Section C Table II

From MozillaWiki
Jump to: navigation, search
<tr> <th>PKCS #5
Password-Based
Encryption</th> <td>The PKCS #5 API specifies a standard interface based upon the PKCS #5 standard which allows this private service to be used to perform password-based encryption and consists of the five routines including SEC_PKCS5GetSalt(), SEC_PKCS5GetIV(), SEC_PKCS5GetKey(), SEC_PKCS5CipherData(), and SEC_PKCS5CreateAlgorithmID().</td> </tr> <tr> <th>PKCS #12
Personal
Information
Exchange</th> <td>The PKCS #12 API will specify a standard interface based upon the forthcoming PKCS #12 standard which allows this private service to be used to exchange data such as private keys and certificates between two parties and consists of the eight routines including SEC_PKCS12CreateExportContext, SEC_PKCS12CreatePasswordPrivSafe(), SEC_PKCS12AddCertAndKey(), SEC_PKCS12Encode(), SEC_PKCS12DestroyExportContext(), SEC_PKCS12DecoderStart(), SEC_PKCS12DecoderUpdate(), and SEC_PKCS12DecoderFinish().</td> </tr> <tr> <th>Prime
Number
Generation</th> <td>This public service consists of the two routines used for generating a prime number including mpp_make_prime() and mpp_pprime().</td> </tr> <tr> <th>Private Key
Storage and
Retrieval</th> <td>This private service is utilized to perform private key storage and retrieval and consists of the seven routines including SECKEY_OpenKeyDB(), SECKEY_TraverseKeys(), SECKEY_UpdateKeyDBPass1() SECKEY_UpdateKeyDBPass2(), SECKEY_FindKeyByPublicKey(), SECKEY_DeleteKey(), and SECKEY_CloseKeyDB().</td> </tr> <tr> <th>Pseudorandom
Number
Generation</th> <td>This public service consists of the four routines used for global pseudorandom number generation including RNG_RNGInit(), RNG_GenerateGlobalRandomBytes(), RNG_RandomUpdate(), and RNG_RNGShutdown(), and the three routines used for seeding pseudorandom number generation including RNG_GetNoise(), RNG_SystemInfoForRNG(), and RNG_FileForRNG(). A continuous pseudorandom number generator test is performed whenever a new pseudorandom number is generated.</td> </tr> <tr> <th>SSL Session ID
Cache
(Secret
Management)</th> <td>This public service consists of the five routines used to perform session ID cache management including SSL_ConfigServerSessionIDCache(), ssl_FreeSID(), ssl_LookupSID(), ssl_ChooseSessionIDProcs(), and SSL_ClearSessionCache().</td> </tr> <tr> <td>TLS pseudorandom function (PRF)</td> <td>TLS pseudorandom function (PRF) is utilized by SSL 3.0 protocol to produce FIPS 140-1 compliant hashes of security relevant data items [pre-master secret]. See <a href="../sslchanges/index.html">SSL changes in Security Module 1.01</a> for full details.</td> </tr> </table>
Table II. Services
Name of Service Description of Service in Terms of Routines
PKCS #11 The PKCS #11 API specifies a standard interface based upon the PKCS #11 standard, which allows for the selection of a FIPS 140-2 mode of operation that provides both public and private services as well as a means of authentication into all private services, creates and maintains entry points for all FIPS 140-2 specific routines including sftk_fipsPowerUpSelfTest() at initialization as well as on demand for subsequent logins, and enforces a pairwise consistency check on all key generation algorithms. NSS's FIPS 140-2 PKCS #11 implementation defines the following standard crypto API:
Category Function Description
FIPS 140-2
specific
FC_GetFunctionList Return the list of FIPS 140-2 functions
General
purpose
FC_Initialize initializes Cryptoki
FC_Finalize finalizes Cryptoki (1.1)
FC_GetInfo obtains general information about Cryptoki
Slot and
token
management
FC_GetSlotList obtains a list of slots in the system
FC_GetSlotInfo obtains information about a particular slot
FC_GetTokenInfo obtains information about a particular token
FC_GetMechansimList obtains a list of mechanisms supported by a token
FC_GetMechanismInfo obtains information about a particular mechanism
FC_InitToken initializes a token
FC_InitPIN initializes the normal user?s PIN
FC_SetPIN modifies the PIN of the current user
Session management FC_OpenSession opens a connection or "session" between an application and a particular token
FC_CloseSession closes a session
FC_CloseAllSessions closes all sessions with a token
FC_GetSessionInfo obtains information about the session
FC_GetOperationState saves the state of the cryptographic operation in a session (1.1)
FC_SetOperationState restores the state of the cryptographic operation in a session (1.1)
FC_Login logs into a token
FC_Logout logs out from a token
Object
management
FC_CreateObject creates an object
FC_CopyObject creates a copy of an object
FC_DestroyObject destroys an object
FC_GetObjectSize obtains the size of an object in bytes
FC_GetAttributeValue obtains an attribute value of an object
FC_SetAttributeValue modifies an attribute value of an object
FC_FindObjectsInit initializes an object search operation
FC_FindObjects continues an object search operation
FC_FindObjectsFinal finishes an object search operation (1.1)

Encryption and

decryption
FC_EncryptInit initializes an encryption operation
FC_Encrypt encrypts single-part data
FC_EncryptUpdate continues a multiple-part encryption operation
FC_EncryptFinal finishes a multiple-part encryption operation
FC_DecryptInit initializes a decryption operation
FC_Decrypt decrypts single-part encrypted data
FC_DecryptUpdate continues a multiple-part decryption operation
FC_DecryptFinal finishes a multiple-part decryption operation
Message
digesting
FC_DigestInit initializes a message-digesting operation
FC_Digest digests single-part data
FC_DigestUpdate continues a multiple-part digesting operation
FC_DigestKey continues a multi-part message-digesting operation by digesting the value of a secret key as part of the data already digested (1.1)
FC_DigestFinal finishes a multiple-part digesting operation
Signature
and
verification
FC_SignInit initializes a signature operation
FC_Sign signs single-part data
FC_SignUpdate continues a multiple-part signature operation
FC_SignFinal finishes a multiple-part signature operation
FC_SignRecoverInit initializes a signature operation, where the data can be recovered from the signature
FC_SignRecover signs single-part data, where the data can be recovered from the signature
FC_VerifyInit initializes a verification operation
FC_Verify verifies a signature on single-part data
FC_VerifyUpdate continues a multiple-part verification operation
FC_VerifyFinal finishes a multiple-part verification operation
FC_VerifyRecoverInit initializes a verification operation where the data is recovered from the signature
FC_VerifyRecover verifies a signature on single-part data, where the data is recovered from the signature
Dual-function

cryptographic

operations
FC_DigestEncryptUpdate continues a multiple-part digesting and encryption operation (1.1)
FC_DecryptDigestUpdate continues a multiple-part decryption and digesting operation (1.1)
FC_SignEncryptUpdate continues a multiple-part signing and encryption operation (1.1)
FC_DecryptVerifyUpdate continues a multiple-part decryption and verify operation (1.1)
Key
management
FC_GenerateKey generates a secret key
FC_GenerateKeyPair generates a public-key/private-key pair
FC_WrapKey wraps (encrypts) a key
FC_UnwrapKey unwraps (decrypts) a key
FC_DeriveKey derives a key from a base key
Random number
generation
FC_SeedRandom mixes in additional seed material to the random number generator
FC_GenerateRandom generates random data
Function management FC_GetFunctionStatus obtains updated status of a function running in parallel with the application
FC_CancelFunction cancels a function running in parallel with the application
Callbacks Notify processes notifications from Cryptoki
Certificate
Storage and
Retrieval
This private service consists of six routines used to perform certificate storage and retrieval including SEC_OpenPermCertDB(), AddCertToPermDB(), SEC_TraversePermCerts(), SEC_FindPermCertByKey(), SEC_DeletePermCertificate(), and CERT_ClosePermCertDB().
Digital
Signatures
This private service consists of the one routine used to perform DSA signature generation, DSA_SignDigest(), and the one routine used to perform DSA signature verification, DSA_VerifyDigest(). This service also consists of the three routines used for RSA signature generation, verification, and entity association: RSA_Sign(), RSA_CheckSign(), and RSA_CheckSignRecover(), and the three raw routines used for RSA signature generation, verification, and entity association: RSA_SignRaw(), RSA_CheckSignRaw(), and RSA_CheckSignRecoverRaw(). In general, the key generation service must be invoked prior to invoking this service.
Encryption/
Decryption
This private service consists of the four routines used to perform DES Encryption/Decryption including DES_CreateContext(), DES_Encrypt(), DES_Decrypt(), and DES_DestroyContext(). Single-key DES service is provided by using the NSS_DES and NSS_DES_CBC modes with DES_CreateContext(). Triple-DES service is provided by using the NSS_DES_EDE3 and NSS_DES_EDE3_CBC modes with DES_CreateContext().
Hashing This public service consists of the eight routines used to perform SHA-1 hashing including SHA1_NewContext(), SHA1_CloneContext(), SHA1_Begin(), SHA1_Update(), SHA1_End(), SHA1_HashBuf(), SHA1_Hash(), and SHA1_DestroyContext().
Key
Generation
This private service is utilized to perform key generation and consists of the six routines used to perform DSA key generation including PQGParamGen(), PQG_ParamGenSeedLen(), PQG_VerifyParams(), DSA_CreateKeyGenContext(), DSA_NewKey(), and DSA_NewKeyFromSeed(), and the b>one</b> routine used for RSA private key generation called RSA_NewKey() (only used for entity association in public key exchange). When RSA_NewKey() is used in public key exchange between two parties, the Pairwise Consistency Test requires routines to check this symmetric algorithm. These consist of two routines used for entity association which include RSA_EncryptBlock(), and RSA_DecryptBlock(), and two raw routines used for entity association which include RSA_EncryptRaw(), and RSA_DecryptRaw().