craton-hsm 0.10.5

A production-grade PKCS#11 v3.0-compliant Software HSM written in Rust
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377

// SPDX-License-Identifier: Apache-2.0
// Copyright 2026 Craton Software Company
// PKCS#11 v3.0 constants
// Reference: OASIS PKCS#11 Base Specification v3.0

use super::types::CK_ULONG;

// --- Return Values (CKR_*) ---

pub const CKR_OK: CK_ULONG = 0x00000000;
pub const CKR_CANCEL: CK_ULONG = 0x00000001;
pub const CKR_HOST_MEMORY: CK_ULONG = 0x00000002;
pub const CKR_SLOT_ID_INVALID: CK_ULONG = 0x00000003;
pub const CKR_GENERAL_ERROR: CK_ULONG = 0x00000005;
pub const CKR_FUNCTION_FAILED: CK_ULONG = 0x00000006;
pub const CKR_NO_EVENT: CK_ULONG = 0x00000008;
pub const CKR_ARGUMENTS_BAD: CK_ULONG = 0x00000007;
pub const CKR_ATTRIBUTE_READ_ONLY: CK_ULONG = 0x00000010;
pub const CKR_ATTRIBUTE_SENSITIVE: CK_ULONG = 0x00000011;
pub const CKR_ATTRIBUTE_TYPE_INVALID: CK_ULONG = 0x00000012;
pub const CKR_ATTRIBUTE_VALUE_INVALID: CK_ULONG = 0x00000013;
pub const CKR_DATA_INVALID: CK_ULONG = 0x00000020;
pub const CKR_DATA_LEN_RANGE: CK_ULONG = 0x00000021;
pub const CKR_DEVICE_ERROR: CK_ULONG = 0x00000030;
pub const CKR_DEVICE_MEMORY: CK_ULONG = 0x00000031;
pub const CKR_DEVICE_REMOVED: CK_ULONG = 0x00000032;
pub const CKR_ENCRYPTED_DATA_INVALID: CK_ULONG = 0x00000040;
pub const CKR_ENCRYPTED_DATA_LEN_RANGE: CK_ULONG = 0x00000041;
pub const CKR_FUNCTION_CANCELED: CK_ULONG = 0x00000050;
pub const CKR_FUNCTION_NOT_PARALLEL: CK_ULONG = 0x00000051;
pub const CKR_FUNCTION_NOT_SUPPORTED: CK_ULONG = 0x00000054;
pub const CKR_KEY_HANDLE_INVALID: CK_ULONG = 0x00000060;
pub const CKR_KEY_SIZE_RANGE: CK_ULONG = 0x00000062;
pub const CKR_KEY_TYPE_INCONSISTENT: CK_ULONG = 0x00000063;
pub const CKR_KEY_NOT_NEEDED: CK_ULONG = 0x00000064;
pub const CKR_KEY_CHANGED: CK_ULONG = 0x00000065;
pub const CKR_KEY_NEEDED: CK_ULONG = 0x00000066;
pub const CKR_KEY_INDIGESTIBLE: CK_ULONG = 0x00000067;
pub const CKR_KEY_FUNCTION_NOT_PERMITTED: CK_ULONG = 0x00000068;
pub const CKR_KEY_NOT_WRAPPABLE: CK_ULONG = 0x00000069;
pub const CKR_KEY_UNEXTRACTABLE: CK_ULONG = 0x0000006A;
pub const CKR_MECHANISM_INVALID: CK_ULONG = 0x00000070;
pub const CKR_MECHANISM_PARAM_INVALID: CK_ULONG = 0x00000071;
pub const CKR_OBJECT_HANDLE_INVALID: CK_ULONG = 0x00000082;
pub const CKR_OPERATION_ACTIVE: CK_ULONG = 0x00000090;
pub const CKR_OPERATION_NOT_INITIALIZED: CK_ULONG = 0x00000091;
pub const CKR_PIN_INCORRECT: CK_ULONG = 0x000000A0;
pub const CKR_PIN_INVALID: CK_ULONG = 0x000000A1;
pub const CKR_PIN_LEN_RANGE: CK_ULONG = 0x000000A2;
pub const CKR_PIN_EXPIRED: CK_ULONG = 0x000000A3;
pub const CKR_PIN_LOCKED: CK_ULONG = 0x000000A4;
pub const CKR_SESSION_CLOSED: CK_ULONG = 0x000000B0;
pub const CKR_SESSION_COUNT: CK_ULONG = 0x000000B1;
pub const CKR_SESSION_HANDLE_INVALID: CK_ULONG = 0x000000B3;
pub const CKR_SESSION_PARALLEL_NOT_SUPPORTED: CK_ULONG = 0x000000B4;
pub const CKR_SESSION_READ_ONLY: CK_ULONG = 0x000000B5;
pub const CKR_SESSION_EXISTS: CK_ULONG = 0x000000B6;
pub const CKR_SESSION_READ_ONLY_EXISTS: CK_ULONG = 0x000000B7;
pub const CKR_SESSION_READ_WRITE_SO_EXISTS: CK_ULONG = 0x000000B8;
pub const CKR_SIGNATURE_INVALID: CK_ULONG = 0x000000C0;
pub const CKR_SIGNATURE_LEN_RANGE: CK_ULONG = 0x000000C1;
pub const CKR_TEMPLATE_INCOMPLETE: CK_ULONG = 0x000000D0;
pub const CKR_TEMPLATE_INCONSISTENT: CK_ULONG = 0x000000D1;
pub const CKR_TOKEN_NOT_PRESENT: CK_ULONG = 0x000000E0;
pub const CKR_TOKEN_NOT_RECOGNIZED: CK_ULONG = 0x000000E1;
pub const CKR_TOKEN_WRITE_PROTECTED: CK_ULONG = 0x000000E2;
pub const CKR_UNWRAPPING_KEY_HANDLE_INVALID: CK_ULONG = 0x000000F0;
pub const CKR_UNWRAPPING_KEY_SIZE_RANGE: CK_ULONG = 0x000000F1;
pub const CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT: CK_ULONG = 0x000000F2;
pub const CKR_USER_ALREADY_LOGGED_IN: CK_ULONG = 0x00000100;
pub const CKR_USER_NOT_LOGGED_IN: CK_ULONG = 0x00000101;
pub const CKR_USER_PIN_NOT_INITIALIZED: CK_ULONG = 0x00000102;
pub const CKR_USER_TYPE_INVALID: CK_ULONG = 0x00000103;
pub const CKR_USER_ANOTHER_ALREADY_LOGGED_IN: CK_ULONG = 0x00000104;
pub const CKR_USER_TOO_MANY_TYPES: CK_ULONG = 0x00000105;
pub const CKR_WRAPPED_KEY_INVALID: CK_ULONG = 0x00000110;
pub const CKR_WRAPPED_KEY_LEN_RANGE: CK_ULONG = 0x00000112;
pub const CKR_WRAPPING_KEY_HANDLE_INVALID: CK_ULONG = 0x00000113;
pub const CKR_WRAPPING_KEY_SIZE_RANGE: CK_ULONG = 0x00000114;
pub const CKR_WRAPPING_KEY_TYPE_INCONSISTENT: CK_ULONG = 0x00000115;
pub const CKR_RANDOM_SEED_NOT_SUPPORTED: CK_ULONG = 0x00000120;
pub const CKR_RANDOM_NO_RNG: CK_ULONG = 0x00000121;
pub const CKR_DOMAIN_PARAMS_INVALID: CK_ULONG = 0x00000130;
pub const CKR_CURVE_NOT_SUPPORTED: CK_ULONG = 0x00000140;
pub const CKR_BUFFER_TOO_SMALL: CK_ULONG = 0x00000150;
pub const CKR_SAVED_STATE_INVALID: CK_ULONG = 0x00000160;
pub const CKR_INFORMATION_SENSITIVE: CK_ULONG = 0x00000170;
pub const CKR_STATE_UNSAVEABLE: CK_ULONG = 0x00000180;
pub const CKR_CRYPTOKI_NOT_INITIALIZED: CK_ULONG = 0x00000190;
pub const CKR_CRYPTOKI_ALREADY_INITIALIZED: CK_ULONG = 0x00000191;
pub const CKR_MUTEX_BAD: CK_ULONG = 0x000001A0;
pub const CKR_MUTEX_NOT_LOCKED: CK_ULONG = 0x000001A1;
pub const CKR_VENDOR_DEFINED: CK_ULONG = 0x80000000;

// --- Mechanism Types (CKM_*) ---

pub const CKM_RSA_PKCS_KEY_PAIR_GEN: CK_ULONG = 0x00000000;
pub const CKM_RSA_PKCS: CK_ULONG = 0x00000001;
pub const CKM_RSA_PKCS_OAEP: CK_ULONG = 0x00000009;
pub const CKM_RSA_PKCS_PSS: CK_ULONG = 0x0000000D;
/// Deprecated: SHA-1 based RSA signing is prohibited for digital signatures
/// per NIST SP 800-131A Rev.2. Retained for spec completeness but NOT
/// advertised in C_GetMechanismInfo or C_GetMechanismList.
pub const CKM_SHA1_RSA_PKCS: CK_ULONG = 0x00000006;
pub const CKM_SHA256_RSA_PKCS: CK_ULONG = 0x00000040;
pub const CKM_SHA384_RSA_PKCS: CK_ULONG = 0x00000041;
pub const CKM_SHA512_RSA_PKCS: CK_ULONG = 0x00000042;
pub const CKM_SHA256_RSA_PKCS_PSS: CK_ULONG = 0x00000043;
pub const CKM_SHA384_RSA_PKCS_PSS: CK_ULONG = 0x00000044;
pub const CKM_SHA512_RSA_PKCS_PSS: CK_ULONG = 0x00000045;
pub const CKM_DSA_KEY_PAIR_GEN: CK_ULONG = 0x00000010;
pub const CKM_DSA: CK_ULONG = 0x00000011;
pub const CKM_ECDSA_KEY_PAIR_GEN: CK_ULONG = 0x00001040;
pub const CKM_EC_KEY_PAIR_GEN: CK_ULONG = 0x00001040;
pub const CKM_ECDSA: CK_ULONG = 0x00001041;
pub const CKM_ECDSA_SHA256: CK_ULONG = 0x00001044;
pub const CKM_ECDSA_SHA384: CK_ULONG = 0x00001045;
pub const CKM_ECDSA_SHA512: CK_ULONG = 0x00001046;
pub const CKM_ECDH1_DERIVE: CK_ULONG = 0x00001050;
pub const CKM_ECDH1_COFACTOR_DERIVE: CK_ULONG = 0x00001051;
pub const CKM_EC_EDWARDS_KEY_PAIR_GEN: CK_ULONG = 0x00001055;
pub const CKM_EDDSA: CK_ULONG = 0x00001057;
pub const CKM_AES_KEY_GEN: CK_ULONG = 0x00001080;
pub const CKM_AES_CBC: CK_ULONG = 0x00001082;
pub const CKM_AES_CBC_PAD: CK_ULONG = 0x00001085;
pub const CKM_AES_CTR: CK_ULONG = 0x00001086;
pub const CKM_AES_GCM: CK_ULONG = 0x00001087;
pub const CKM_AES_KEY_WRAP: CK_ULONG = 0x00002109;
pub const CKM_AES_KEY_WRAP_KWP: CK_ULONG = 0x0000210B;
pub const CKM_SHA_1: CK_ULONG = 0x00000220;
pub const CKM_SHA256: CK_ULONG = 0x00000250;
pub const CKM_SHA384: CK_ULONG = 0x00000260;
pub const CKM_SHA512: CK_ULONG = 0x00000270;
pub const CKM_SHA3_256: CK_ULONG = 0x000002B0;
pub const CKM_SHA3_384: CK_ULONG = 0x000002C0;
pub const CKM_SHA3_512: CK_ULONG = 0x000002D0;

// --- Post-Quantum Mechanisms (PKCS#11 v3.2) ---
// The parameter set (ML-DSA-44/65/87, ...) comes from the key's
// CKA_PARAMETER_SET rather than from the mechanism.
pub const CKM_ML_KEM_KEY_PAIR_GEN: CK_ULONG = 0x0000000F;
pub const CKM_ML_DSA_KEY_PAIR_GEN: CK_ULONG = 0x0000001C;
pub const CKM_ML_DSA: CK_ULONG = 0x0000001D;
pub const CKM_SLH_DSA_KEY_PAIR_GEN: CK_ULONG = 0x0000002D;
pub const CKM_SLH_DSA: CK_ULONG = 0x0000002E;

// --- Post-Quantum Mechanisms (vendor-defined range) ---
// Predate PKCS#11 v3.2; each names one parameter set. Still accepted.
pub const CKM_ML_KEM_512: CK_ULONG = 0x80000001;
pub const CKM_ML_KEM_768: CK_ULONG = 0x80000002;
pub const CKM_ML_KEM_1024: CK_ULONG = 0x80000003;
pub const CKM_ML_DSA_44: CK_ULONG = 0x80000010;
pub const CKM_ML_DSA_65: CK_ULONG = 0x80000011;
pub const CKM_ML_DSA_87: CK_ULONG = 0x80000012;
pub const CKM_SLH_DSA_SHA2_128S: CK_ULONG = 0x80000020;
pub const CKM_SLH_DSA_SHA2_256S: CK_ULONG = 0x80000021;
pub const CKM_HYBRID_ML_DSA_ECDSA: CK_ULONG = 0x80000030;
pub const CKM_HYBRID_X25519_ML_KEM_768: CK_ULONG = 0x80000040;
pub const CKM_HYBRID_X25519_ML_KEM_1024: CK_ULONG = 0x80000041;

// --- Object Classes (CKO_*) ---

pub const CKO_DATA: CK_ULONG = 0x00000000;
pub const CKO_CERTIFICATE: CK_ULONG = 0x00000001;
pub const CKO_PUBLIC_KEY: CK_ULONG = 0x00000002;
pub const CKO_PRIVATE_KEY: CK_ULONG = 0x00000003;
pub const CKO_SECRET_KEY: CK_ULONG = 0x00000004;
pub const CKO_VENDOR_DEFINED: CK_ULONG = 0x80000000;

// --- Key Types (CKK_*) ---

pub const CKK_RSA: CK_ULONG = 0x00000000;
pub const CKK_DSA: CK_ULONG = 0x00000001;
pub const CKK_DH: CK_ULONG = 0x00000002;
pub const CKK_EC: CK_ULONG = 0x00000003;
pub const CKK_GENERIC_SECRET: CK_ULONG = 0x00000010;
pub const CKK_AES: CK_ULONG = 0x0000001F;
pub const CKK_SHA256_HMAC: CK_ULONG = 0x0000002B;
pub const CKK_EC_EDWARDS: CK_ULONG = 0x00000040;
pub const CKK_EC_MONTGOMERY: CK_ULONG = 0x00000041;
pub const CKK_ML_KEM: CK_ULONG = 0x00000049;
pub const CKK_ML_DSA: CK_ULONG = 0x0000004A;
pub const CKK_SLH_DSA: CK_ULONG = 0x0000004B;
pub const CKK_VENDOR_DEFINED: CK_ULONG = 0x80000000;

/// Vendor-defined PQC key types used before the PKCS#11 v3.2 values above.
/// Objects persisted with them, and templates that still name them, are
/// mapped to the standard values by [`normalize_key_type`].
pub const CKK_VENDOR_ML_KEM_LEGACY: CK_ULONG = 0x80000001;
pub const CKK_VENDOR_ML_DSA_LEGACY: CK_ULONG = 0x80000002;
pub const CKK_VENDOR_SLH_DSA_LEGACY: CK_ULONG = 0x80000003;

/// Map a legacy vendor-defined PQC key type to its PKCS#11 v3.2 value.
/// Other key types are returned unchanged.
pub const fn normalize_key_type(key_type: CK_ULONG) -> CK_ULONG {
    match key_type {
        CKK_VENDOR_ML_KEM_LEGACY => CKK_ML_KEM,
        CKK_VENDOR_ML_DSA_LEGACY => CKK_ML_DSA,
        CKK_VENDOR_SLH_DSA_LEGACY => CKK_SLH_DSA,
        other => other,
    }
}

// --- Parameter Sets (CKP_*, PKCS#11 v3.2) ---

pub const CKP_ML_DSA_44: CK_ULONG = 0x00000001;
pub const CKP_ML_DSA_65: CK_ULONG = 0x00000002;
pub const CKP_ML_DSA_87: CK_ULONG = 0x00000003;
pub const CKP_ML_KEM_512: CK_ULONG = 0x00000001;
pub const CKP_ML_KEM_768: CK_ULONG = 0x00000002;
pub const CKP_ML_KEM_1024: CK_ULONG = 0x00000003;
pub const CKP_SLH_DSA_SHA2_128S: CK_ULONG = 0x00000001;
pub const CKP_SLH_DSA_SHA2_256S: CK_ULONG = 0x00000009;

// --- Hedging variants for CK_SIGN_ADDITIONAL_CONTEXT (PKCS#11 v3.2) ---

pub const CKH_HEDGE_PREFERRED: CK_ULONG = 0x00000000;
pub const CKH_HEDGE_REQUIRED: CK_ULONG = 0x00000001;
pub const CKH_DETERMINISTIC_REQUIRED: CK_ULONG = 0x00000002;

// --- Attribute Types (CKA_*) ---

pub const CKA_CLASS: CK_ULONG = 0x00000000;
pub const CKA_TOKEN: CK_ULONG = 0x00000001;
pub const CKA_PRIVATE: CK_ULONG = 0x00000002;
pub const CKA_LABEL: CK_ULONG = 0x00000003;
pub const CKA_APPLICATION: CK_ULONG = 0x00000010;
pub const CKA_VALUE: CK_ULONG = 0x00000011;
pub const CKA_OBJECT_ID: CK_ULONG = 0x00000012;
pub const CKA_CERTIFICATE_TYPE: CK_ULONG = 0x00000080;
pub const CKA_ISSUER: CK_ULONG = 0x00000081;
pub const CKA_SERIAL_NUMBER: CK_ULONG = 0x00000082;
pub const CKA_KEY_TYPE: CK_ULONG = 0x00000100;
pub const CKA_SUBJECT: CK_ULONG = 0x00000101;
pub const CKA_ID: CK_ULONG = 0x00000102;
pub const CKA_SENSITIVE: CK_ULONG = 0x00000103;
pub const CKA_ENCRYPT: CK_ULONG = 0x00000104;
pub const CKA_DECRYPT: CK_ULONG = 0x00000105;
pub const CKA_WRAP: CK_ULONG = 0x00000106;
pub const CKA_UNWRAP: CK_ULONG = 0x00000107;
pub const CKA_SIGN: CK_ULONG = 0x00000108;
pub const CKA_SIGN_RECOVER: CK_ULONG = 0x00000109;
pub const CKA_VERIFY: CK_ULONG = 0x0000010A;
pub const CKA_VERIFY_RECOVER: CK_ULONG = 0x0000010B;
pub const CKA_DERIVE: CK_ULONG = 0x0000010C;
pub const CKA_START_DATE: CK_ULONG = 0x00000110;
pub const CKA_END_DATE: CK_ULONG = 0x00000111;
pub const CKA_MODULUS: CK_ULONG = 0x00000120;
pub const CKA_MODULUS_BITS: CK_ULONG = 0x00000121;
pub const CKA_PUBLIC_EXPONENT: CK_ULONG = 0x00000122;
pub const CKA_PRIVATE_EXPONENT: CK_ULONG = 0x00000123;
pub const CKA_PRIME_1: CK_ULONG = 0x00000124;
pub const CKA_PRIME_2: CK_ULONG = 0x00000125;
pub const CKA_EXPONENT_1: CK_ULONG = 0x00000126;
pub const CKA_EXPONENT_2: CK_ULONG = 0x00000127;
pub const CKA_COEFFICIENT: CK_ULONG = 0x00000128;
pub const CKA_EC_PARAMS: CK_ULONG = 0x00000180;
pub const CKA_EC_POINT: CK_ULONG = 0x00000181;
pub const CKA_VALUE_LEN: CK_ULONG = 0x00000161;
pub const CKA_EXTRACTABLE: CK_ULONG = 0x00000162;
pub const CKA_LOCAL: CK_ULONG = 0x00000163;
pub const CKA_NEVER_EXTRACTABLE: CK_ULONG = 0x00000164;
pub const CKA_ALWAYS_SENSITIVE: CK_ULONG = 0x00000165;
pub const CKA_KEY_GEN_MECHANISM: CK_ULONG = 0x00000166;
pub const CKA_MODIFIABLE: CK_ULONG = 0x00000170;
pub const CKA_COPYABLE: CK_ULONG = 0x00000171;
pub const CKA_DESTROYABLE: CK_ULONG = 0x00000172;
pub const CKF_ARRAY_ATTRIBUTE: CK_ULONG = 0x40000000;
pub const CKA_WRAP_WITH_TRUSTED: CK_ULONG = 0x00000210;
pub const CKA_WRAP_TEMPLATE: CK_ULONG = CKF_ARRAY_ATTRIBUTE | 0x00000211;
pub const CKA_UNWRAP_TEMPLATE: CK_ULONG = CKF_ARRAY_ATTRIBUTE | 0x00000212;
pub const CKA_PARAMETER_SET: CK_ULONG = 0x0000061D;
pub const CKA_TRUSTED: CK_ULONG = 0x00000086;
pub const CKA_VENDOR_DEFINED: CK_ULONG = 0x80000000;

/// FIPS 140-3 IG 2.4.C: Algorithm indicator for last crypto operation.
/// Query via C_GetSessionInfo extension or audit log.
/// Value: CK_BBOOL (CK_TRUE = approved, CK_FALSE = non-approved).
pub const CKA_VENDOR_FIPS_APPROVED: CK_ULONG = CKA_VENDOR_DEFINED | 0x00000001;

// --- Session Flags ---

pub const CKF_RW_SESSION: CK_ULONG = 0x00000002;
pub const CKF_SERIAL_SESSION: CK_ULONG = 0x00000004;

// --- Session States ---

pub const CKS_RO_PUBLIC_SESSION: CK_ULONG = 0;
pub const CKS_RO_USER_FUNCTIONS: CK_ULONG = 1;
pub const CKS_RW_PUBLIC_SESSION: CK_ULONG = 2;
pub const CKS_RW_USER_FUNCTIONS: CK_ULONG = 3;
pub const CKS_RW_SO_FUNCTIONS: CK_ULONG = 4;

// --- User Types ---

pub const CKU_SO: CK_ULONG = 0;
pub const CKU_USER: CK_ULONG = 1;
pub const CKU_CONTEXT_SPECIFIC: CK_ULONG = 2;

// --- Token Flags ---
// NOTE: Token flags and slot flags share numeric values but apply to
// different struct fields (CK_TOKEN_INFO.flags vs CK_SLOT_INFO.flags).
// This is per the PKCS#11 specification and is NOT a collision.

pub const CKF_TOKEN_PRESENT: CK_ULONG = 0x00000001;
pub const CKF_REMOVABLE_DEVICE: CK_ULONG = 0x00000002;
pub const CKF_HW_SLOT: CK_ULONG = 0x00000004;
// CKF_RNG (0x1) applies to CK_TOKEN_INFO.flags; same value as CKF_TOKEN_PRESENT
// which applies to CK_SLOT_INFO.flags — different flag spaces per PKCS#11 spec.
pub const CKF_RNG: CK_ULONG = 0x00000001;
pub const CKF_WRITE_PROTECTED: CK_ULONG = 0x00000002;
pub const CKF_LOGIN_REQUIRED: CK_ULONG = 0x00000004;
pub const CKF_USER_PIN_INITIALIZED: CK_ULONG = 0x00000008;
pub const CKF_TOKEN_INITIALIZED: CK_ULONG = 0x00000400;
pub const CKF_USER_PIN_COUNT_LOW: CK_ULONG = 0x00010000;
pub const CKF_USER_PIN_FINAL_TRY: CK_ULONG = 0x00020000;
pub const CKF_USER_PIN_LOCKED: CK_ULONG = 0x00040000;
pub const CKF_SO_PIN_COUNT_LOW: CK_ULONG = 0x00100000;
pub const CKF_SO_PIN_FINAL_TRY: CK_ULONG = 0x00200000;
pub const CKF_SO_PIN_LOCKED: CK_ULONG = 0x00400000;

// --- Slot Flags ---

pub const CKF_SLOT_TOKEN_PRESENT: CK_ULONG = 0x00000001;
pub const CKF_SLOT_REMOVABLE_DEVICE: CK_ULONG = 0x00000002;
pub const CKF_SLOT_HW_SLOT: CK_ULONG = 0x00000004;

// --- WaitForSlotEvent Flags ---

pub const CKF_DONT_BLOCK: CK_ULONG = 0x00000001;

// --- Initialize Flags ---

pub const CKF_LIBRARY_CANT_CREATE_OS_THREADS: CK_ULONG = 0x00000001;
pub const CKF_OS_LOCKING_OK: CK_ULONG = 0x00000002;

// --- Mechanism Flags ---

pub const CKF_HW: CK_ULONG = 0x00000001;
pub const CKF_ENCRYPT_FLAG: CK_ULONG = 0x00000100;
pub const CKF_DECRYPT_FLAG: CK_ULONG = 0x00000200;
pub const CKF_DIGEST_FLAG: CK_ULONG = 0x00000400;
pub const CKF_SIGN_FLAG: CK_ULONG = 0x00000800;
pub const CKF_SIGN_RECOVER_FLAG: CK_ULONG = 0x00001000;
pub const CKF_VERIFY_FLAG: CK_ULONG = 0x00002000;
pub const CKF_VERIFY_RECOVER_FLAG: CK_ULONG = 0x00004000;
pub const CKF_GENERATE_FLAG: CK_ULONG = 0x00008000;
pub const CKF_GENERATE_KEY_PAIR_FLAG: CK_ULONG = 0x00010000;
pub const CKF_WRAP_FLAG: CK_ULONG = 0x00020000;
pub const CKF_UNWRAP_FLAG: CK_ULONG = 0x00040000;
pub const CKF_DERIVE_FLAG: CK_ULONG = 0x00080000;

// --- EC key derivation functions (CKD_*, CK_EC_KDF_TYPE) ---

pub const CKD_NULL: CK_ULONG = 0x00000001;
pub const CKD_SHA1_KDF: CK_ULONG = 0x00000002;
pub const CKD_SHA224_KDF: CK_ULONG = 0x00000005;
pub const CKD_SHA256_KDF: CK_ULONG = 0x00000006;
pub const CKD_SHA384_KDF: CK_ULONG = 0x00000007;
pub const CKD_SHA512_KDF: CK_ULONG = 0x00000008;

// --- Unavailable information sentinel ---

pub const CK_UNAVAILABLE_INFORMATION: CK_ULONG = CK_ULONG::MAX;
pub const CK_EFFECTIVELY_INFINITE: CK_ULONG = 0;

// --- Mask Generation Functions (CKG_MGF1_*) ---

pub const CKG_MGF1_SHA1: CK_ULONG = 0x00000001;
pub const CKG_MGF1_SHA256: CK_ULONG = 0x00000002;
pub const CKG_MGF1_SHA384: CK_ULONG = 0x00000003;
pub const CKG_MGF1_SHA512: CK_ULONG = 0x00000004;
pub const CKG_MGF1_SHA224: CK_ULONG = 0x00000005;

// --- OAEP source types ---

pub const CKZ_DATA_SPECIFIED: CK_ULONG = 0x00000001;