Global Values

CKA_GLOBAL - ULONG

0 - Default value, not global

1 - Token Global

2 - Implementation Global

All objects where CKA_GLOBAL > 0 MUST also have an attribute CKA_OBJECT_ID to define the specific use of the global object.

Valid object IDs

Token Identity [OID: xxx]

Must be Token Global.

May define any or all of an X.509 certificate, a private key, or a public key.

When it defines an X.509 certificate, that certificate uniquely identifies this token or implementation. The certificate shall be signed by the manufacturer of the HSM.

When it defines a private key, it identifies a private key that is unique to this token, is non exportable, and is usable by any user of the token (CKA_PRIVATE = FALSE). That key SHOULD be limited to signature only mechanisms.

Platform Identity [OID: xxx]

Must be Implementation Global

Must define either an X.509 certificate or an CKO_OBJECT.

When it defines an X.509 certificate, that certificate uniquely identifies the token or HSM implementation.

When it defines a CKO_OBJECT the CKA_VALUE of that object is a "measurement" of the HSM that is bound into the Platform Identity certificate. [TBD!!!!]

Key Certification Mechanism

CKM_CERTIFY_KEY

This is a sign/verify mechanism. It may be used by any private key to certify the CKA_PUBLIC_KEY_INFO (SubjectPublicKeyInfo) value of any other private key on the same token. When used with the Token Identity private key, this can be used to certify that a key exists on a specific token, is not exportable, was generated on the token, etc.

This mechanism uses the following mechanism parameter structure:

typedef struct CK_CERTIFY_KEY_PARAMS {
CK_OBJECT_HANDLE keyToBeSignedVerified;
CK_MECHANISM_PTR signingMechanism;
CK_ULONG attributeCount;
CK_ATTTIBUTE_TYPE[] attributesToCertify;
}

A call to C_SignUpdate is optional, but allows additional information (e.g. a challenge) to be included under the signature.

keyToBeSignedVerified - a handle to the private key to be certified.

signingMechanism	the mechanism used to create the signature for the certification information.

attributeCount	the number of attributes in the attributeToCertify array

attributesToCertify	he specific attributes for the private key that shall be included under the certification. They may be specified in any order, and will be included in the signature in that order.

The data to be signed consists of the concatenation of:

The DER encoded SubjectPublicKeyInfo for the keyToBeSigned

The attribute count expressed as a 32 bit Network Byte Order quantity.

For each attribute in the order specified in the mechanism:

The attribute type as a 32 bit NBO

The size of the attribute in bytes as a 32 bit NBO

The encoded bytes of the attribute. If the value is an integer quantity, it must be expressed as an NBO for the purposes of the signature.

Any data provided by C_SignUpdate (or C_VerifyKey).

If any attribute specified in attributesToCertify does not exist, the attribute shall be included the signature calculation, but with a length of 0 and no encoded bytes.

Note that most verifications will not use this mechanism, as the key to be verified will not exist on the token doing the verification.