JSS 3.1

org.mozilla.jss.pkcs11
Class PK11Token

java.lang.Object
  |
  +--org.mozilla.jss.pkcs11.PK11Token

public final class PK11Token
extends java.lang.Object
implements CryptoToken

A PKCS #11 token. Currently, these can only be obtained from the CryptoManager class.

See Also:
CryptoManager

Inner Class Summary
static interface PK11Token.NotInitializedException
          Thrown if the operation requires that the token be logged in, and it isn't.
 
Field Summary
protected  PK11Store cryptoStore
           
protected  boolean mIsInternalCryptoToken
           
protected  boolean mIsInternalKeyStorageToken
           
protected  TokenProxy tokenProxy
           
 
Constructor Summary
protected PK11Token()
           
protected PK11Token(byte[] pointer, boolean internal, boolean keyStorage)
          Creates a new PK11Token.
 
Method Summary
protected  void changePassword(byte[] oldPIN, byte[] newPIN)
          Change the password on the token from the old one to the new one.
 void changePassword(PasswordCallback oldPINcb, PasswordCallback newPINcb)
          Change password.
 SymmetricKey cloneKey(SymmetricKey key)
          Allows a SymmetricKey to be cloned on a different token.
 boolean doesAlgorithm(Algorithm alg)
          Determines whether this token is capable of performing the given algorithm.
 boolean equals(java.lang.Object obj)
          Deep-comparison operator.
 java.lang.String generateCertRequest(java.lang.String subject, int keysize, java.lang.String keyType, byte[] P, byte[] Q, byte[] G)
          Generates a PKCS#10 certificate request including Begin/End brackets
protected  java.lang.String generatePK10(java.lang.String subject, int keysize, java.lang.String keyType, byte[] P, byte[] Q, byte[] G)
           
 Cipher getCipherContext(EncryptionAlgorithm algorithm)
           
 CryptoStore getCryptoStore()
           
 JSSMessageDigest getDigestContext(DigestAlgorithm algorithm)
           
 KeyGenerator getKeyGenerator(KeyGenAlgorithm algorithm)
           
 KeyPairGenerator getKeyPairGenerator(KeyPairAlgorithm algorithm)
           
 KeyWrapper getKeyWrapper(KeyWrapAlgorithm algorithm)
           
 int getLoginMode()
           
 int getLoginTimeoutMinutes()
           
 java.lang.String getName()
           
 java.security.Provider getProvider()
           
(package private)  TokenProxy getProxy()
           
 java.security.SecureRandom getRandomGenerator()
           
 Signature getSignatureContext(SignatureAlgorithm algorithm)
           
protected  void initPassword(byte[] ssopw, byte[] userpw)
           
 void initPassword(PasswordCallback ssopwcb, PasswordCallback userpwcb)
          Initialize PIN.
 boolean isInternalCryptoToken()
           
 boolean isInternalKeyStorageToken()
           
 boolean isLoggedIn()
           
 boolean isPresent()
          Determines if the given token is present on the system.
 boolean isWritable()
           
 void login(PasswordCallback callback)
          Log into the token.
 void logout()
          Log out of the token.
protected  PasswordCallbackInfo makePWCBInfo()
           
protected  void nativeLogin(PasswordCallback callback)
           
 boolean passwordIsInitialized()
          Determine whether the token has been initialized yet.
protected  boolean PWInitable()
          Make sure the PIN can be initialized.
 void setLoginMode(int mode)
           
 void setLoginTimeoutMinutes(int timeoutMinutes)
           
protected  boolean SSOPasswordIsCorrect(byte[] ssopw)
           
protected  boolean userPasswordIsCorrect(byte[] pw)
          Check the given password, return true if it's right, false if it's wrong.
 
Methods inherited from class java.lang.Object
, clone, finalize, getClass, hashCode, notify, notifyAll, registerNatives, toString, wait, wait, wait
 

Field Detail

mIsInternalCryptoToken

protected boolean mIsInternalCryptoToken

mIsInternalKeyStorageToken

protected boolean mIsInternalKeyStorageToken

tokenProxy

protected TokenProxy tokenProxy

cryptoStore

protected PK11Store cryptoStore
Constructor Detail

PK11Token

protected PK11Token()

PK11Token

protected PK11Token(byte[] pointer,
                    boolean internal,
                    boolean keyStorage)
Creates a new PK11Token. Should only be called from PK11Token's native code.
Parameters:
pointer - A byte array containing a pointer to a PKCS #11 slot.
Method Detail

getSignatureContext

public Signature getSignatureContext(SignatureAlgorithm algorithm)
                              throws java.security.NoSuchAlgorithmException,
                                     TokenException
Specified by:
getSignatureContext in interface CryptoToken

getDigestContext

public JSSMessageDigest getDigestContext(DigestAlgorithm algorithm)
                                  throws java.security.NoSuchAlgorithmException,
                                         java.security.DigestException
Specified by:
getDigestContext in interface CryptoToken

getCipherContext

public Cipher getCipherContext(EncryptionAlgorithm algorithm)
                        throws java.security.NoSuchAlgorithmException,
                               TokenException
Specified by:
getCipherContext in interface CryptoToken

getKeyGenerator

public KeyGenerator getKeyGenerator(KeyGenAlgorithm algorithm)
                             throws java.security.NoSuchAlgorithmException,
                                    TokenException
Specified by:
getKeyGenerator in interface CryptoToken

cloneKey

public SymmetricKey cloneKey(SymmetricKey key)
                      throws SymmetricKey.NotExtractableException,
                             java.security.InvalidKeyException,
                             TokenException
Allows a SymmetricKey to be cloned on a different token.
Specified by:
cloneKey in interface CryptoToken
Throws:
SymmetricKey.NotExtractableException - If the key material cannot be extracted from the current token.
java.security.InvalidKeyException - If the owning token cannot process the key to be cloned.

getKeyWrapper

public KeyWrapper getKeyWrapper(KeyWrapAlgorithm algorithm)
                         throws java.security.NoSuchAlgorithmException,
                                TokenException
Specified by:
getKeyWrapper in interface CryptoToken

getRandomGenerator

public java.security.SecureRandom getRandomGenerator()
                                              throws NotImplementedException,
                                                     TokenException

getKeyPairGenerator

public KeyPairGenerator getKeyPairGenerator(KeyPairAlgorithm algorithm)
                                     throws java.security.NoSuchAlgorithmException,
                                            TokenException
Specified by:
getKeyPairGenerator in interface CryptoToken

isLoggedIn

public boolean isLoggedIn()
                   throws TokenException
Specified by:
isLoggedIn in interface CryptoToken

login

public void login(PasswordCallback callback)
           throws PK11Token.NotInitializedException,
                  IncorrectPasswordException,
                  TokenException
Log into the token. If you are already logged in, this method has no effect, even if the PIN is wrong.
Specified by:
login in interface CryptoToken
Parameters:
callback - A callback to use to obtain the password, or a Password object.
Throws:
PK11Token.NotInitializedException - The token has not yet been initialized.
IncorrectPasswordException - The specified password was incorrect.

nativeLogin

protected void nativeLogin(PasswordCallback callback)
                    throws PK11Token.NotInitializedException,
                           IncorrectPasswordException,
                           TokenException

isWritable

public boolean isWritable()
Returns:
true if the token is writable, false if it is read-only. Writable tokens can have their keys generated on the internal token and then moved out.

isPresent

public boolean isPresent()
Determines if the given token is present on the system. This would return false, for example, for a smart card reader that didn't have a card inserted.
Specified by:
isPresent in interface CryptoToken

logout

public void logout()
            throws TokenException
Log out of the token.
Specified by:
logout in interface CryptoToken
Throws:
TokenException - If you are already logged in, or an unspecified error occurs.

getLoginMode

public int getLoginMode()
                 throws TokenException
Specified by:
getLoginMode in interface CryptoToken

setLoginMode

public void setLoginMode(int mode)
                  throws TokenException
Specified by:
setLoginMode in interface CryptoToken

getLoginTimeoutMinutes

public int getLoginTimeoutMinutes()
                           throws TokenException
Specified by:
getLoginTimeoutMinutes in interface CryptoToken

setLoginTimeoutMinutes

public void setLoginTimeoutMinutes(int timeoutMinutes)
                            throws TokenException
Specified by:
setLoginTimeoutMinutes in interface CryptoToken

initPassword

public void initPassword(PasswordCallback ssopwcb,
                         PasswordCallback userpwcb)
                  throws IncorrectPasswordException,
                         AlreadyInitializedException,
                         TokenException
Initialize PIN. This sets the user's new PIN, using the current security officer PIN for authentication.
Specified by:
initPassword in interface CryptoToken
Parameters:
ssopw - The security officer's current password.
userpw - The user's new password.
Throws:
IncorrectPinException - If the security officer PIN is incorrect.
TokenException - If the PIN was already initialized, or there was an unspecified error in the token.

PWInitable

protected boolean PWInitable()
                      throws TokenException
Make sure the PIN can be initialized. This is mainly to check the internal module.

SSOPasswordIsCorrect

protected boolean SSOPasswordIsCorrect(byte[] ssopw)
                                throws TokenException,
                                       AlreadyInitializedException

initPassword

protected void initPassword(byte[] ssopw,
                            byte[] userpw)
                     throws IncorrectPasswordException,
                            AlreadyInitializedException,
                            TokenException

passwordIsInitialized

public boolean passwordIsInitialized()
                              throws TokenException
Determine whether the token has been initialized yet.
Specified by:
passwordIsInitialized in interface CryptoToken

changePassword

public void changePassword(PasswordCallback oldPINcb,
                           PasswordCallback newPINcb)
                    throws IncorrectPasswordException,
                           TokenException
Change password. This changes the user's PIN after it has already been initialized.
Specified by:
changePassword in interface CryptoToken
Parameters:
oldPIN - The user's old PIN.
newPIN - The new PIN.
Throws:
IncorrectPasswordException - If the old PIN is incorrect.
TokenException - If some other error occurs on the token.

makePWCBInfo

protected PasswordCallbackInfo makePWCBInfo()

userPasswordIsCorrect

protected boolean userPasswordIsCorrect(byte[] pw)
                                 throws TokenException
Check the given password, return true if it's right, false if it's wrong.

changePassword

protected void changePassword(byte[] oldPIN,
                              byte[] newPIN)
                       throws IncorrectPasswordException,
                              TokenException
Change the password on the token from the old one to the new one.

getName

public java.lang.String getName()
Specified by:
getName in interface CryptoToken

getProvider

public java.security.Provider getProvider()

getCryptoStore

public CryptoStore getCryptoStore()
Specified by:
getCryptoStore in interface CryptoToken

equals

public boolean equals(java.lang.Object obj)
Deep-comparison operator.
Specified by:
equals in interface CryptoToken
Returns:
true if these tokens point to the same underlying native token. false otherwise, or if compare is null.
Overrides:
equals in class java.lang.Object

doesAlgorithm

public boolean doesAlgorithm(Algorithm alg)
Determines whether this token is capable of performing the given algorithm.
Specified by:
doesAlgorithm in interface CryptoToken

generateCertRequest

public java.lang.String generateCertRequest(java.lang.String subject,
                                            int keysize,
                                            java.lang.String keyType,
                                            byte[] P,
                                            byte[] Q,
                                            byte[] G)
                                     throws TokenException,
                                            java.security.InvalidParameterException,
                                            PQGParamGenException
Generates a PKCS#10 certificate request including Begin/End brackets
Specified by:
generateCertRequest in interface CryptoToken
Parameters:
subject - subject dn of the certificate
keysize - size of the key
keyType - "rsa" or "dsa"
P - The DSA prime parameter
Q - The DSA sub-prime parameter
G - The DSA base parameter

generatePK10

protected java.lang.String generatePK10(java.lang.String subject,
                                        int keysize,
                                        java.lang.String keyType,
                                        byte[] P,
                                        byte[] Q,
                                        byte[] G)
                                 throws TokenException,
                                        java.security.InvalidParameterException

getProxy

TokenProxy getProxy()

isInternalCryptoToken

public boolean isInternalCryptoToken()
Returns:
true if this is the internal token used for bulk crypto.

isInternalKeyStorageToken

public boolean isInternalKeyStorageToken()
Returns:
true if this is the internal key storage token.

JSS 3.1