Pkcs11 C Reference Documentation

Pkcs11

Current Version: 9.5.0.97

A wrapper around the Cryptographic Token Interface (Cryptoki API) for thePKCS11 architecture of smart cards and tokens. This class provides functions for accessing, adding, deleting, and performing operations on data, certificates, and keys. It integrates with other Chilkat classes to allow for smartcards and tokens to be used in various protocols (TLS, SSH, PDF, etc.), across different operating systems and programming languages.

This class is introduced in Chilkat v9.5.0.88.

Create/Dispose

HCkPkcs11 instance = CkPkcs11_Create();
// ...
CkPkcs11_Dispose(instance);
HCkPkcs11 CkPkcs11_Create(void);

Creates an instance of the HCkPkcs11 object and returns a handle ("void *" pointer). The handle is passed in the 1st argument for the functions listed on this page.

void CkPkcs11_Dispose(HCkPkcs11 handle);

Objects created by calling CkPkcs11_Create must be freed by calling this method. A memory leak occurs if a handle is not disposed by calling this function. Also, any handle returned by a Chilkat "C" function must also be freed by the application by calling the appropriate Dispose method, such as CkPkcs11_Dispose.

Properties

DebugLogFilePath
void CkPkcs11_getDebugLogFilePath(HCkPkcs11 cHandle, HCkString retval);
void CkPkcs11_putDebugLogFilePath(HCkPkcs11 cHandle, const char *newVal);
const char *CkPkcs11_debugLogFilePath(HCkPkcs11 cHandle);

If set to a file path, causes each Chilkat method or property call to automatically append it's LastErrorText to the specified log file. The information is appended such that if a hang or crash occurs, it is possible to see the context in which the problem occurred, as well as a history of all Chilkat calls up to the point of the problem. The VerboseLogging property can be set to provide more detailed information.

This property is typically used for debugging the rare cases where a Chilkat method call hangs or generates an exception that halts program execution (i.e. crashes). A hang or crash should generally never happen. The typical causes of a hang are:

  1. a timeout related property was set to 0 to explicitly indicate that an infinite timeout is desired,
  2. the hang is actually a hang within an event callback (i.e. it is a hang within the application code), or
  3. there is an internal problem (bug) in the Chilkat code that causes the hang.

top
LastErrorHtml
void CkPkcs11_getLastErrorHtml(HCkPkcs11 cHandle, HCkString retval);
const char *CkPkcs11_lastErrorHtml(HCkPkcs11 cHandle);

Provides information in HTML format about the last method/property called. If a method call returns a value indicating failure, or behaves unexpectedly, examine this property to get more information.

top
LastErrorText
void CkPkcs11_getLastErrorText(HCkPkcs11 cHandle, HCkString retval);
const char *CkPkcs11_lastErrorText(HCkPkcs11 cHandle);

Provides information in plain-text format about the last method/property called. If a method call returns a value indicating failure, or behaves unexpectedly, examine this property to get more information.

top
LastErrorXml
void CkPkcs11_getLastErrorXml(HCkPkcs11 cHandle, HCkString retval);
const char *CkPkcs11_lastErrorXml(HCkPkcs11 cHandle);

Provides information in XML format about the last method/property called. If a method call returns a value indicating failure, or behaves unexpectedly, examine this property to get more information.

top
LastMethodSuccess
BOOL CkPkcs11_getLastMethodSuccess(HCkPkcs11 cHandle);
void CkPkcs11_putLastMethodSuccess(HCkPkcs11 cHandle, BOOL newVal);

Indicate whether the last method call succeeded or failed. A value of TRUE indicates success, a value of FALSE indicates failure. This property is automatically set for method calls. It is not modified by property accesses. The property is automatically set to indicate success for the following types of method calls:

  • Any method that returns a string.
  • Any method returning a Chilkat object, binary bytes, or a date/time.
  • Any method returning a standard boolean status value where success = TRUE and failure = FALSE.
  • Any method returning an integer where failure is defined by a return value less than zero.

Note: Methods that do not fit the above requirements will always set this property equal to TRUE. For example, a method that returns no value (such as a "void" in C++) will technically always succeed.

top
NumCerts
int CkPkcs11_getNumCerts(HCkPkcs11 cHandle);
Introduced in version 9.5.0.88

The number of certificates contained on the smart card or USB token. This property is set when FindAllCerts is called.

top
SharedLibPath
void CkPkcs11_getSharedLibPath(HCkPkcs11 cHandle, HCkString retval);
void CkPkcs11_putSharedLibPath(HCkPkcs11 cHandle, const char *newVal);
const char *CkPkcs11_sharedLibPath(HCkPkcs11 cHandle);
Introduced in version 9.5.0.88

On Windows systems, then should be set to the name of the DLL file (if the DLL is located in C:\Windows\System32), or it can be the full path to the DLL.

On Linux, MacOSX, or other non-Windows systems, this can also be either the full path to the .so or .dylib, or just the .so or .dylib filename. On these systems, Chilkat calls the dlopen system function to load the shared library. If just the filename is passed in, the directories searched are those indicated in the dlopen function description at https://man7.org/linux/man-pages/man3/dlopen.3.html

More Information and Examples
top
SigContextPin
void CkPkcs11_getSigContextPin(HCkPkcs11 cHandle, HCkString retval);
void CkPkcs11_putSigContextPin(HCkPkcs11 cHandle, const char *newVal);
const char *CkPkcs11_sigContextPin(HCkPkcs11 cHandle);
Introduced in version 9.5.0.97

If the smart card or token requires a signature context login within the signing operation, then set this property to the context-specific signature PIN. Most smart cards do not need this. Don't set this property unless you know for sure your smart card needs it.

More Information and Examples
top
Utf8
BOOL CkPkcs11_getUtf8(HCkPkcs11 cHandle);
void CkPkcs11_putUtf8(HCkPkcs11 cHandle, BOOL newVal);

When set to TRUE, all "const char *" arguments are interpreted as utf-8 strings. If set to FALSE (the default), then "const char *" arguments are interpreted as ANSI strings. Also, when set to TRUE, and Chilkat method returning a "const char *" is returning the utf-8 representation. If set to FALSE, all "const char *" return values are ANSI strings.

top
VerboseLogging
BOOL CkPkcs11_getVerboseLogging(HCkPkcs11 cHandle);
void CkPkcs11_putVerboseLogging(HCkPkcs11 cHandle, BOOL newVal);

If set to TRUE, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. The default value is FALSE. Verbose logging should only be used for debugging. The potentially large quantity of logged information may adversely affect peformance.

top
Version
void CkPkcs11_getVersion(HCkPkcs11 cHandle, HCkString retval);
const char *CkPkcs11_version(HCkPkcs11 cHandle);

Version of the component/library, such as "9.5.0.94"

More Information and Examples
top

Methods

CloseSession
BOOL CkPkcs11_CloseSession(HCkPkcs11 cHandle);
Introduced in version 9.5.0.88

Closes the session on the token (i.e. smart card).

Note: Memory leaks can occur if the session is not properly closed.

Returns TRUE for success, FALSE for failure.

More Information and Examples
top
CreatePkcs11Object
unsigned long CkPkcs11_CreatePkcs11Object(HCkPkcs11 cHandle, HCkJsonObject attrs);
Introduced in version 9.5.0.96

Creates an object and returns the handle. The attrs specifies the attributes that define the object to be created. See the linked examples below for more information.

top
DestroyObject
BOOL CkPkcs11_DestroyObject(HCkPkcs11 cHandle, unsigned long hObject);
Introduced in version 9.5.0.96

Destroys an object (deletes it from the HSM). hObject is the object's handle.

Returns TRUE for success, FALSE for failure.

top
Discover
BOOL CkPkcs11_Discover(HCkPkcs11 cHandle, BOOL onlyTokensPresent, HCkJsonObject json);
Introduced in version 9.5.0.88

Discovers the readers, smart cards, and USB tokens accessible via PKCS11 on the computer (using the DLL/shared lib specified by SharedLibPath). The onlyTokensPresent specifies if only slots (readers) with tokens (smart cards) present should be returned. The information is written to the json. (For details, see the example below.)

Returns TRUE for success, FALSE for failure.

top
ExportPublicKey
BOOL CkPkcs11_ExportPublicKey(HCkPkcs11 cHandle, unsigned long keyHandle, HCkPublicKey pubKey);
Introduced in version 9.5.0.96

Export a public key given a public or private key handle. The pubKey is loaded with the exported public key.

See the example linked below for more details.

Returns TRUE for success, FALSE for failure.

More Information and Examples
top
FindAllCerts
BOOL CkPkcs11_FindAllCerts(HCkPkcs11 cHandle);
Introduced in version 9.5.0.88

Finds all certificates contained on the smart card (or USB token). This sets the NumCerts property. Each certificate can be obtained by calling GetCert(index) where the 1st cert is at index 0.

Important: Private keys will not be seen unless the PKCS11 session is authenticated. To authenticate, your application must call Login after calling OpenSession.

Returns TRUE for success, FALSE for failure.

top
FindAllKeys
BOOL CkPkcs11_FindAllKeys(HCkPkcs11 cHandle, const char *keyClass, HCkJsonObject json);
Introduced in version 9.5.0.96

Finds all keys contained on the smart card (or USB token). The keyClass indicates the kind of keys to return, and can be one of the following:

  • public
  • private
  • secret
  • otp

Information about the keys is returned in json.

Important: Private keys will not be seen unless the PKCS11 session is authenticated. To authenticate, your application must call Login after calling OpenSession.

Returns TRUE for success, FALSE for failure.

top
FindCert
BOOL CkPkcs11_FindCert(HCkPkcs11 cHandle, const char *certPart, const char *partValue, HCkCert cert);
Introduced in version 9.5.0.88

Finds the certificate where the given certPart equals the partValue. Possible values for certPart are: "privateKey", "subjectDN", "subjectDN_withTags", "subjectCN", "serial", or "serial:issuerCN". If certPart equals "privateKey", then pass an empty string in partValue. Specifying "privateKey" means to return the first certificate having a private key.

The cert is loaded with the certificate if successful.

Important: Private keys will not be seen unless the PKCS11 session is authenticated. To authenticate, your application must call Login after calling OpenSession.

Note: If successful, the cert will be linked internally with this PKCS11 session such that certificate can be used for signing on the smart card when used in other Chilkat classes such as XmlDSigGen, Pdf, Crypt2, Mime, MailMan, etc.

Returns TRUE for success, FALSE for failure.

top
FindObject
unsigned long CkPkcs11_FindObject(HCkPkcs11 cHandle, HCkJsonObject jsonTemplate);
Introduced in version 9.5.0.96

General function for finding an object such as a private key. Returns the handle of the first matching object, or 0 if not found.

More Information and Examples
top
GenEcKey
BOOL CkPkcs11_GenEcKey(HCkPkcs11 cHandle, HCkJsonObject publicAttrs, HCkJsonObject privateAttrs, HCkJsonObject jsonOut, HCkPublicKey pubKey);
Introduced in version 9.5.0.96

Generate an EC key pair suitable for signing data and verifying signatures. The private key is created on the HSM (smart card or token), and the public key is returned in pubKey. The publicAttrs and privateAttrs contain attributes for the public and private keys respectively. The PKCS11 public and private key handles are returned in jsonOut. Handles are used to reference a PKCS11 object, such as a public or private key, and are valid during the PKCS11 session. To use the key in future PKCS11 sessions, your application would need to find the object to get a new handle.

See the example linked below for more details.

Returns TRUE for success, FALSE for failure.

top
GenRsaKey
BOOL CkPkcs11_GenRsaKey(HCkPkcs11 cHandle, HCkJsonObject publicAttrs, HCkJsonObject privateAttrs, HCkJsonObject jsonOut, HCkPublicKey pubKey);
Introduced in version 9.5.0.96

Generate an RSA key pair suitable for signing data and verifying signatures. The private key is created on the HSM (smart card or token), and the public key is returned in pubKey. The publicAttrs and privateAttrs contain attributes for the public and private keys respectively. The PKCS11 public and private key handles are returned in jsonOut. Handles are used to reference a PKCS11 object, such as a public or private key, and are valid during the PKCS11 session. To use the key in future PKCS11 sessions, your application would need to find the object to get a new handle.

See the example linked below for more details.

Returns TRUE for success, FALSE for failure.

top
GenSecretKey
unsigned long CkPkcs11_GenSecretKey(HCkPkcs11 cHandle, const char *keyType, HCkJsonObject jsonTemplate);
Introduced in version 9.5.0.96

Generates a symmetric encryption key. The keyType is the key type, which can be one of the following values:

  • AES
  • AES XTS
  • Blowfish
  • Twofish
  • ChaCha20

The jsonTemplate is a template that specifies attributes about the key to be generated. See the example at the link below.

The handle to the generated key is returned. A value of 0 is returned on failure.

More Information and Examples
top
GetCert
BOOL CkPkcs11_GetCert(HCkPkcs11 cHandle, int index, HCkCert cert);
Introduced in version 9.5.0.88

Loads cert with the Nth certificate indicated by index. The 1st certificate is at index 0. The FindAllCerts method must be called beforehand to load the certs from the smart card into this object. After calling FindAllCerts, the NumCerts property is set and each certificate can be retrieved by calling GetCert.

Returns TRUE for success, FALSE for failure.

top
ImportPrivateKey
unsigned long CkPkcs11_ImportPrivateKey(HCkPkcs11 cHandle, HCkPrivateKey privKey, HCkJsonObject jsonTemplate);
Introduced in version 9.5.0.96

Imports a private key onto the HSM. Returns the handle of the unwrapped key, or 0 if failed. See the linked example below for more details.

More Information and Examples
top
ImportSshKey
unsigned long CkPkcs11_ImportSshKey(HCkPkcs11 cHandle, HCkSshKey sshKey, HCkJsonObject jsonTemplate);
Introduced in version 9.5.0.96

Imports an SSH private key onto the HSM. Returns the handle of the unwrapped key, or 0 if failed.

More Information and Examples
top
Initialize
BOOL CkPkcs11_Initialize(HCkPkcs11 cHandle);
Introduced in version 9.5.0.88

Initializes the PKCS#11 library. Should be called after specifying the SharedLibPath. The DLL (or .so/.dylib) is dynamically loaded and the PKCS#11 lib is initialized.

Returns TRUE for success, FALSE for failure.

More Information and Examples
top
InitPin
BOOL CkPkcs11_InitPin(HCkPkcs11 cHandle, const char *pin);
Introduced in version 9.5.0.89

Initializes the normal user's PIN. This must be called from the security officer's (SO) logged-in session.

Note: To unblock a smart card, login to the SO (Security Officer) session using the PUK, and then call this with the new user PIN.

Returns TRUE for success, FALSE for failure.

More Information and Examples
top
InitToken
BOOL CkPkcs11_InitToken(HCkPkcs11 cHandle, int slotId, const char *pin, const char *tokenLabel);
Introduced in version 9.5.0.89

Initializes a token. slotId is the slot ID of the token's slot.

If the token has not been initialized (i.e. new from the factory), then the pPin parameter becomes the initial value of the SO (Security Officer) PIN. If the token is being reinitialized, the pin parameter is checked against the existing SO PIN to authorize the initialization operation.

When a token is initialized, all objects that can be destroyed are destroyed (i.e., all except for “indestructible” objects such as keys built into the token). Also, access by the normal user is disabled until the SO sets the normal user’s PIN. Depending on the token, some “default” objects may be created, and attributes of some objects may be set to default values.

Returns TRUE for success, FALSE for failure.

top
Login
BOOL CkPkcs11_Login(HCkPkcs11 cHandle, int userType, const char *pin);
Introduced in version 9.5.0.88

Authenticates a session with a PIN. The userType can be one of the following integer values:

  1. Security Officer (0)
  2. Normal User (1)
  3. Context Specific (2)

Except for special circumstances, you'll always login as the Normal User.

Returns TRUE for success, FALSE for failure.

More Information and Examples
top
Logout
BOOL CkPkcs11_Logout(HCkPkcs11 cHandle);
Introduced in version 9.5.0.88

Logs out from a token (smart card).

Returns TRUE for success, FALSE for failure.

More Information and Examples
top
OpenSession
BOOL CkPkcs11_OpenSession(HCkPkcs11 cHandle, int slotId, BOOL readWrite);
Introduced in version 9.5.0.88

Opens a session on the token (i.e. smart card). The slotId is the ID of the slot (not the index). Set slotId equal to -1 to choose the first available non-empty slot. The readWrite indicates whether the session should be read-only or read-write.

The PKCS11 terminology is confusing:

  • A "slot" corresponds to a connected smart card reader or USB hardware token, such as a Feitian ePass3003Auto token.
  • A "token" corresponds to the smart card inserted into the reader. If we have a USB hardware token, such as the epass3003Auto (or many others), then technically there is always a "smart card" inserted, because the USB hardware token is effectively both the reader and smart card wrapped in one inseparable device.
  • The PKCS11 DLL (or .so shared lib, or .dylib) is the vendor supplied PKCS11 implementation (driver) that provides the low-level "C" PKCS11 functions (called by Chilkat internally).
  • Generally, the number of slots will equal the number of connected smart cards or tokens belonging to the vendor of the DLL, or compatible with the DLL. In most cases you'll have your single reader with a single smart card inserted, and therefore only one slot exists.
  • Some PKCS11 DLLs are provided by a 3rd party and support many smart cards. For example, A.E.T. Europe B.V.'s "SafeSign Identity Client Standard Version 3.5" DLL is "aetpkss1.dll". It supports the following tokens:
    • Defensiepas
    • Defensiepas 2
    • G&D Convego Join 4.01 40k/80k
    • G&D SkySIM Hercules
    • G&D SkySIM Scorpius
    • G&D Sm@rtCafé Expert 3.2
    • G&D Sm@rtCafé Expert 4.0
    • G&D Sm@rtCafé Expert 5.0
    • G&D Sm@rtCafé Expert 6.0
    • G&D Sm@rtCafé Expert 7.0
    • G&D Sm@rtCafé Expert 64
    • Gemalto Desineo ICP D72 FXR1 Java
    • Gemalto IDCore 30
    • Gemalto MultiApp ID v2.1
    • Gemalto Optelio D72 FR1
    • Gemalto TOP DL v2
    • Infineon Oracle JCOS Ed.1
    • JCOP21 v2.3
    • Morpho IDealCitiz v2.1
    • Morpho JMV ProCL V3.0
    • NXP J2A080 / J2A081 (JCOP 2.4.1 R3)
    • NXP JD081 (JCOP 2.4.1 R3)
    • NXP J3A080 (JCOP 2.4.1 R3)
    • NXP JCOP 2.4.2 R3
    • NXP JCOP 3 SecID P60
    • Oberthur IDOne Cosmo v7.0
    • RDW ABR kaart
    • Rijkspas
    • Rijkspas 2
    • Sagem YpsID s2
    • Sagem YpsID s3
    • StarSign Crypto USB Token S
    • Swissbit PS-100u SE
    • UZI-pas
    • UZI-pas 2

Returns TRUE for success, FALSE for failure.

More Information and Examples
top
QuickSession
BOOL CkPkcs11_QuickSession(HCkPkcs11 cHandle, int userType, const char *pin);
Introduced in version 9.5.0.96

Quickly establishes a session on the 1st unempty slot, with or without login. If the pin is the empty string, then no login will take place. The userType can be one of the following integer values:

  1. Security Officer (0)
  2. Normal User (1)
  3. Context Specific (2)

Except for special circumstances, you should always select Normal User. If pin is the empty string, then no login takes place and userType is ignored.

Calling this method takes the place of making separate calls to Initialize, OpenSession, and Login.

Returns TRUE for success, FALSE for failure.

top
SetPin
BOOL CkPkcs11_SetPin(HCkPkcs11 cHandle, const char *oldPin, const char *newPin);
Introduced in version 9.5.0.89

Modifies the PIN of the user that is currently logged in, or the Normal User PIN if the session is not logged in.

Returns TRUE for success, FALSE for failure.

top