128172 - function to convert a session key to a token key

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P1)

Description

[Jamie Nicolson]

In the JCA model, whenever you generate a keypair, the keys are temporary
objects. Not until you store them do they become permanent. I already have the
ability to create temporary (session) keys. Now I need a way to convert a
session key to a token key. This would do a C_CopyObject on the key while
modifying the CKA_TOKEN attribute to be TRUE.

Comment 1

[Jamie Nicolson]

Attachment: two new functions to convert private and symmetric keys to token objects

These are the functions I had in mind. I haven't tested them yet. But do they
look OK, generally? Since they are new functions, not modifying existing code,
adding them would be very low risk, right?

Comment 2

[Wan-Teh Chang]

Yes, adding new functions that do not modify existing code
would be low risk.  You just need to verify that they work.

Bob, if you think it's ok to add these two functions and
you have reviewed the patch, I can take care of the mechanical
part.

Comment 3

[Jamie Nicolson]

Actually, I can do the work as long as you guys approve of the changes.

Comment 4

[Robert Relyea]

I don't have any problem. I do have some comments on the code:

1) we probably should preserve wincx from the source key/private key.
2) I don't think we have ever tested copy object, at least for copying to token
objects. I think it should work (as long as it is calling handle object at the
bottom).

bob

Comment 5

[Jamie Nicolson]

We can add a symmetric key, but it doesn't show up because of 130699, so it's
not useful. I'm adding 130699 as a blocker of this bug.

Comment 6

[Wan-Teh Chang]

Moved to 3.4.1.

Comment 7

[Wan-Teh Chang]

Changed the QA contact to Bishakha.

Comment 8

[Wan-Teh Chang]

Set target milestone to NSS 3.5.

Comment 9

[Wan-Teh Chang]

Target 3.6.

Comment 10

[Wan-Teh Chang]

Bob, could you work with Jamie to decide whether
his patch can be checked in in the 3.6 timeframe?

Comment 11

[Robert Relyea]

Yes, he should check in his patch in the 3.6 time frame. It would also be good
to test the patch to make sure it actually works, but I wouldn't hold 3.6 up in
the failure case.

bob

Comment 12

[Jamie Nicolson]

Attachment: updated patch

Improved patch. Includes the header file and nss.def changes.
Also, we need to get a RW session before we can create a new token object.

Comment 13

[Robert Relyea]

Comment on attachment 100344 [details] [diff] [review]
updated patch

Looks good

Comment 14

[Jamie Nicolson]

Checked in on trunk.

/cvsroot/mozilla/security/nss/lib/nss/nss.def,v  <--  nss.def
new revision: 1.84; previous revision: 1.83

/cvsroot/mozilla/security/nss/lib/pk11wrap/pk11func.h,v  <--  pk11func.h
new revision: 1.34; previous revision: 1.33

/cvsroot/mozilla/security/nss/lib/pk11wrap/pk11skey.c,v  <--  pk11skey.c
new revision: 1.56; previous revision: 1.55