Skip to content

RFE: CKA_UNWRAP_TEMPLATE Support #51

@jumpifnotzero

Description

@jumpifnotzero

Hi!

Are you able to add support for CKA_UNWRAP_TEMPLATE?

I'd like to generate wrapping keys that cannot be used to bypass CKA_EXTRACTABLE via wrap+unwrap operations.

key = session.generate_key(pkcs11.KeyType.AES, key_length=256, label='ABC1234', store=True, template={
    pkcs11.Attribute.SENSITIVE: True,
    pkcs11.Attribute.EXTRACTABLE: False,
    pkcs11.Attribute.WRAP: True,
    pkcs11.Attribute.UNWRAP: True,
    pkcs11.Attribute.UNWRAP_TEMPLATE: {pkcs11.Attribute.EXTRACTABLE: False},
});

The above code produces:
NotImplementedError: Can't pack this Attribute.UNWRAP_TEMPLATE. Expand ATTRIBUTE_TYPES!

Thanks for the great library!

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions