (CKM_CAST5_MAC_GENERAL)`	1	N/A	16	`CK_MAC_GENERAL_PARAMS`
`CKM_CONCATENATE_BASE_AND_DATA`	0	N/A	None	`CK_KEY_DERIVATION_STRING_DATA`
`CKM_CONCATENATE_BASE_AND_KEY`	0	N/A	None	`CK_OBJECT_HANDLE`
`CKM_CONCATENATE_DATA_AND_BASE`	0	N/A	None	`CK_KEY_DERIVATION_STRING_DATA`
`CKM_DECODE_PKCS_7`	0	0	0	None
`CKM_DECODE_X_509`	0	0	0	None
`CKM_DES_BCF`	8	N/A	8	8 bytes
`CKM_DES_CBC`	8	N/A	8	8 bytes
`CKM_DES_CBC_PAD`	8	N/A	8	8 bytes
`CKM_DES_DERIVE_CBC`	8	N/A	8	`CK_DES_CBC_PARAMS`
`CKM_DES_DERIVE_ECB`	8	N/A	8	Multiple of 8 bytes
`CKM_DES_ECB`	8	N/A	8	None
`CKM_DES_ECB_PAD`	8	N/A	8	None
`CKM_DES_KEY_GEN`	8	N/A	8	None
`CKM_DES_MAC`	8	N/A	8	`CK_MAC_GENERAL_PARAMS`
`CKM_DES_MAC_GENERAL`	8	N/A	8	`CK_MAC_GENERAL_PARAMS`
`CKM_DES_MDC_2_PAD1`	0	N/A	0	None
`CKM_DES_OFB64`	8	N/A	8	8 bytes
`CKM_DES2_KEY_GEN`	16	16	16	None
`CKM_DES3_BCF`	16	N/A	24	8 bytes
`CKM_DES3_CBC`	16	16	24	8 bytes
`CKM_DES3_CBC_PAD`	16	16	24	8 bytes
`CKM_DES3_CMAC`	16	16	24	8 bytes
`CKM_DES3_CMAC_GENERAL`	16	16	24	8 bytes
`CKM_DES3_DDD_CBC`	16	N/A	24	8 bytes
`CKM_DES3_DERIVE_CBC`	16	N/A	24	`CK_DES2_CBC_PARAMS CK_DES3_CBC_PARAMS`
`CKM_DES3_DERIVE_ECB`	0	N/A	0	Multiple of 8 bytes
`CKM_DES3_ECB`	16	16	24	None
`CKM_DES3_ECB_PAD`	16	16	24	None
`CKM_DES3_KEY_GEN`	24	24	24	None
`CKM_DES3_MAC`	16	16	24	None
`CKM_DES3_MAC_GENERAL`	16	16	24	`CK_MAC_GENERAL_PARAMS`
`CKM_DES3_OFB64`	16	16	24	8 bytes
`CKM_DES3_RETAIL_CFB_MAC`	16	16	24	8 bytes (IV)
`CKM_DES3_X919_MAC`	16	16	24	`CK_MAC_GENERAL_PARAMS`
`CKM_DES3_X919_MAC_GENERAL`	16	16	24	8 bytes
`CKM_DH_PKCS_DERIVE`	512	1024	4096	Bytes (Big Integer)
`CKM_DH_PKCS_KEY_PAIR_GEN`	512	1024	4096	None
`CKM_DH_PKCS_PARAMETER_GEN`	512	1024	4096	None
`CKM_DSA`	512	2048	4096	None
`CKM_DSA_KEY_PAIR_GEN`	512	2048	4096	None
`CKM_DSA_PARAMETER_GEN`	512	2048	4096	None
`CKM_DSA_SHA1`	512	2048	4096	None
`CKM_DSA_SHA1_PKCS`	512	2048	4096	None
`CKM_DSA_SHA224`	1024	2048	4096	None
`CKM_DSA_SHA224_PKCS`	1024	2048	4096	None
`CKM_DSA_SHA256`	1024	2048	4096	None
`CKM_DSA_SHA256_PKCS`	1024	2048	4096	None
`CKM_EC_KEY_PAIR_GEN`	64	224	571	None
`CKM_ECDH1_DERIVE`	64	224	571	`CK_ECDH1_DERIVE_PARAMS`
`CKM_ECDSA`	64	224	571	None
`CKM_ECDSA_SHA1`	64	N/A	571	None
`CKM_ECDSA_SHA224`	64	224	571	None
`CKM_ECDSA_SHA256`	64	224	571	None
`CKM_ECDSA_SHA384`	64	224	571	None
`CKM_ECDSA_SHA512`	64	224	571	None
`CKM_ECIES`	64	N/A	571	`CK_ECIES_PARAMS`
`CKM_ENCODE_ATTRIBUTES`	0	0	0	None
`CKM_ENCODE_PKCS_10`	0	0	0	None
`CKM_ENCODE_PUBLIC_KEY`	0	0	0	None
`CKM_ENCODE_X_509`	0	0	0	`CK_MECH_TYPE_AND_OBJECT`
`CKM_ENCODE_X_509_LOCAL_CERT`	0	0	0	None
`CKM_EXTRACT_KEY_FROM_KEY`	0	N/A	0	`CK_EXTRACT_PARAMS`
`CKM_FM_DOWNLOAD`	512	2048	4096	None
`CKM_FM_DOWNLOAD_2`	1024	2048	4096	None
`CKM_GENERIC_SECRET_KEY_GEN`	0	0	None	None
`CKM_IDEA_CBC`	16	N/A	16	8 bytes
`CKM_IDEA_CBC_PAD`	16	N/A	16	8 bytes
`CKM_IDEA_ECB`	16	N/A	16	None
`CKM_IDEA_ECB_PAD`	16	N/A	16	None
`CKM_IDEA_KEY_GEN`	16	N/A	16	None
`CKM_IDEA_MAC`	16	N/A	16	None
`CKM_IDEA_MAC_GENERAL`	16	N/A	16	`CK_MAC_GENERAL_PARAMS`
`CKM_KEY_TRANSLATION`	512	N/A	4096	None
`CKM_KEY_WRAP_SET_OAEP`	512	1024	4096	`CK_KEY_WRAP_SET_OAEP_PARAMS`
`CKM_MD2`	0	N/A	0	None
`CKM_MD2_HMAC`	0	N/A	0	None
`CKM_MD2_HMAC_GENERAL`	0	N/A	0	`CK_MAC_GENERAL_PARAMS`
`CKM_MD2_KEY_DERIVATION`	0	N/A	0	None
`CKM_MD2_RSA_PKCS`	512	N/A	4096	None
`CKM_MD5`	0	N/A	0	None
`CKM_MD5_HMAC`	0	N/A	0	None
`CKM_MD5_HMAC_GENERAL`	0	N/A	0	`CK_MAC_GENERAL_PARAMS`
`CKM_MD5_KEY_DERIVATION`	0	N/A	0	None
`CKM_MD5_RSA_PKCS`	512	N/A	4096	None
`CKM_NVB`	0	N/A	0	None
`CKM_OS_UPGRADE`	1024	1024	4096	None
`CKM_OS_UPGRADE_2`	1024	1024	4096	None
`CKM_PBA_SHA1_WITH_SHA1_HMAC`	20	N/A	20	`CK_PBE_PARAMS`
`CKM_PBE_MD2_DES_CBC`	8	N/A	8	`CK_PBE_PARAMS`
`CKM_PBE_MD5_CAST128_CBC (CKM_PBE_MD5_CAST5_CBC)`	16	N/A	16	`CK_PBE_PARAMS`
`CKM_PBE_MD5_DES_CBC`	8	N/A	8	`CK_PBE_PARAMS`
`CKM_PBE_SHA1_CAST128_CBC (CKM_PBE_SHA1_CAST5_CBC)`	16	N/A	16	`CK_PBE_PARAMS`
`CKM_PBE_SHA1_DES2_EDE_CBC`	16	N/A	16	`CK_PBE_PARAMS`
`CKM_PBE_SHA1_DES3_EDE_CBC`	24	N/A	24	`CK_PBE_PARAMS`
`CKM_PBE_SHA1_RC2_40_CBC`	5	N/A	5	`CK_PBE_PARAMS`
`CKM_PBE_SHA1_RC2_128_CBC`	16	N/A	16	`CK_PBE_PARAMS`
`CKM_PBE_SHA1_RC4_40`	5	N/A	5	`CK_PBE_PARAMS`
`CKM_PBE_SHA1_RC4_128`	16	N/A	16	`CK_PBE_PARAMS`
`CKM_PKCS12_PBE_EXPORT`	1	N/A	None	`CKM_PKCS12_PBE_EXPORT_PARAMS`
`CKM_PKCS12_PBE_IMPORT`	1	N/A	None	`CKM_PKCS12_PBE_IMPORT_PARAMS`
`CKM_PP_LOAD_SECRET`	1	1	None	`CK_PP_LOAD_SECRET_PARAMS`
`CKM_RC2_CBC`	1	N/A	128	`CK_RC2_CBC_PARAMS`
`CKM_RC2_CBC_PAD`	1	N/A	128	`CK_RC2_CBC_PARAMS`
`CKM_RC2_ECB`	1	N/A	128	`CK_RC2_PARAMS`
`CKM_RC2_ECB_PAD`	1	N/A	128	`CK_RC2_PARAMS`
`CKM_RC2_KEY_GEN`	1	N/A	128	None
`CKM_RC2_MAC`	1	N/A	128	`CK_RC2_PARAMS`
`CKM_RC2_MAC_GENERAL`	1	N/A	128	`CK_RC2_MAC_GENERAL_PARAMS`
`CKM_RC4`	0	N/A	256	None
`CKM_RC4_KEY_GEN`	0	N/A	256	None
`CKM_REPLICATE_TOKEN_RSA_AES`	2048	2048	4096	`CK_REPLICATE_TOKEN_PARAMS`
`CKM_RIPEMD128`	0	N/A	0	None
`CKM_RIPEMD128_HMAC`	0	N/A	0	None
`CKM_RIPEMD128_HMAC_GENERAL`	0	N/A	0	`CK_MAC_GENERAL_PARAMS`
`CKM_RIPEMD128_RSA_PKCS`	512	N/A	4096	None
`CKM_RIPEMD160`	0	N/A	0	None
`CKM_RIPEMD160_HMAC`	0	N/A	0	None
`CKM_RIPEMD160_HMAC_GENERAL`	0	N/A	0	`CK_MAC_GENERAL_PARAMS`
`CKM_RIPEMD160_RSA_PKCS`	512	N/A	4096	None
`CKM_RSA_9796`	512	N/A	4096	None
`CKM_RSA_FIPS_186_4_PRIME_KEY_PAIR_GEN`	2048	2048	4096	`CK_ULONG (optional)`
`CKM_RSA_PKCS`	512	2048	4096	None
`CKM_RSA_PKCS_KEY_PAIR_GEN`	512	2048	4096	None
`CKM_RSA_PKCS_OAEP`	512	2048	4096	`CK_RSA_PKCS_OAEP_PARAMS`
`CKM_RSA_PKCS_PSS`	512	2048	4096	`CK_RSA_PKCS_PSS_PARAMS`
`CKM_RSA_X_509`	512	2048	4096	None
`CKM_RSA_X9_31_KEY_PAIR_GEN`	1024	2048	4096	None
`CKM_SECRET_RECOVER_WITH_ATTRIBUTES`	0	0	None	`CK_SECRET_SHARE_PARAMS`
`CKM_SECRET_SHARE_WITH_ATTRIBUTES`	0	0	None	None
`CKM_SEED_CBC`	16	N/A	16	16 bytes
`CKM_SEED_CBC_PAD`	16	N/A	16	16 bytes
`CKM_SEED_ECB`	16	N/A	16	None
`CKM_SEED_ECB_PAD`	16	N/A	16	None
`CKM_SEED_KEY_GEN`	16	N/A	16	None
`CKM_SEED_MAC`	16	N/A	16	None
`CKM_SEED_MAC_GENERAL`	16	N/A	16	`CK_MAC_GENERAL_PARAMS`
`CKM_SET_ATTRIBUTES`	1024	1024	4096	None
`CKM_SHA1`	0	0	0	None
`CKM_SHA1_HMAC`	0	10	None	None
`CKM_SHA1_HMAC_GENERAL`	0	10	None	`CK_MAC_GENERAL_PARAMS`
`CKM_SHA1_KEY_DERIVATION`	0	N/A	0	None
`CKM_SHA1_RSA_PKCS`	512	2048	4096	None
`CKM_SHA1_RSA_PKCS_PSS`	512	2048	4096	`CK_RSA_PKCS_PSS_PARAMS`
`CKM_SHA1_RSA_PKCS_TIMESTAMP`	512	N/A	4096	`CK_TIMESTAMP_PARAMS`
`CKM_SHA224`	0	0	0	None
`CKM_SHA224_HMAC`	0	14	None	None
`CKM_SHA224_HMAC_GENERAL`	0	14	None	`CK_MAC_GENERAL_PARAMS`
`CKM_SHA224_KEY_DERIVATION`	0	N/A	0	None
`CKM_SHA224_RSA_PKCS`	512	2048	4096	None
`CKM_SHA224_RSA_PKCS_PSS`	512	2048	4096	`CK_RSA_PKCS_PSS_PARAMS`
`CKM_SHA256`	0	0	0	None
`CKM_SHA256_HMAC`	0	16	None	None
`CKM_SHA256_HMAC_GENERAL`	0	16	None	`CK_MAC_GENERAL_PARAMS`
`CKM_SHA256_KEY_DERIVATION`	0	N/A	0	None
`CKM_SHA256_RSA_PKCS`	512	2048	4096	None
`CKM_SHA256_RSA_PKCS_PSS`	512	2048	4096	`CK_RSA_PKCS_PSS_PARAMS`
`CKM_SHA384`	0	0	0	None
`CKM_SHA384_HMAC`	0	24	None	None
`CKM_SHA384_HMAC_GENERAL`	0	24	None	`CK_MAC_GENERAL_PARAMS`
`CKM_SHA384_KEY_DERIVATION`	0	N/A	0	None
`CKM_SHA384_RSA_PKCS`	640	2048	4096	None
`CKM_SHA384_RSA_PKCS_PSS`	640	2048	4096	`CK_RSA_PKCS_PSS_PARAMS`
`CKM_SHA512`	0	0	0	None
`CKM_SHA512_HMAC`	0	32	None	None
`CKM_SHA512_HMAC_GENERAL`	0	32	None	`CK_MAC_GENERAL_PARAMS`
`CKM_SHA512_KEY_DERIVATION`	0	N/A	0	None
`CKM_SHA512_RSA_PKCS`	768	2048	4096	None
`CKM_SHA512_RSA_PKCS_PSS`	768	2048	4096	`CK_RSA_PKCS_PSS_PARAMS`
`CKM_SSL3_KEY_AND_MAC_DERIVE`	48	N/A	48	`CK_SSL3_KEY_MAT_PARAMS`
`CKM_SSL3_MASTER_KEY_DERIVE`	48	N/A	48	`CK_SSL3_MASTER_KEY_DERIVE_PARAMS`
`CKM_SSL3_MD5_MAC`	0	0	None	`CK_MAC_GENERAL_PARAMS`
`CKM_SSL3_PRE_MASTER_KEY_GEN`	48	48	48	`CK_VERSION`
`CKM_SSL3_SHA1_MAC`	0	N/A	None	`CK_MAC_GENERAL_PARAMS`
`CKM_VISA_CVV`	16	N/A	16	None
`CKM_WRAPKEY_AES_CBC`	16	16	32	None
`CKM_WRAPKEY_DES3_CBC`	0	0	0	None
`CKM_WRAPKEY_DES3_ECB`	0	0	0	None
`CKM_WRAPKEYBLOB_AES_CBC`	16	16	32	None
`CKM_WRAPKEYBLOB_DES3_CBC`	0	0	0	None
`CKM_X9_42_DH_DERIVE`	1024	1024	4096	`CK_X9_42_DH1_DERIVE_PARAMS`
`CKM_X9_42_DH_KEY_PAIR_GEN`	1024	1024	4096	None
`CKM_X9_42_DH_PARAMETER_GEN`	1024	1024	4096	None
`CKM_XOR_BASE_AND_DATA`	0	N/A	None	`CK_KEY_DERIVATION_STRING_DATA`
`CKM_XOR_BASE_AND_KEY`	0	N/A	None	`CK_OBJECT_HANDLE`
`CKM_ZKA_MDC_2_KEY_DERIVATION`	0	N/A	0	arbitrary byte length

Note: Key size limitations specified above may be further limited, depending on the specific operation being performed. For example: CKM_DES3_CBC specifies a 16-byte key as a lower limit, but in FIPS mode, such keys are only allowed for legacy decryption operations and not new encryptions. See the section detailing the relevant mechanism for more information.