JNIPKCS11 ("Entrust Authority Security Toolkit for the Java Platform")

java.lang.Object
- com.entrust.toolkit.pkcs11.JNIPKCS11

```
public final class JNIPKCS11
extends java.lang.Object
```
Implements the native interface to the token's Cryptoki library.
This class contains many of the functions described in the PKCS11 standard, which specifies an application programming interface (API), called 'Cryptoki', to devices that hold cryptographic information and perform cryptographic functions — tokens. It is used internally by the Toolkit for all token access.

FIPS 140-2:

This class is part of the Toolkit's FIPS 140-2 cryptographic module and contains APIs that are considered part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; refer to the API documentation for further details

Nested Class Summary

Nested Classes
Modifier and Type Class and Description

static class JNIPKCS11.EcdsaDigestFormat
Supported ECDSA digest formats.

Nested Classes
Modifier and Type	Class and Description
`static class`	`JNIPKCS11.EcdsaDigestFormat` Supported ECDSA digest formats.

Field Summary

Fields
Modifier and Type	Field and Description
`static long`	`CKG_MGF1_SHA1` Indicator for the MGF1 with SHA1 mask generation function.
`static long`	`CKG_MGF1_SHA224` Indicator for the MGF1 with SHA224 mask generation function.
`static long`	`CKG_MGF1_SHA256` Indicator for the MGF1 with SHA256 mask generation function.
`static long`	`CKG_MGF1_SHA384` Indicator for the MGF1 with SHA384 mask generation function.
`static long`	`CKG_MGF1_SHA512` Indicator for the MGF1 with SHA512 mask generation function.
`static int`	`CKK_DSA` Indicator for the DSA key-type.
`static int`	`CKK_EC` Indicator for the EC key-type.
`static int`	`CKK_RSA` Indicator for the RSA key-type.
`static int`	`CKU_SO` Indicator for a Security Officer user.
`static int`	`CKU_USER` Indicator for a Normal user.

Method Summary

Methods
Modifier and Type	Method and Description
`long`	`addDecryptionKey(long sessionHandle, byte[] id, byte[] modulus, byte[] publicExponent, byte[] privateExponent, byte[] prime1, byte[] prime2, byte[] exponent1, byte[] exponent2, byte[] coefficient)` Creates a new RSA decryption key object on a token (a token object).
`long`	`addDecryptionKeySecure(long sessionHandle, SecretKey wrappingKey, long wrappingKeyHandle, byte[] decryptionKey, byte[] id)` Creates a new decryption key object on a token by transferring it to the token securely.
`void`	`closeAllSessions(long slotID)` Closes all sessions an application has with a token.
`void`	`closeSession(long sessionHandle)` Closes a session between an application and a token.
`void`	`closeTemporarySessions(long slotID)` Closes all released temporary session handles for a particular slot.
`static byte[]`	`convertEcdsaSignaturePkcs11ToAnsix963(byte[] signature)` Converts an ECDSA signature produced by a PKCS#11 device to standard ASNI X9-63-2005 format.
`long`	`create3DESKey(long sessionHandle)` Generates an DESede unwrapping key on the token.
`long[]`	`createDSASigningKeys(long sessionHandle, byte[] prime, byte[] subprime, byte[] base)` Generates an DSA signing key pair on the token.
`long[]`	`createDSASigningKeys(long sessionHandle, int strength)` Generates an DSA signing key pair on the token.
`long[]`	`createECSigningKeys(long sessionHandle, java.security.spec.ECParameterSpec ecDomainParams)` Generates an EC signing key pair on the token.
`long[]`	`createRSADecryptionKeys(long sessionHandle, int strength)` Generates an RSA encryption key pair on the token.
`long[]`	`createRSADecryptionKeys(long sessionHandle, int strength, byte[] publicExponent)` Generates an RSA decryption key pair on the token.
`long[]`	`createRSASigningKeys(long sessionHandle, int strength)` Generates an RSA signing key pair on the token.
`long[]`	`createRSASigningKeys(long sessionHandle, int strength, byte[] publicExponent)` Generates an RSA signing key pair on the token.
`long`	`createSymmetricKey(long sessionHandle, java.lang.String label, SymmetricKeyType keyType, int keySizeInBytes, boolean tokenObject, boolean extractable, boolean forEncrypt, boolean forMac)` Creates a symmetric key object of the given type, return the handle to it.
`byte[]`	`decrypt(long sessionHandle, byte[] ciphertext)` Decrypts encrypted data in a single part.
`byte[]`	`decryptFinal(long sessionHandle)` Finishes a multiple-part decryption operation.
`void`	`decryptInit(long sessionHandle, long mechanism, long keyHandle)` Initializes a decryption operation.
`void`	`decryptInit(long sessionHandle, long mechanism, long keyHandle, byte[] iv)` Initializes a decryption operation, passing in a byte array to use as an initialization vector with a symmetric cipher.
`byte[]`	`decryptUpdate(long sessionHandle, byte[] ciphertext)` Continues a multiple-part decryption operation, processing another encrypted data part.
`int`	`decryptUpdate(long sessionHandle, byte[] input, int inputOffset, int inputLength, byte[] output, int outputOffset)` Continues a multiple-part decryption operation, processing another encrypted data part and placing the result in a pre-allocated array.
`void`	`destroyObject(long sessionHandle, long objectHandle)` Destroys (deletes) an object on the token.
`byte[]`	`encrypt(long sessionHandle, byte[] plaintext)` Encrypts single-part data.
`byte[]`	`encryptFinal(long sessionHandle)` Finishes a multiple-part encryption operation.
`void`	`encryptInit(long sessionHandle, long mechanism, long keyHandle)` Initializes an encryption operation.
`void`	`encryptInit(long sessionHandle, long mechanism, long keyHandle, byte[] iv)` Initializes an encryption operation, passing in a byte array to use as an initialization vector with a symmetric cipher.
`byte[]`	`encryptUpdate(long sessionHandle, byte[] plaintext)` Continues a multiple-part encryption operation, processing another data part.
`int`	`encryptUpdate(long sessionHandle, byte[] input, int inputOffset, int inputLength, byte[] output, int outputOffset)` Continues a multiple-part encryption operation, processing another data part and placing the result in a pre-allocated array.
`static byte[]`	`formatEcdsaDigest(byte[] digest, JNIPKCS11.EcdsaDigestFormat format, java.security.spec.ECParameterSpec ecDomainParams)` Formats a digest using one of the supported ECDSA digest format methods.
`long[]`	`generateDSAKeyPair(long sessionHandle, java.lang.String label, boolean encryptAllowed, boolean signAllowed, byte[] prime, byte[] subprime, byte[] base)` Generates an DSA key pair on the token.
`long[]`	`generateECKeyPair(long sessionHandle, java.lang.String label, boolean encryptAllowed, boolean signAllowed, java.security.spec.ECParameterSpec ecDomainParams)` Generates an EC key pair on the token.
`long[]`	`generateRSAKeyPair(long sessionHandle, java.lang.String label, boolean encryptAllowed, boolean signAllowed, int strength, byte[] publicExponent)` Generates an RSA key pair on the token.
`SecretKey`	`get3DESKeySecure(long sessionHandle, long keyHandle)` Securely obtains a DESede secret key from a token using RSA wrapping.
`long[]`	`getAllDecryptionKeyHandles(long sessionHandle)` Obtains the object handles for a all decryption key objects stored on a token.
`long[]`	`getAllObjectHandles(long sessionHandle)` Obtains the object handles for all objects stored on a token.
`long`	`getByteArrayHandle(long sessionHandle, boolean isPrivate, java.lang.String label)` Obtains the object handle for a byte array object stored on a token.
`byte[]`	`getByteArrayObject(long sessionHandle, long objectHandle)` Obtains a byte array object from a token by reading the CKA_VALUE attribute an object.
`byte[]`	`getCertificate(long sessionHandle, long objectHandle)` Obtains a certificate object from a token by reading the CKA_VALUE attribute an object.
`long`	`getCertificateHandle(long sessionHandle, boolean isPrivate, java.lang.String label)` Obtains the object handle for a certificate object stored on a token.
`long`	`getCertificateHandle(long sessionHandle, boolean isPrivate, java.lang.String label, byte[] id)` Obtains the object handle for a certificate object stored on a token.
`long[]`	`getCertificateHandles(long sessionHandle, boolean isPrivate, java.lang.String label)` Obtains the object handles for a set certificate objects stored on a token.
`long`	`getDataObjectHandle(long sessionHandle, boolean isPrivate, java.lang.String label)` Obtains the object handle for a data object stored on a token.
`long[]`	`getDataObjectHandles(long sessionHandle, boolean isPrivate, java.lang.String label)` Obtains the object handles for a set data objects stored on a token.
`long[]`	`getDataObjectHandles(long sessionHandle, java.lang.String application)` Obtains the object handles for a set data objects stored on a token.
`long`	`getDecryptionKeyHandle(long sessionHandle, byte[] id)` Obtains the object handle for a decryption key object stored on a token.
`int`	`getDecryptUpdateLength(long sessionHandle, byte[] input, int inputLength)` When performing a multiple-part decryption operation, this call returns the number of bytes that would be required in an array passed to `decryptUpdate` to hold the output.
`java.security.spec.DSAParameterSpec`	`getDSAParams(long sessionHandle, long objectHandle)` Extracts the DSA parameters from a DSA key object stored on a PKCS#11 device.
`byte[]`	`getDSAPublicKeyY(long sessionHandle, long objectHandle)` Obtains the public value from a DSA key object stored on a token by reading the CKA_VALUE attribute of the object.
`java.security.spec.ECParameterSpec`	`getECDomainParams(long sessionHandle, long objectHandle)` Extracts the EC domain parameters from an EC key object stored on a PKCS#11 device.
`JNIPKCS11.EcdsaDigestFormat`	`getEcdsaDigestFormat(long slotId)` Determines the ECDSA digest format used by the PKCS#11 device.
`java.security.spec.ECPoint`	`getECPublicPoint(long sessionHandle, long objectHandle, java.security.spec.ECParameterSpec ecDomainParams)` Extracts the EC public point from an EC public key object stored on a PKCS#11 device.
`int`	`getEncryptUpdateLength(long sessionHandle, byte[] input, int inputLength)` When performing a multiple-part encryption operation, this call returns the number of bytes that would be required in an array passed to `encryptUpdate` to hold the output.
`Info`	`getInfo()` Returns general information about Cryptoki.
`java.lang.String`	`getKeyID(long sessionHandle, long objectHandle)` Obtains the key identifier from a key object on the token by reading the CKA_ID attribute of the object.
`int`	`getKeyType(long sessionHandle, long objectHandle)` Obtains the key type from a key object on the token by reading the CKA_KEY_TYPE attribute of the object.
`java.lang.String`	`getLabel(long sessionHandle, long objectHandle)` Obtains the label of an object on the token by reading the CKA_LABEL attribute of the object.
`MechanismInfo`	`getMechanismInfo(long slotID, long mechanismType)` Used to obtain information about a particular mechanism possibly supported by a token.
`MechanismList`	`getMechanismList(long slotID)` Used to obtain a list of mechanism types supported by a token.
`long`	`getOldSigningKeyHandle(long sessionHandle)` Obtains the object handle for an "old" signing key object stored on a token.
`long`	`getPrivateKeyHandle(long sessionHandle, byte[] id)` Obtains the object handle for a private key object stored on a token.
`long`	`getPrivateKeyHandle(long sessionHandle, java.lang.String label)` Obtains the object handle for a private key object stored on a token.
`long[]`	`getPrivateKeyHandles(long sessionHandle, java.lang.String label)` Obtains the object handles for a set private key objects stored on a token.
`byte[]`	`getRSAPrivateKeyModulus(long sessionHandle, long objectHandle)` Obtains the modulus from an RSA private key object stored on a token by reading the CKA_MODULUS attribute of the object.
`byte[]`	`getRSAPublicKeyModulus(long sessionHandle, long objectHandle)` Obtains the modulus from an RSA key object stored on a token by reading the CKA_MODULUS attribute of the object.
`byte[]`	`getRSAPublicKeyPublicExp(long sessionHandle, long objectHandle)` Obtains the public exponent from an RSA key object stored on a token by reading the CKA_PUBLIC_EXPONENT attribute of the object.
`int`	`getSecretKeyLength(long sessionHandle, long objectHandle)` Obtains the key length from a secret key object stored on a token by reading the CKA_VALUE_LEN attribute of the object.
`SessionInfo`	`getSessionInfo(long sessionHandle)` Obtains information about a session.
`long`	`getSigningKeyHandle(long sessionHandle)` Obtains the object handle for a signing key object stored on a token.
`int`	`getSigningKeyType(long sessionHandle, long objectHandle)` Obtains the key type from a signing key object on the token by reading the CKA_KEY_TYPE attribute of the object.
`SlotInfo`	`getSlotInfo(long slotID)` Obtains information about a particular slot in the system.
`SlotList`	`getSlotList(boolean tokenPresent)` Used to obtain a list of slots in the system.
`long`	`getStringHandle(long sessionHandle, boolean isPrivate, java.lang.String label)` Obtains the object handle for a string object stored on a token.
`java.lang.String`	`getStringObject(long sessionHandle, long objectHandle)` Obtains a string object from a token by reading the CKA_VALUE attribute an object.
`long`	`getTemporarySession(long slotID)` Gets a temporary session handle from the PKCS11 library, to be used when crypto operations may be executed by multiple threads simultaneously.
`TokenInfo`	`getTokenInfo(long slotID)` Obtains information about a particular token in the system.
`void`	`initPin(long sessionHandle, java.lang.String userPin)` Initializes the Normal User's PIN.
`void`	`initToken(long slotID, java.lang.String soPin, java.lang.String label)` Initializes a token.
`void`	`login(long sessionHandle, int userType, java.lang.String pin)` Logs a user into a token.
`void`	`logout(long sessionHandle)` Logs a user out from a token.
`long`	`openSession(long slotID, boolean readWrite)` This function opens a session between an application and a token in a particular slot.
`void`	`releaseTemporarySession(long slotID, long sessionHandle)` Releases a temporary session handle previously obtained through a call to `getTemporarySession(long)`.
`long`	`setByteArrayObject(long sessionHandle, boolean isPrivate, java.lang.String label, byte[] value)` Creates a new byte array object on a token (a token object).
`long`	`setByteArrayObject(long sessionHandle, boolean isPrivate, java.lang.String label, java.lang.String application, byte[] value)` Creates a new byte array object on a token (a token object), setting the CKA_APPLICATION attribute.
`long`	`setCertificate(long sessionHandle, boolean isToken, boolean isPrivate, boolean isModifiable, java.lang.String label, byte[] subject, byte[] id, byte[] issuer, byte[] serialNumber, byte[] value)` Creates a new X.509 public key certificate object on a token (a token object).
`long`	`setCertificate(long sessionHandle, boolean isPrivate, java.lang.String label, byte[] subject, byte[] value)` Creates a new X.509 public key certificate object on a token (a token object).
`long`	`setCertificate(long sessionHandle, boolean isPrivate, java.lang.String label, byte[] id, X509Certificate certificate)` Creates a new X.509 public key certificate object on a token (a token object).
`long`	`setCertificate(long sessionHandle, boolean isPrivate, java.lang.String label, X509Certificate certificate)` Creates a new X.509 public key certificate object on a token (a token object).
`long`	`setDSAPrivateKey(long sessionHandle, java.lang.String label, byte[] id, boolean encryptAllowed, boolean signAllowed, byte[] prime, byte[] subprime, byte[] base, byte[] value)` Creates a new DSA private key object on a token (a token object).
`long`	`setDSAPrivateKeySecure(long sessionHandle, long wrappingKeyHandle, SecretKey wrappingKey, java.lang.String label, byte[] id, boolean encryptAllowed, boolean signAllowed, byte[] privateKey)` Creates a new DSA private key object on a token by transferring it to the token securely.
`long`	`setDSASigningKey(long sessionHandle, byte[] prime, byte[] subprime, byte[] base, byte[] value)` Creates a new DSA signing key object on a token (a token object).
`long`	`setECPrivateKey(long sessionHandle, java.lang.String label, byte[] id, boolean encryptAllowed, boolean signAllowed, byte[] d, java.security.spec.ECParameterSpec ecDomainParams)` Creates a new EC private key object on a token (a token object).
`long`	`setECPrivateKeySecure(long sessionHandle, long wrappingKeyHandle, SecretKey wrappingKey, java.lang.String label, byte[] id, boolean encryptAllowed, boolean signAllowed, byte[] privateKey)` Creates a new EC private key object on a token by transferring it to the token securely.
`long`	`setIntObject(long sessionHandle, boolean isPrivate, java.lang.String label, int value)` Creates a new integer object on a token (a token object).
`void`	`setKeyID(long sessionHandle, long objectHandle, java.lang.String keyId)` Sets the key identifier of a key object that already exists on the token by writing the CKA_ID attribute of the object.
`void`	`setNewLabel(long sessionHandle, long objectHandle, java.lang.String label)` Sets the label of an object that already exists on the token by writing the CKA_LABEL attribute of the object.
`void`	`setPin(long sessionHandle, java.lang.String oldPin, java.lang.String newPin)` Modifies the PIN of the user currently logged in.
`long`	`setRSAPrivateKey(long sessionHandle, java.lang.String label, byte[] id, boolean encryptAllowed, boolean signAllowed, byte[] modulus, byte[] publicExponent, byte[] privateExponent, byte[] prime1, byte[] prime2, byte[] exponent1, byte[] exponent2, byte[] coefficient)` Creates a new RSA private key object on a token (a token object).
`long`	`setRSAPrivateKeySecure(long sessionHandle, long wrappingKeyHandle, SecretKey wrappingKey, java.lang.String label, byte[] id, boolean encryptAllowed, boolean signAllowed, byte[] privateKey)` Creates a new RSA private key object on a token by transferring it to the token securely.
`long`	`setRSASigningKey(long sessionHandle, byte[] modulus, byte[] publicExponent, byte[] privateExponent, byte[] prime1, byte[] prime2, byte[] exponent1, byte[] exponent2, byte[] coefficient)` Creates a new RSA signing key object on a token (a token object).
`long`	`setStringObject(long sessionHandle, boolean isPrivate, java.lang.String label, java.lang.String value)` Creates a new string object on a token (a token object).
`long`	`setStringObject(long sessionHandle, boolean isPrivate, java.lang.String label, java.lang.String application, java.lang.String value)` Creates a new string object on a token (a token object).
`byte[]`	`sign(long sessionHandle, byte[] data)` Signs data in a single part, where the signature is an appendix to the data.
`byte[]`	`signFinal(long sessionHandle)` Finishes a multiple-part signature operation, returning the signature.
`void`	`signInit(long sessionHandle, long mechanism, long keyHandle)` Initializes a signature operation, where the signature is an appendix to the data.
`void`	`SignInitWithRSAPSSParameters(long sessionHandle, long mechanism, long keyHandle, long hashAlg, long mgfType, long saltLength)` Initializes a signature operation, where the signature is an appendix to the data.
`void`	`signUpdate(long sessionHandle, byte[] part)` Continues a multiple-part signature operation, processing another data part.
`void`	`signUpdate(long sessionHandle, byte[] part, int offset, int length)` Continues a multiple-part signature operation, processing another data part.
`long`	`unwrapDecryptionKey(long sessionHandle, long wrappingKeyHandle, byte[] wrappedKey, byte[] id)` Unwraps an RSA decryption key on the token using the specified DESede secret key.
`long`	`unwrapDSAPrivateKey(long sessionHandle, long wrappingKeyHandle, java.lang.String label, byte[] id, boolean encryptAllowed, boolean signAllowed, byte[] wrappedKey)` Unwraps an DSA private key on the token using the specified DESede secret key.
`long`	`unwrapECPrivateKey(long sessionHandle, long wrappingKeyHandle, java.lang.String label, byte[] id, boolean encryptAllowed, boolean signAllowed, byte[] wrappedKey)` Unwraps an EC private key on the token using the specified DESede secret key.
`long`	`unwrapRSAPrivateKey(long sessionHandle, long wrappingKeyHandle, java.lang.String label, byte[] id, boolean encryptAllowed, boolean signAllowed, byte[] wrappedKey)` Unwraps an RSA private key on the token using the specified DESede secret key.
`boolean`	`verify(long sessionHandle, byte[] data, byte[] signature)` Verifies a signature in a single-part operation, where the signature is an appendix to the data.
`boolean`	`verifyFinal(long sessionHandle, byte[] signature)` Finishes a multiple-part verification operation, checking the signature.
`void`	`verifyInit(long sessionHandle, long mechanism, long keyHandle)` Initializes a verification operation, where the signature is an appendix to the data.
`void`	`verifyUpdate(long sessionHandle, byte[] part)` Continues a multiple-part verification operation, processing another data part.
`byte[]`	`wrapKeyRSA(long sessionHandle, long keyHandle, byte[] modulus, byte[] publicExponent)` Wraps a DESede key on the token with the provided RSA public key.

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Field Detail
  - CKK_RSA
```
public static final int CKK_RSA
```
    Indicator for the RSA key-type.
    
    Since:
    
    7.0
    
    See Also:
    Constant Field Values
  - CKK_DSA
```
public static final int CKK_DSA
```
    Indicator for the DSA key-type.
    
    Since:
    
    7.0
    
    See Also:
    Constant Field Values
  - CKK_EC
```
public static final int CKK_EC
```
    Indicator for the EC key-type.
    
    Since:
    
    7.2 SP2
    
    See Also:
    Constant Field Values
  - CKU_SO
```
public static final int CKU_SO
```
    Indicator for a Security Officer user.
    
    Since:
    
    7.0
    
    See Also:
    Constant Field Values
  - CKU_USER
```
public static final int CKU_USER
```
    Indicator for a Normal user.
    
    Since:
    
    7.0
    
    See Also:
    Constant Field Values
  - CKG_MGF1_SHA1
```
public static final long CKG_MGF1_SHA1
```
    Indicator for the MGF1 with SHA1 mask generation function.
    
    Since:
    
    7.2 SP2
    
    See Also:
    Constant Field Values
  - CKG_MGF1_SHA256
```
public static final long CKG_MGF1_SHA256
```
    Indicator for the MGF1 with SHA256 mask generation function.
    
    Since:
    
    7.2 SP2
    
    See Also:
    Constant Field Values
  - CKG_MGF1_SHA384
```
public static final long CKG_MGF1_SHA384
```
    Indicator for the MGF1 with SHA384 mask generation function.
    
    Since:
    
    7.2 SP2
    
    See Also:
    Constant Field Values
  - CKG_MGF1_SHA512
```
public static final long CKG_MGF1_SHA512
```
    Indicator for the MGF1 with SHA512 mask generation function.
    
    Since:
    
    7.2 SP2
    
    See Also:
    Constant Field Values
  - CKG_MGF1_SHA224
```
public static final long CKG_MGF1_SHA224
```
    Indicator for the MGF1 with SHA224 mask generation function.
    
    Since:
    
    7.2 SP2
    
    See Also:
    Constant Field Values
- Method Detail
  - getInfo
```
public Info getInfo()
             throws UserFatalException
```
    Returns general information about Cryptoki.
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Returns:
    [FIPS 140-2 data output] general information about Cryptoki
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs accessing the general information about Cryptoki
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getSlotList
```
public SlotList getSlotList(boolean tokenPresent)
                     throws UserFatalException
```
    Used to obtain a list of slots in the system.
    The set of slots accessible through a Cryptoki library is fixed when the PKCS11 API is loaded and initialized. If an application calls getSlotList, and then the user connects a new hardware device, the new device will not appear as a new slot if getSlotList is called again.
    
    To recognize the new device, the PKCS11 API must be loaded and initialized again. To be able to load an initialized successfully, the PKCS11 API must first be unloaded an finalized. Even if the PKCS11 API is loaded and initialized successfully, the new device might not be recognized. On some platforms, it might be necessary to restart the entire system.
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    tokenPresent - [FIPS 140-2 control input] indicates whether the list obtained includes only those slots with a token present ( true), or all slots (false)
    
    Returns:
    [FIPS 140-2 data output] a list of slots in the system
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining a list of slots
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getSlotInfo
```
public SlotInfo getSlotInfo(long slotID)
                     throws UserFatalException
```
    Obtains information about a particular slot in the system.
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    slotID - [FIPS 140-2 control input] the ID of the slot
    
    Returns:
    [FIPS 140-2 data output] information about the slot
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining information about the slot
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getTokenInfo
```
public TokenInfo getTokenInfo(long slotID)
                       throws UserFatalException
```
    Obtains information about a particular token in the system.
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    slotID - [FIPS 140-2 control input] the ID of the token's slot
    
    Returns:
    [FIPS 140-2 data output] information about a token
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining information about a token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getMechanismList
```
public MechanismList getMechanismList(long slotID)
                               throws UserFatalException
```
    Used to obtain a list of mechanism types supported by a token.
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    slotID - [FIPS 140-2 control input] the ID of the token's slot
    
    Returns:
    [FIPS 140-2 data output] a list of mechanism types supported
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining a list of mechanism types
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getMechanismInfo
```
public MechanismInfo getMechanismInfo(long slotID,
                             long mechanismType)
                               throws UserFatalException
```
    Used to obtain information about a particular mechanism possibly supported by a token.
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    slotID - [FIPS 140-2 control input] the ID of the token's slot
    mechanismType - [FIPS 140-2 control input] the type of mechanism
    
    Returns:
    [FIPS 140-2 data output] information about the mechanism
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining information about the mechanism
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - initToken
```
public void initToken(long slotID,
             java.lang.String soPin,
             java.lang.String label)
               throws UserFatalException
```
    Initializes a token.
    If the token has not been initialized (because it is new from the factory, for example), the soPin parameter becomes the initial value of the SO PIN. If the token is being reinitialized, the soPin parameter is checked against the existing SO PIN to authorize the initialization operation. In both cases, the SO PIN is set to the value soPin after the function completes successfully.
    
    When a token is initialized, all objects that can be destroyed are destroyed (except "indestructible" objects such as keys built into the token). Also, access by the normal user is disabled until the SO sets the normal user's PIN.
    
    A token cannot be initialized if Cryptoki detects that any application has an open session. When a call to this function is made under such circumstances, the call fails with error CKR_SESSION_EXISTS.
    
    If the token has a "protected authentication path", as indicated by the CKF_PROTECTED_AUTHENTICATION_PATH flag in the CK_TOKEN_INFO being set; then there is some other way for a user to be authenticated to the token without sending a PIN through the Cryptoki library. One such possibility is that the user enters a PIN on a PIN-pad connected to the token itself. To initialize token a token with such a protected authentication path, the soPin parameter must be set to null. Then, during the execution of this API, the Security Officer must enter their PIN through the protected authentication path.
    FIPS 140-2:
    
    FIPS Service: Initialization
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    status output interface (exceptions)
    Parameters:
    slotID - [FIPS 140-2 control input] the ID of the token's slot
    soPin - [FIPS 140-2 data input] [FIPS 140-2 CSP] the the Security Officers initial PIN
    label - [FIPS 140-2 data input] a label for the token
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while initializing the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - initPin
```
public void initPin(long sessionHandle,
           java.lang.String userPin)
             throws UserFatalException
```
    Initializes the Normal User's PIN.
    This method can be called only in the R/W SO Functions state. An attempt to call it from a session in any other state fails with error CKR_USER_NOT_LOGGED_IN.
    
    If the token has a "protected authentication path", as indicated by the CKF_PROTECTED_AUTHENTICATION_PATH flag in the CK_TOKEN_INFO being set; then there is some other way for a user to be authenticated to the token without sending a PIN through the Cryptoki library. One such possibility is that the user enters a PIN on a PIN-pad connected to the token itself. To initialize the Normal User's PIN on a token with such a protected authentication path, the userPin parameter must be set to null. Then, during the execution of this API, the Security Officer must enter the Normal User's PIN through the protected authentication path.
    FIPS 140-2:
    
    FIPS Service: Initialization
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    userPin - [FIPS 140-2 data input] [FIPS 140-2 CSP] the normal user's PIN
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while initializing the normal user's PIN
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - setPin
```
public void setPin(long sessionHandle,
          java.lang.String oldPin,
          java.lang.String newPin)
            throws UserFatalException
```
    Modifies the PIN of the user currently logged in.
    This method can be called only in the R/W SO Functions or R/W User Functions states. An attempt to call it from a session in any other state fails with error CKR_SESSION_READ_ONLY.
    
    If the token has a "protected authentication path", as indicated by the CKF_PROTECTED_AUTHENTICATION_PATH flag in the CK_TOKEN_INFO being set; then there is some other way for a user to be authenticated to the token without sending a PIN through the Cryptoki library. One such possibility is that the user enters a PIN on a PIN-pad connected to the token itself. To modify the current user's PIN on a token with such a protected authentication path, the oldPin and newPin parameters must be set to null. Then, during the execution of this API, the current user must enter the old PIN and the new PIN through the protected authentication path.
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    oldPin - [FIPS 140-2 data input] [FIPS 140-2 CSP] the user's old PIN
    newPin - [FIPS 140-2 data input] [FIPS 140-2 CSP] the user's new PIN
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while setting the user's PIN
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - openSession
```
public long openSession(long slotID,
               boolean readWrite)
                 throws UserFatalException
```
    This function opens a session between an application and a token in a particular slot.
    There might be a limit on the number of concurrent sessions an application can have with the token, which may depend on whether the session is read-only or read/write. An attempt to open a session that does not succeed because there are too many existing sessions of some type, will fail with error CKR_SESSION_COUNT.
    
    If the token is write-protected, then only read-only sessions can be opened with it. If the application calling openSession already has a read/write SO session open with the token, any attempt to open a read-only session with the token fails with error code CKR_SESSION_READ_WRITE_SO_EXISTS.
    FIPS 140-2:
    
    FIPS Service: Non-Cryptographic Operation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    slotID - [FIPS 140-2 control input] the slot's ID
    readWrite - [FIPS 140-2 control input] indicates the type of session( read/write or read-only )
    
    Returns:
    [FIPS 140-2 data output] the session's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while opening the session
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - closeSession
```
public void closeSession(long sessionHandle)
                  throws UserFatalException
```
    Closes a session between an application and a token.
    If this function is successful and it closes the last session between the application and the token, the login state of the token for the application returns to public sessions. Any new sessions with the token opened by the application will be either read-only Public or read/write Public sessions.
    FIPS 140-2:
    
    FIPS Service: Non-Cryptographic Operation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while closing the session
  - closeAllSessions
```
public void closeAllSessions(long slotID)
                      throws UserFatalException
```
    Closes all sessions an application has with a token.
    After successful execution of this function, the login state of the token for the application returns to public sessions. Any new sessions to the token opened by the application will be either read-only Public or read/write Public sessions.
    FIPS 140-2:
    
    FIPS Service: Non-Cryptographic Operation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    status output interface (exceptions)
    Parameters:
    slotID - [FIPS 140-2 control input] specifies the token's slot
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while closing all the sessions
  - getSessionInfo
```
public SessionInfo getSessionInfo(long sessionHandle)
                           throws UserFatalException
```
    Obtains information about a session.
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    
    Returns:
    [FIPS 140-2 data output] information about the session
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining information about the session
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - login
```
public void login(long sessionHandle,
         int userType,
         java.lang.String pin)
           throws UserFatalException,
                  UserAlreadyLoggedInException
```
    Logs a user into a token.
    Depending on the user type, if the call succeeds, each of the application's sessions will enter either the R/W SO Functions state, the R/W User Functions state, or the R/O User Functions' state.
    
    If the application calling login has a read-only session open with the token, it will be unable to log the SO into a session. An attempt to do this will result in the error code CKR_SESSION_READ_ONLY_EXISTS.
    
    If the token has a "protected authentication path", as indicated by the CKF_PROTECTED_AUTHENTICATION_PATH flag in the CK_TOKEN_INFO being set; then there is some other way for a user to be authenticated to the token without sending a PIN through the Cryptoki library. One such possibility is that the user enters a PIN on a PIN-pad connected to the token itself. To login to a token with such a protected authentication path, the pin parameter must be set to null. Then, during the execution of this API, the user attempting to login must enter their PIN through the protected authentication path.
    FIPS 140-2:
    
    FIPS Service: Non-Cryptographic Operation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user officer role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] a session handle
    userType - [FIPS 140-2 control input] the user type ( 0 = security officer, 1 = user )
    pin - [FIPS 140-2 data input] [FIPS 140-2 CSP] the user's PIN
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while logging in the user
    
    UserAlreadyLoggedInException - [FIPS 140-2 status output] thrown if the user is already logged in
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - logout
```
public void logout(long sessionHandle)
            throws UserFatalException
```
    Logs a user out from a token.
    Depending on the current user type, if the call succeeds, each of the application's sessions will enter either the R/W Public Session state or the R/O Public Session state.
    
    When logout successfully executes, any of the application's handles to private objects become invalid (even if a user is later logged back into the token, the handles remain invalid).
    FIPS 140-2:
    
    FIPS Service: Non-Cryptographic Operation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while logging out the user
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - setStringObject
```
public long setStringObject(long sessionHandle,
                   boolean isPrivate,
                   java.lang.String label,
                   java.lang.String value)
                     throws UserFatalException
```
    Creates a new string object on a token (a token object).
    The Data object is created with the following attribute values:
```
      CKA_CLASS =         CKO_DATA
      CKA_TOKEN =         TRUE
      CKA_PRIVATE =       <CODE>isPrivate</CODE>
      CKA_MODIFIABLE =    default
      CKA_LABEL =         <CODE>label</CODE>
      CKA_APPLICATION =   default
      CKA_VALUE =         <CODE>value</CODE>
 
```
    Note:
    
    Unless the normal user is logged in, only public objects can be created
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    isPrivate - [FIPS 140-2 control input] indicates whether the object is created in the public or private memory on the token
    label - [FIPS 140-2 data input] the object's label on the token — a description of the object
    value - [FIPS 140-2 data input] the string value
    
    Returns:
    [FIPS 140-2 data output] the string object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while creating the string object on the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - setStringObject
```
public long setStringObject(long sessionHandle,
                   boolean isPrivate,
                   java.lang.String label,
                   java.lang.String application,
                   java.lang.String value)
                     throws UserFatalException
```
    Creates a new string object on a token (a token object).
    The Data object is created with the following attribute values:
```
      CKA_CLASS =         CKO_DATA
      CKA_TOKEN =         TRUE
      CKA_PRIVATE =       <CODE>isPrivate</CODE>
      CKA_MODIFIABLE =    default
      CKA_LABEL =         <CODE>label</CODE>
      CKA_APPLICATION =   <CODE>application</CODE>
      CKA_VALUE =         <CODE>value</CODE>
 
```
    Note:
    
    Unless the normal user is logged in, only public objects can be created
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    isPrivate - [FIPS 140-2 control input] indicates whether the object is created in the public or private memory on the token
    label - [FIPS 140-2 data input] the object's label on the token — a description of the object
    application - [FIPS 140-2 data input] an identifier for the application that created the object (OPTIONAL)
    value - [FIPS 140-2 data input] the string value
    
    Returns:
    [FIPS 140-2 data output] the string object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while creating the string object on the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - setIntObject
```
public long setIntObject(long sessionHandle,
                boolean isPrivate,
                java.lang.String label,
                int value)
                  throws UserFatalException
```
    Creates a new integer object on a token (a token object).
    The Data object is created with the following attribute values:
```
      CKA_CLASS =         CKO_DATA
      CKA_TOKEN =         TRUE
      CKA_PRIVATE =       <CODE>isPrivate</CODE>
      CKA_MODIFIABLE =    default
      CKA_LABEL =         <CODE>label</CODE>
      CKA_APPLICATION =   default
      CKA_VALUE =         <CODE>value</CODE>
 
```
    Note:
    
    Unless the normal user is logged in, only public objects can be created
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    isPrivate - [FIPS 140-2 control input] indicates whether the object is created in the public or private memory on the token
    label - [FIPS 140-2 data input] the object's label on the token — a description of the object
    value - [FIPS 140-2 data input] the integer value
    
    Returns:
    [FIPS 140-2 data output] the integer object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while creating the integer object on the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - setByteArrayObject
```
public long setByteArrayObject(long sessionHandle,
                      boolean isPrivate,
                      java.lang.String label,
                      byte[] value)
                        throws UserFatalException
```
    Creates a new byte array object on a token (a token object).
    The Data object is created with the following attribute values:
```
      CKA_CLASS =         CKO_DATA
      CKA_TOKEN =         TRUE
      CKA_PRIVATE =       <CODE>isPrivate</CODE>
      CKA_MODIFIABLE =    default
      CKA_LABEL =         <CODE>label</CODE>
      CKA_APPLICATION =   default
      CKA_VALUE =         <CODE>value</CODE>
 
```
    Note:
    
    Unless the normal user is logged in, only public objects can be created
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    isPrivate - [FIPS 140-2 control input] indicates whether the object is created in the public or private memory on the token
    label - [FIPS 140-2 data input] the object's label on the token — a description of the object
    value - [FIPS 140-2 data input] the byte array
    
    Returns:
    [FIPS 140-2 data output] the byte array object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while creating the byte array object on the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - setByteArrayObject
```
public long setByteArrayObject(long sessionHandle,
                      boolean isPrivate,
                      java.lang.String label,
                      java.lang.String application,
                      byte[] value)
                        throws UserFatalException
```
    Creates a new byte array object on a token (a token object), setting the CKA_APPLICATION attribute.
    The Data object is created with the following attribute values:
```
      CKA_CLASS =         CKO_DATA
      CKA_TOKEN =         TRUE
      CKA_PRIVATE =       <CODE>isPrivate</CODE>
      CKA_MODIFIABLE =    default
      CKA_LABEL =         <CODE>label</CODE>
      CKA_APPLICATION =   <CODE>application</CODE>
      CKA_VALUE =         <CODE>value</CODE>
 
```
    Note:
    
    Unless the normal user is logged in, only public objects can be created
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    isPrivate - [FIPS 140-2 control input] indicates whether the object is created in the public or private memory on the token
    label - [FIPS 140-2 data input] the object's label on the token — a description of the object
    application - [FIPS 140-2 data input] an identifier for the application that created the object (OPTIONAL)
    value - [FIPS 140-2 data input] the byte array
    
    Returns:
    [FIPS 140-2 data output] the byte array object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while creating the byte array object on the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - setCertificate
```
public long setCertificate(long sessionHandle,
                  boolean isPrivate,
                  java.lang.String label,
                  X509Certificate certificate)
                    throws UserFatalException
```
    Creates a new X.509 public key certificate object on a token (a token object).
    The Certificate object is created with the following attribute values:
```
      CKA_CLASS =             CKO_CERTIFICATE
      CKA_TOKEN =             TRUE
      CKA_PRIVATE =           <CODE>isPrivate</CODE>
      CKA_MODIFIABLE =        default
      CKA_LABEL =             <CODE>label</CODE>
      CKA_CERTIFICATE_TYPE =  CKC_X_509
      CKA_SUBJECT =           <CODE>certificate.getSubjectDN()</CODE>
      CKA_ID =                default
      CKA_ISSUER =            default
      CKA_SERIAL_NUMBER =     default
      CKA_VALUE =             <CODE>certificate.getEncoded()</CODE>
 
```
    Note:
    
    Unless the normal user is logged in, only public objects can be created
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    isPrivate - [FIPS 140-2 control input] indicates whether the object is created in the public or private memory on the token
    label - [FIPS 140-2 data input] the object's label on the token — a description of the object
    certificate - [FIPS 140-2 data input] the certificate
    
    Returns:
    [FIPS 140-2 data output] the certificate object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while creating the certificate object on the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - setCertificate
```
public long setCertificate(long sessionHandle,
                  boolean isPrivate,
                  java.lang.String label,
                  byte[] id,
                  X509Certificate certificate)
                    throws UserFatalException
```
    Creates a new X.509 public key certificate object on a token (a token object).
    The Certificate object is created with the following attribute values:
```
      CKA_CLASS =             CKO_CERTIFICATE
      CKA_TOKEN =             TRUE
      CKA_PRIVATE =           <CODE>isPrivate</CODE>
      CKA_MODIFIABLE =        default
      CKA_LABEL =             <CODE>label</CODE>
      CKA_CERTIFICATE_TYPE =  CKC_X_509
      CKA_SUBJECT =           <CODE>certificate.getSubjectDN()</CODE>
      CKA_ID =                <CODE>id</CODE>
      CKA_ISSUER =            default
      CKA_SERIAL_NUMBER =     default
      CKA_VALUE =             <CODE>certificate.getEncoded()</CODE>
 
```
    Note:
    
    Unless the normal user is logged in, only public objects can be created
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    isPrivate - [FIPS 140-2 control input] indicates whether the object is created in the public or private memory on the token
    label - [FIPS 140-2 data input] the object's label on the token — a description of the object
    id - [FIPS 140-2 data input] key identifier for the certificate (OPTIONAL)
    certificate - [FIPS 140-2 data input] the certificate
    
    Returns:
    [FIPS 140-2 data output] the certificate object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while creating the certificate object on the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - setCertificate
```
public long setCertificate(long sessionHandle,
                  boolean isPrivate,
                  java.lang.String label,
                  byte[] subject,
                  byte[] value)
                    throws UserFatalException
```
    Creates a new X.509 public key certificate object on a token (a token object).
    The Certificate object is created with the following attribute values:
```
      CKA_CLASS =             CKO_CERTIFICATE
      CKA_TOKEN =             TRUE
      CKA_PRIVATE =           <CODE>isPrivate</CODE>
      CKA_MODIFIABLE =        default
      CKA_LABEL =             <CODE>label</CODE>
      CKA_CERTIFICATE_TYPE =  CKC_X_509
      CKA_SUBJECT =           <CODE>subject</CODE>
      CKA_ID =                default
      CKA_ISSUER =            default
      CKA_SERIAL_NUMBER =     default
      CKA_VALUE =             <CODE>value</CODE>
 
```
    Note:
    
    Unless the normal user is logged in, only public objects can be created
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    isPrivate - [FIPS 140-2 control input] indicates whether the object is created in the public or private memory on the token
    label - [FIPS 140-2 data input] the object's label on the token — a description of the object
    subject - [FIPS 140-2 data input] DER-encoding of the certificate subject name
    value - [FIPS 140-2 data input] the BER encoding of the certificate
    
    Returns:
    [FIPS 140-2 data output] the certificate object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while creating the certificate object on the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - setCertificate
```
public long setCertificate(long sessionHandle,
                  boolean isToken,
                  boolean isPrivate,
                  boolean isModifiable,
                  java.lang.String label,
                  byte[] subject,
                  byte[] id,
                  byte[] issuer,
                  byte[] serialNumber,
                  byte[] value)
                    throws UserFatalException
```
    Creates a new X.509 public key certificate object on a token (a token object).
    The Certificate object is created with the following attribute values:
```
      CKA_CLASS =             CKO_CERTIFICATE
      CKA_TOKEN =             <CODE>isToken</CODE>
      CKA_PRIVATE =           <CODE>isPrivate</CODE>
      CKA_MODIFIABLE =        default
      CKA_LABEL =             <CODE>label</CODE>
      CKA_CERTIFICATE_TYPE =  CKC_X_509
      CKA_SUBJECT =           <CODE>subject</CODE>
      CKA_ID =                <CODE>id</CODE>
      CKA_ISSUER =            <CODE>issuer</CODE>
      CKA_SERIAL_NUMBER =     <CODE>serialNumber</CODE>
      CKA_VALUE =             <CODE>value</CODE>
 
```
    Note:
    
    Unless the normal user is logged in, only public objects can be created
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    isToken - [FIPS 140-2 control input] indicates if the object is to be created as a token object or a session object
    isPrivate - [FIPS 140-2 control input] indicates whether the object is created in the public or private memory on the token
    isModifiable - [FIPS 140-2 control input] this value is ignored and the default value is used instead because some vendors do not support the setting of this value
    label - [FIPS 140-2 data input] the object's label on the token — a description of the object
    subject - [FIPS 140-2 data input] DER-encoding of the certificate subject name
    id - [FIPS 140-2 data input] key identifier for the certificate
    issuer - [FIPS 140-2 data input] DER-encoding of the certificate issuer name
    serialNumber - [FIPS 140-2 data input] DER encoding of the certificate serial number
    value - [FIPS 140-2 data input] the BER encoding of the certificate
    
    Returns:
    [FIPS 140-2 data output] the certificate object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while creating the certificate object on the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - setRSASigningKey
```
public long setRSASigningKey(long sessionHandle,
                    byte[] modulus,
                    byte[] publicExponent,
                    byte[] privateExponent,
                    byte[] prime1,
                    byte[] prime2,
                    byte[] exponent1,
                    byte[] exponent2,
                    byte[] coefficient)
                      throws UserFatalException
```
    Creates a new RSA signing key object on a token (a token object).
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 "Signing Key"
      CKA_KEY_TYPE =              CKK_RSA
      CKA_ID =                    default
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 false
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               false
      CKA_SIGN =                  true
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_MODULUS =               <CODE>modulus</CODE>
      CKA_PUBLIC_EXPONENT =       <CODE>publicExponent</CODE>
      CKA_PRIVATE_EXPONENT =      <CODE>privateExponent</CODE>
      CKA_PRIME_1 =               <CODE>prime1</CODE>
      CKA_PRIME_2 =               <CODE>prime2</CODE>
      CKA_EXPONENT_1 =            <CODE>exponent1</CODE>
      CKA_EXPONENT_2 =            <CODE>exponent2</CODE>
      CKA_COEFFICIENT =           <CODE>coefficient</CODE>
 
```
    Note:
    
    Because this object is created as a private object, the normal user must be logged in. Because the object is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    
    When if operating in FIPS mode, this API cannot be used; plain-text private keys cannot be transerred from cryptographic module in FIPS mode
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    modulus - [FIPS 140-2 data input] the key's modulus (n)
    publicExponent - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's public exponent (e)
    privateExponent - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's private exponent (d)
    prime1 - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's first prime (p)
    prime2 - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's second prime (q)
    exponent1 - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's first exponent (d mod p-1)
    exponent2 - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's second exponent (d mod q-1)
    coefficient - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's coefficient (1/q mod p)
    
    Returns:
    [FIPS 140-2 data output] the RSA signing key object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while creating the RSA signing key object on the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - setDSASigningKey
```
public long setDSASigningKey(long sessionHandle,
                    byte[] prime,
                    byte[] subprime,
                    byte[] base,
                    byte[] value)
                      throws UserFatalException
```
    Creates a new DSA signing key object on a token (a token object).
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 <CODE>Signing Key</CODE>
      CKA_KEY_TYPE =              CKK_DSA
      CKA_ID =                    default
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 false
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               false
      CKA_SIGN =                  true
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_PRIME =                 <CODE>prime</CODE>
      CKA_SUBPRIME =              <CODE>subPrime</CODE>
      CKA_BASE =                  <CODE>base</CODE>
      CKA_VALUE =                 <CODE>value</CODE>
 
```
    Note:
    
    Because this object is created as a private object, the normal user must be logged in. Because the object is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    
    When if operating in FIPS mode, this API cannot be used; plain-text private keys cannot be transferred from cryptographic module in FIPS mode
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    prime - [FIPS 140-2 data input] the key's prime (p)
    subprime - [FIPS 140-2 data input] the key's sub-prime (q)
    base - [FIPS 140-2 data input] the key's base (g)
    value - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's private value (x)
    
    Returns:
    [FIPS 140-2 data output] the DSA signing key object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while creating the DSA signing key object on the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - addDecryptionKey
```
public long addDecryptionKey(long sessionHandle,
                    byte[] id,
                    byte[] modulus,
                    byte[] publicExponent,
                    byte[] privateExponent,
                    byte[] prime1,
                    byte[] prime2,
                    byte[] exponent1,
                    byte[] exponent2,
                    byte[] coefficient)
                      throws UserFatalException
```
    Creates a new RSA decryption key object on a token (a token object).
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 <CODE>Private Keys</CODE>
      CKA_KEY_TYPE =              CKK_RSA
      CKA_ID =                    <CODE>id</CODE>
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 false
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               true
      CKA_SIGN =                  false
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_MODULUS =               <CODE>modulus</CODE>
      CKA_PUBLIC_EXPONENT =       <CODE>publicExponent</CODE>
      CKA_PRIVATE_EXPONENT =      <CODE>privateExponent</CODE>
      CKA_PRIME_1 =               <CODE>prime1</CODE>
      CKA_PRIME_2 =               <CODE>prime2</CODE>
      CKA_EXPONENT_1 =            <CODE>exponent1</CODE>
      CKA_EXPONENT_2 =            <CODE>exponent2</CODE>
      CKA_COEFFICIENT =           <CODE>coefficient</CODE>
 
```
    Note:
    
    Because this object is created as a private object, the normal user must be logged in. Because the object is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    
    When if operating in FIPS mode, this API cannot be used; plain-text private keys cannot be transferred from cryptographic module in FIPS mode
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    id - [FIPS 140-2 data input] key identifier for the private key
    modulus - [FIPS 140-2 data input] the key's modulus (n)
    publicExponent - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's public exponent (e)
    privateExponent - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's private exponent (d)
    prime1 - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's first prime (p)
    prime2 - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's second prime (q)
    exponent1 - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's first exponent (d mod p-1)
    exponent2 - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's second exponent (d mod q-1)
    coefficient - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's coefficient (1/q mod p)
    
    Returns:
    [FIPS 140-2 data output] the RSA decryption key object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while creating the RSA decryption key object on the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - setRSAPrivateKey
```
public long setRSAPrivateKey(long sessionHandle,
                    java.lang.String label,
                    byte[] id,
                    boolean encryptAllowed,
                    boolean signAllowed,
                    byte[] modulus,
                    byte[] publicExponent,
                    byte[] privateExponent,
                    byte[] prime1,
                    byte[] prime2,
                    byte[] exponent1,
                    byte[] exponent2,
                    byte[] coefficient)
                      throws UserFatalException
```
    Creates a new RSA private key object on a token (a token object).
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 <CODE>label</CODE>
      CKA_KEY_TYPE =              CKK_RSA
      CKA_ID =                    <CODE>id</CODE>
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 false
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               <CODE>encryptAllowed</CODE>
      CKA_SIGN =                  <CODE>signAllowed</CODE>
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_MODULUS =               <CODE>modulus</CODE>
      CKA_PUBLIC_EXPONENT =       <CODE>publicExponent</CODE>
      CKA_PRIVATE_EXPONENT =      <CODE>privateExponent</CODE>
      CKA_PRIME_1 =               <CODE>prime1</CODE>
      CKA_PRIME_2 =               <CODE>prime2</CODE>
      CKA_EXPONENT_1 =            <CODE>exponent1</CODE>
      CKA_EXPONENT_2 =            <CODE>exponent2</CODE>
      CKA_COEFFICIENT =           <CODE>coefficient</CODE>
 
```
    Note:
    
    Because this object is created as a private object, the normal user must be logged in. Because the object is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    
    When if operating in FIPS mode, this API cannot be used; plain-text private keys cannot be transferred from cryptographic module in FIPS mode
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    label - [FIPS 140-2 data input] the object's label on the token — a description of the object
    id - [FIPS 140-2 data input] key identifier for the private key
    encryptAllowed - [FIPS 140-2 control input] indicates if the private key can be used for encryption/decryption
    signAllowed - [FIPS 140-2 control input] indicates if the private key can be used for signing/verification
    modulus - [FIPS 140-2 data input] the key's modulus (n)
    publicExponent - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's public exponent (e)
    privateExponent - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's private exponent (d)
    prime1 - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's first prime (p)
    prime2 - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's second prime (q)
    exponent1 - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's first exponent (d mod p-1)
    exponent2 - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's second exponent (d mod q-1)
    coefficient - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's coefficient (1/q mod p)
    
    Returns:
    [FIPS 140-2 data output] the RSA private key object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while creating the RSA private key object on the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - setDSAPrivateKey
```
public long setDSAPrivateKey(long sessionHandle,
                    java.lang.String label,
                    byte[] id,
                    boolean encryptAllowed,
                    boolean signAllowed,
                    byte[] prime,
                    byte[] subprime,
                    byte[] base,
                    byte[] value)
                      throws UserFatalException
```
    Creates a new DSA private key object on a token (a token object).
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 <CODE>label</CODE>
      CKA_KEY_TYPE =              CKK_DSA
      CKA_ID =                    <CODE>id</CODE>
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 false
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               <CODE>encryptAllowed</CODE>
      CKA_SIGN =                  <CODE>signAllowed</CODE>
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_PRIME =                 <CODE>prime</CODE>
      CKA_SUBPRIME =              <CODE>subPrime</CODE>
      CKA_BASE =                  <CODE>base</CODE>
      CKA_VALUE =                 <CODE>value</CODE>
 
```
    Note:
    
    Because this object is created as a private object, the normal user must be logged in. Because the object is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    
    When if operating in FIPS mode, this API cannot be used; plain-text private keys cannot be transferred from cryptographic module in FIPS mode
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    label - [FIPS 140-2 data input] the object's label on the token — a description of the object
    id - [FIPS 140-2 data input] key identifier for the private key
    encryptAllowed - [FIPS 140-2 control input] indicates if the private key can be used for encryption/decryption
    signAllowed - [FIPS 140-2 control input] indicates if the private key can be used for signing/verification
    prime - [FIPS 140-2 data input] the key's prime (p)
    subprime - [FIPS 140-2 data input] the key's sub-prime (q)
    base - [FIPS 140-2 data input] the key's base (g)
    value - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key's private value (x)
    
    Returns:
    [FIPS 140-2 data output] the DSA private key object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while creating the DSA private key object on the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - setECPrivateKey
```
public long setECPrivateKey(long sessionHandle,
                   java.lang.String label,
                   byte[] id,
                   boolean encryptAllowed,
                   boolean signAllowed,
                   byte[] d,
                   java.security.spec.ECParameterSpec ecDomainParams)
                     throws UserFatalException
```
    Creates a new EC private key object on a token (a token object).
    An attempt is first made to create the key pair using EC domain parameters encoded in 'named' format. If this fails, a second attempt is made to create the key pair using EC domain parameters encoded in 'specified' format.
    
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 <CODE>label</CODE>
      CKA_KEY_TYPE =              CKK_EC
      CKA_ID =                    <CODE>id</CODE>
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 false
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               <CODE>encryptAllowed</CODE>
      CKA_SIGN =                  <CODE>signAllowed</CODE>
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_EC_PARAMS =             DER-encoding of <CODE>ecDomainParams</CODE>
      CKA_VALUE =                 <CODE>d</CODE>
 
```
    Note:
    
    Because this object is created as a private object, the normal user must be logged in. Because the object is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    
    When if operating in FIPS mode, this API cannot be used; plain-text private keys cannot be transferred from cryptographic module in FIPS mode
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    label - [FIPS 140-2 data input] the object's label on the token — a description of the object
    id - [FIPS 140-2 data input] key identifier for the private key
    encryptAllowed - [FIPS 140-2 control input] indicates if the private key can be used for encryption/decryption
    signAllowed - [FIPS 140-2 control input] indicates if the private key can be used for signing/verification
    d - [FIPS 140-2 data input] [FIPS 140-2 CSP] the private key value (also called s)
    ecDomainParams - [FIPS 140-2 data input] EC domain parameters
    
    Returns:
    [FIPS 140-2 data output] the EC private key object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while creating the EC private key object on the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.2 SP2
  - addDecryptionKeySecure
```
public long addDecryptionKeySecure(long sessionHandle,
                          SecretKey wrappingKey,
                          long wrappingKeyHandle,
                          byte[] decryptionKey,
                          byte[] id)
                            throws UserFatalException
```
    Creates a new decryption key object on a token by transferring it to the token securely.
    This is done by first wrapping the decryption key in software using a DESede key that was generated on the token and securely transfered to software. The wrapped decryption key is then transfered onto the token and unwrapped on the token using the same DESede key.
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 <CODE>Private Keys</CODE>
      CKA_KEY_TYPE =              CKK_RSA
      CKA_ID =                    <CODE>id</CODE>
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 false
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               true
      CKA_SIGN =                  false
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_MODULUS =               from wrapped key
      CKA_PUBLIC_EXPONENT =       from wrapped key
      CKA_PRIVATE_EXPONENT =      from wrapped key
      CKA_PRIME_1 =               from wrapped key
      CKA_PRIME_2 =               from wrapped key
      CKA_EXPONENT_1 =            from wrapped key
      CKA_EXPONENT_2 =            from wrapped key
      CKA_COEFFICIENT =           from wrapped key
 
```
    Note:
    
    Because this object is created as a private object, the normal user must be logged in. Because the object is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    wrappingKey - [FIPS 140-2 data input] [FIPS 140-2 CSP] the DESede key used for wrapping the decryption key in software
    wrappingKeyHandle - [FIPS 140-2 control input] the handle of the DESede key used for unwrapping the decryption key on the token
    decryptionKey - [FIPS 140-2 data input] [FIPS 140-2 CSP] the DER encoding of the decryption key
    id - [FIPS 140-2 data input] key identifier for the decryption key
    
    Returns:
    [FIPS 140-2 data output] the decryption private key object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while securely creating the RSA decryption key object on the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - setRSAPrivateKeySecure
```
public long setRSAPrivateKeySecure(long sessionHandle,
                          long wrappingKeyHandle,
                          SecretKey wrappingKey,
                          java.lang.String label,
                          byte[] id,
                          boolean encryptAllowed,
                          boolean signAllowed,
                          byte[] privateKey)
                            throws UserFatalException
```
    Creates a new RSA private key object on a token by transferring it to the token securely.
    This is done by first wrapping the decryption key in software using a DESede key that was generated on the token and securely transfered to software. The wrapped decryption key is then transfered onto the token and unwrapped on the token using the same DESede key.
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 <CODE>label</CODE>
      CKA_KEY_TYPE =              CKK_RSA
      CKA_ID =                    <CODE>id</CODE>
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 false
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               <CODE>encryptAllowed</CODE>
      CKA_SIGN =                  <CODE>signAllowed</CODE>
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_MODULUS =               from wrapped key
      CKA_PUBLIC_EXPONENT =       from wrapped key
      CKA_PRIVATE_EXPONENT =      from wrapped key
      CKA_PRIME_1 =               from wrapped key
      CKA_PRIME_2 =               from wrapped key
      CKA_EXPONENT_1 =            from wrapped key
      CKA_EXPONENT_2 =            from wrapped key
      CKA_COEFFICIENT =           from wrapped key
 
```
    Note:
    
    Because this object is created as a private object, the normal user must be logged in. Because the object is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    wrappingKey - [FIPS 140-2 data input] [FIPS 140-2 CSP] the DESede key used for wrapping the private key in software
    wrappingKeyHandle - [FIPS 140-2 control input] the handle of the DESede key used for unwrapping the private key on the token
    label - [FIPS 140-2 data input] the object's label on the token — a description of the object
    id - [FIPS 140-2 data input] key identifier for the private key
    encryptAllowed - [FIPS 140-2 control input] indicates if the private key can be used for encryption/decryption
    signAllowed - [FIPS 140-2 control input] indicates if the private key can be used for signing/verification
    privateKey - [FIPS 140-2 data input] [FIPS 140-2 CSP] the DER encoding of the private key
    
    Returns:
    [FIPS 140-2 data output] the RSA private key object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while securely creating the RSA private key object on the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - setDSAPrivateKeySecure
```
public long setDSAPrivateKeySecure(long sessionHandle,
                          long wrappingKeyHandle,
                          SecretKey wrappingKey,
                          java.lang.String label,
                          byte[] id,
                          boolean encryptAllowed,
                          boolean signAllowed,
                          byte[] privateKey)
                            throws UserFatalException
```
    Creates a new DSA private key object on a token by transferring it to the token securely.
    This is done by first wrapping the decryption key in software using a DESede key that was generated on the token and securely transfered to software. The wrapped decryption key is then transfered onto the token and unwrapped on the token using the same DESede key.
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 <CODE>label</CODE>
      CKA_KEY_TYPE =              CKK_DSA
      CKA_ID =                    <CODE>id</CODE>
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 false
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               <CODE>encryptAllowed</CODE>
      CKA_SIGN =                  <CODE>signAllowed</CODE>
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_PRIME =                 <CODE>prime</CODE>
      CKA_SUBPRIME =              <CODE>subPrime</CODE>
      CKA_BASE =                  <CODE>base</CODE>
      CKA_VALUE =                 <CODE>value</CODE>
 
```
    Note:
    
    Because this object is created as a private object, the normal user must be logged in. Because the object is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    wrappingKey - [FIPS 140-2 data input] [FIPS 140-2 CSP] the DESede key used for wrapping the private key in software
    wrappingKeyHandle - [FIPS 140-2 control input] the handle of the DESede key used for unwrapping the private key on the token
    label - [FIPS 140-2 data input] the object's label on the token — a description of the object
    id - [FIPS 140-2 data input] key identifier for the private key
    encryptAllowed - [FIPS 140-2 control input] indicates if the private key can be used for encryption/decryption
    signAllowed - [FIPS 140-2 control input] indicates if the private key can be used for signing/verification
    privateKey - [FIPS 140-2 data input] [FIPS 140-2 CSP] the DER encoding of the private key
    
    Returns:
    [FIPS 140-2 data output] the DSA private key object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while securely creating the DSA private key object on the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - setECPrivateKeySecure
```
public long setECPrivateKeySecure(long sessionHandle,
                         long wrappingKeyHandle,
                         SecretKey wrappingKey,
                         java.lang.String label,
                         byte[] id,
                         boolean encryptAllowed,
                         boolean signAllowed,
                         byte[] privateKey)
                           throws UserFatalException
```
    Creates a new EC private key object on a token by transferring it to the token securely.
    This is done by first wrapping the decryption key in software using a DESede key that was generated on the token and securely transfered to software. The wrapped decryption key is then transfered onto the token and unwrapped on the token using the same DESede key.
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 <CODE>label</CODE>
      CKA_KEY_TYPE =              CKK_EC
      CKA_ID =                    <CODE>id</CODE>
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 false
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               <CODE>encryptAllowed</CODE>
      CKA_SIGN =                  <CODE>signAllowed</CODE>
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_EC_PARAMS =             <CODE>encodedParams</CODE>
      CKA_VALUE =                 <CODE>d</CODE>
 
```
    Note:
    
    Because this object is created as a private object, the normal user must be logged in. Because the object is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    wrappingKey - [FIPS 140-2 data input] [FIPS 140-2 CSP] the DESede key used for wrapping the private key in software
    wrappingKeyHandle - [FIPS 140-2 control input] the handle of the DESede key used for unwrapping the private key on the token
    label - [FIPS 140-2 data input] the object's label on the token — a description of the object
    id - [FIPS 140-2 data input] key identifier for the private key
    encryptAllowed - [FIPS 140-2 control input] indicates if the private key can be used for encryption/decryption
    signAllowed - [FIPS 140-2 control input] indicates if the private key can be used for signing/verification
    privateKey - [FIPS 140-2 data input] [FIPS 140-2 CSP] the DER encoding of the private key
    
    Returns:
    [FIPS 140-2 status output] the EC private key object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while securely creating the DSA private key object on the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.2 SP2
  - destroyObject
```
public void destroyObject(long sessionHandle,
                 long objectHandle)
                   throws UserFatalException
```
    Destroys (deletes) an object on the token.
    
    Note:
    
    Unless the normal user is logged in, only public objects can be destroyed
    FIPS 140-2:
    
    FIPS Service: Non-Cryptographic Operation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    objectHandle - [FIPS 140-2 control input] the object's handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while destroying the object
  - getStringObject
```
public java.lang.String getStringObject(long sessionHandle,
                               long objectHandle)
                                 throws UserFatalException
```
    Obtains a string object from a token by reading the CKA_VALUE attribute an object.
    
    Note:
    
    Unless the normal user is logged in, only public objects can be accessed
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    objectHandle - [FIPS 140-2 control input] the string's object handle
    
    Returns:
    [FIPS 140-2 data output] the string obtained from the token
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the string object
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getByteArrayObject
```
public byte[] getByteArrayObject(long sessionHandle,
                        long objectHandle)
                          throws UserFatalException
```
    Obtains a byte array object from a token by reading the CKA_VALUE attribute an object.
    
    Note:
    
    Unless the normal user is logged in, only public objects can be accessed
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    objectHandle - [FIPS 140-2 control input] the byte array's object handle
    
    Returns:
    [FIPS 140-2 data output] the byte array obtained from the token
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the byte array object
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getCertificate
```
public byte[] getCertificate(long sessionHandle,
                    long objectHandle)
                      throws UserFatalException
```
    Obtains a certificate object from a token by reading the CKA_VALUE attribute an object.
    
    Note:
    
    Unless the normal user is logged in, only public objects can be accessed
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    objectHandle - [FIPS 140-2 control input] the certificate's object handle
    
    Returns:
    [FIPS 140-2 data output] a DER encoding of the certificate obtained from the token
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the certificate object
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getLabel
```
public java.lang.String getLabel(long sessionHandle,
                        long objectHandle)
                          throws UserFatalException
```
    Obtains the label of an object on the token by reading the CKA_LABEL attribute of the object.
    
    Note:
    
    Unless the normal user is logged in, only public objects can be accessed
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    objectHandle - [FIPS 140-2 control input] the object's handle
    
    Returns:
    [FIPS 140-2 data output] the label obtained from the token
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the object's label
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - getKeyID
```
public java.lang.String getKeyID(long sessionHandle,
                        long objectHandle)
                          throws UserFatalException
```
    Obtains the key identifier from a key object on the token by reading the CKA_ID attribute of the object.
    
    Note:
    
    Unless the normal user is logged in, only public objects can be accessed
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    objectHandle - [FIPS 140-2 control input] the key's object handle
    
    Returns:
    [FIPS 140-2 data output] the key identifier obtained from the token
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the key object's key identifier
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getKeyType
```
public int getKeyType(long sessionHandle,
             long objectHandle)
               throws UserFatalException
```
    Obtains the key type from a key object on the token by reading the CKA_KEY_TYPE attribute of the object.
    
    Note:
    
    Unless the normal user is logged in, only public objects can be accessed
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    objectHandle - [FIPS 140-2 control input] the key's object handle
    
    Returns:
    [FIPS 140-2 data output] the key type obtained from the token
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the key object's key type
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - getSigningKeyType
```
public int getSigningKeyType(long sessionHandle,
                    long objectHandle)
                      throws UserFatalException
```
    Obtains the key type from a signing key object on the token by reading the CKA_KEY_TYPE attribute of the object.
    
    Note:
    
    Unless the normal user is logged in, only public objects can be accessed
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    objectHandle - [FIPS 140-2 control input] the signing key's object handle
    
    Returns:
    [FIPS 140-2 data output] the key type obtained from the token
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the signing key object's key type
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getRSAPublicKeyModulus
```
public byte[] getRSAPublicKeyModulus(long sessionHandle,
                            long objectHandle)
                              throws UserFatalException
```
    Obtains the modulus from an RSA key object stored on a token by reading the CKA_MODULUS attribute of the object.
    
    Note:
    
    Because private keys always exist in private memory, the normal user must be logged in
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    objectHandle - [FIPS 140-2 control input] the RSA key's object handle
    
    Returns:
    [FIPS 140-2 data output] the modulus obtained from the token
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the RSA key object's modulus
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getRSAPrivateKeyModulus
```
public byte[] getRSAPrivateKeyModulus(long sessionHandle,
                             long objectHandle)
                               throws UserFatalException
```
    Obtains the modulus from an RSA private key object stored on a token by reading the CKA_MODULUS attribute of the object.
    
    Note:
    
    Because private keys always exist in private memory, the normal user must be logged in
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    objectHandle - [FIPS 140-2 control input] the RSA key's object handle
    
    Returns:
    [FIPS 140-2 data output] the modulus obtained from the token
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the RSA key object's modulus
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getRSAPublicKeyPublicExp
```
public byte[] getRSAPublicKeyPublicExp(long sessionHandle,
                              long objectHandle)
                                throws UserFatalException
```
    Obtains the public exponent from an RSA key object stored on a token by reading the CKA_PUBLIC_EXPONENT attribute of the object.
    
    Note:
    
    Because private keys always exist in private memory, the normal user must be logged in
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    objectHandle - [FIPS 140-2 control input] the RSA key's object handle
    
    Returns:
    [FIPS 140-2 data output] [FIPS 140-2 CSP] the public exponent obtained from the token
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the RSA key object's public exponent
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getDSAPublicKeyY
```
public byte[] getDSAPublicKeyY(long sessionHandle,
                      long objectHandle)
                        throws UserFatalException
```
    Obtains the public value from a DSA key object stored on a token by reading the CKA_VALUE attribute of the object.
    
    Note:
    
    Because private keys always exist in private memory, the normal user must be logged in
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    objectHandle - [FIPS 140-2 control input] the DSA key's object handle
    
    Returns:
    [FIPS 140-2 data output] [FIPS 140-2 CSP] the public value obtained from the token
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the DSA key object's public value
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getDSAParams
```
public java.security.spec.DSAParameterSpec getDSAParams(long sessionHandle,
                                               long objectHandle)
                                                 throws UserFatalException
```
    Extracts the DSA parameters from a DSA key object stored on a PKCS#11 device.
    This is done by reading and DER-decoding the CKA_PRIME, CKA_SUBPRIME, and CKA_BASE attributes of the key object.
    
    Note:
    
    Because a DSA private key always exists in private memory, the normal user must be logged in when extracting DSAparameters from a private key
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    objectHandle - [FIPS 140-2 control input] the DSA key's object handle
    
    Returns:
    [FIPS 140-2 data output] the DSA parameters extracted from the PKCS#11 device
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] if an error occurred while attempting to extract the DSA parameters from the PKCS#11 device
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.2 SP2 Patch
  - getECPublicPoint
```
public java.security.spec.ECPoint getECPublicPoint(long sessionHandle,
                                          long objectHandle,
                                          java.security.spec.ECParameterSpec ecDomainParams)
                                            throws UserFatalException
```
    Extracts the EC public point from an EC public key object stored on a PKCS#11 device.
    This is done by reading and DER-decoding the CKA_EC_POINT attribute value, which contains the DER-encoding of an ANSI X9.62 ECPoint structure, then parsing the contents into ECPoint representation.
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    *
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    objectHandle - [FIPS 140-2 control input] the EC public key's object handle
    ecDomainParams - [FIPS 140-2 data input] the EC domain parameters associated with this EC public key
    
    Returns:
    [FIPS 140-2 data output] [FIPS 140-2 CSP] the EC public point extracted from the PKCS#11 device
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] if an error occurred while attempting to extract the EC public point from the PKCS#11 device
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.2 SP2
  - getECDomainParams
```
public java.security.spec.ECParameterSpec getECDomainParams(long sessionHandle,
                                                   long objectHandle)
                                                     throws UserFatalException
```
    Extracts the EC domain parameters from an EC key object stored on a PKCS#11 device.
    This is done by reading and DER-decoding the CKA_EC_PARAMS attribute value, which contains the DER-encoding of an ANSI X9.62 ECDomainParameters structure, then parsing the contents into ECParameterSpec representation.
    
    Note:
    
    Because an EC private key always exists in private memory, the normal user must be logged in when extracting EC domain parameters from a private key
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    objectHandle - [FIPS 140-2 control input] the EC key's object handle
    
    Returns:
    [FIPS 140-2 data output] the EC domain parameters extracted from the PKCS#11 device
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] if an error occurred while attempting to extract the EC domain parameters from the PKCS#11 device
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.2 SP2
  - setNewLabel
```
public void setNewLabel(long sessionHandle,
               long objectHandle,
               java.lang.String label)
                 throws UserFatalException
```
    Sets the label of an object that already exists on the token by writing the CKA_LABEL attribute of the object.
    
    Note:
    
    Unless the normal user is logged in, only public objects can be accessed
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    objectHandle - [FIPS 140-2 control input] the object's handle
    label - [FIPS 140-2 data input] the object's new label — a description of the object
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while setting the label attribute
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - setKeyID
```
public void setKeyID(long sessionHandle,
            long objectHandle,
            java.lang.String keyId)
              throws UserFatalException
```
    Sets the key identifier of a key object that already exists on the token by writing the CKA_ID attribute of the object.
    
    Note:
    
    Unless the normal user is logged in, only public objects can be accessed
    FIPS 140-2:
    
    FIPS Service: Modify Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    objectHandle - [FIPS 140-2 control input] the key's object handle
    keyId - [FIPS 140-2 data input] the key's new key identifier
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while setting the key identifier
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - getAllObjectHandles
```
public long[] getAllObjectHandles(long sessionHandle)
                           throws UserFatalException
```
    Obtains the object handles for all objects stored on a token.
    
    Note:
    
    Unless the normal user is logged in, only public objects can be accessed
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    
    Returns:
    [FIPS 140-2 data output] all the object handles
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the object handles
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getStringHandle
```
public long getStringHandle(long sessionHandle,
                   boolean isPrivate,
                   java.lang.String label)
                     throws UserFatalException
```
    Obtains the object handle for a string object stored on a token.
    The Data object is searched for using the following attribute values:
```
      CKA_CLASS =     CKO_DATA
      CKA_TOKEN =     TRUE
      CKA_PRIVATE =   <CODE>isPrivate</CODE>
      CKA_LABEL =     <CODE>label</CODE>
 
```
    Note:
    
    Unless the normal user is logged in, only public objects can be accessed
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    isPrivate - [FIPS 140-2 control input] indicates whether the object exists in the public or private memory on the token
    label - [FIPS 140-2 data input] the object's current label on the token
    
    Returns:
    [FIPS 140-2 data output] the object handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the object handle
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getByteArrayHandle
```
public long getByteArrayHandle(long sessionHandle,
                      boolean isPrivate,
                      java.lang.String label)
                        throws UserFatalException
```
    Obtains the object handle for a byte array object stored on a token.
    The Data object is searched for using the following attribute values:
```
      CKA_CLASS =     CKO_DATA
      CKA_TOKEN =     TRUE
      CKA_PRIVATE =   <CODE>isPrivate</CODE>
      CKA_LABEL =     <CODE>label</CODE>
 
```
    Note:
    
    Unless the normal user is logged in, only public objects can be accessed
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    isPrivate - [FIPS 140-2 control input] indicates whether the object exists in the public or private memory on the token
    label - [FIPS 140-2 data input] the object's current label on the token
    
    Returns:
    [FIPS 140-2 data output] the object handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the object handle
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getDataObjectHandle
```
public long getDataObjectHandle(long sessionHandle,
                       boolean isPrivate,
                       java.lang.String label)
                         throws UserFatalException
```
    Obtains the object handle for a data object stored on a token.
    The Data object is searched for using the following attribute values:
```
      CKA_CLASS =     CKO_DATA
      CKA_TOKEN =     TRUE
      CKA_PRIVATE =   <CODE>isPrivate</CODE>
      CKA_LABEL =     <CODE>label</CODE>
 
```
    Note:
    
    Unless the normal user is logged in, only public objects can be accessed
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    isPrivate - [FIPS 140-2 control input] indicates whether the object exists in the public or private memory on the token
    label - [FIPS 140-2 data input] the object's current label on the token
    
    Returns:
    [FIPS 140-2 data output] the object handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the object handle
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - getDataObjectHandles
```
public long[] getDataObjectHandles(long sessionHandle,
                          boolean isPrivate,
                          java.lang.String label)
                            throws UserFatalException
```
    Obtains the object handles for a set data objects stored on a token.
    The Data objects are searched for using the following attribute values:
```
      CKA_CLASS =     CKO_DATA
      CKA_TOKEN =     TRUE
      CKA_PRIVATE =   <CODE>isPrivate</CODE>
      CKA_LABEL =     <CODE>label</CODE>
 
```
    Note:
    
    Unless the normal user is logged in, only public objects can be accessed
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    isPrivate - [FIPS 140-2 control input] indicates whether the objects exist in the public or private memory on the token
    label - [FIPS 140-2 data input] the objects' current label on the token
    
    Returns:
    [FIPS 140-2 data output] the object handles
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the object handles
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getDataObjectHandles
```
public long[] getDataObjectHandles(long sessionHandle,
                          java.lang.String application)
                            throws UserFatalException
```
    Obtains the object handles for a set data objects stored on a token.
    The Data objects are searched for using the following attribute values:
```
      CKA_CLASS =         CKO_DATA
      CKA_TOKEN =         TRUE
      CKA_APPLICATION =   <CODE>application</CODE>
 
```
    Note:
    
    Unless the normal user is logged in, only public objects can be accessed
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    application - [FIPS 140-2 data input] an identifier for the application that created the object (OPTIONAL)
    
    Returns:
    [FIPS 140-2 data output] the object handles
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the object handles
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - getCertificateHandle
```
public long getCertificateHandle(long sessionHandle,
                        boolean isPrivate,
                        java.lang.String label)
                          throws UserFatalException
```
    Obtains the object handle for a certificate object stored on a token.
    The Certificate object is searched for using the following attribute values:
```
      CKA_CLASS =             CKO_CERTIFICATE
      CKA_TOKEN =             true
      CKA_PRIVATE =           <CODE>isPrivate</CODE>
      CKA_LABEL =             <CODE>label</CODE>
      CKA_CERTIFICATE_TYPE =  CKC_X_509
 
```
    Note:
    
    Unless the normal user is logged in, only public objects can be accessed
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    isPrivate - [FIPS 140-2 control input] indicates whether the object exists in the public or private memory on the token
    label - [FIPS 140-2 data input] the object's current label on the token
    
    Returns:
    [FIPS 140-2 data output] the object handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the object handle
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getCertificateHandle
```
public long getCertificateHandle(long sessionHandle,
                        boolean isPrivate,
                        java.lang.String label,
                        byte[] id)
                          throws UserFatalException
```
    Obtains the object handle for a certificate object stored on a token.
    The Certificate object is searched for using the following attribute values:
```
      CKA_CLASS =             CKO_CERTIFICATE
      CKA_TOKEN =             true
      CKA_PRIVATE =           <CODE>isPrivate</CODE>
      CKA_LABEL =             <CODE>label</CODE>
      CKA_CERTIFICATE_TYPE =  CKC_X_509
      CKA_ID =                <CODE>id</CODE>
 
```
    Note:
    
    Unless the normal user is logged in, only public objects can be accessed
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    isPrivate - [FIPS 140-2 control input] indicates whether the object exists in the public or private memory on the token
    label - [FIPS 140-2 data input] the object's current label on the token (OPTIONAL)
    id - [FIPS 140-2 data input] the certificate's key identifier on the token
    
    Returns:
    [FIPS 140-2 data output] the object handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the object handle
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - getCertificateHandles
```
public long[] getCertificateHandles(long sessionHandle,
                           boolean isPrivate,
                           java.lang.String label)
                             throws UserFatalException
```
    Obtains the object handles for a set certificate objects stored on a token.
    The Certificate objects are searched for using the following attribute values:
```
      CKA_CLASS =             CKO_CERTIFICATE
      CKA_TOKEN =             true
      CKA_PRIVATE =           <CODE>isPrivate</CODE>
      CKA_LABEL =             <CODE>label</CODE>
      CKA_CERTIFICATE_TYPE =  CKC_X_509
 
```
    Note:
    
    Unless the normal user is logged in, only public objects can be accessed
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    isPrivate - [FIPS 140-2 control input] indicates whether the objects exist in the public or private memory on the token
    label - [FIPS 140-2 data input] the objects' current label on the token (OPTIONAL)
    
    Returns:
    [FIPS 140-2 data output] the object handles
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the object handles
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getSigningKeyHandle
```
public long getSigningKeyHandle(long sessionHandle)
                         throws UserFatalException
```
    Obtains the object handle for a signing key object stored on a token.
    The Private Key object is searched for using the following attribute values:
```
      CKA_CLASS =     CKO_PRIVATE_KEY
      CKA_TOKEN =     true
      CKA_PRIVATE =   true
      CKA_LABEL =     "Signing Key"
 
```
    Note:
    
    Because private keys always exist in private memory, the normal user must be logged in
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    
    Returns:
    [FIPS 140-2 data output] the object handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the object handle
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getOldSigningKeyHandle
```
public long getOldSigningKeyHandle(long sessionHandle)
                            throws UserFatalException
```
    Obtains the object handle for an "old" signing key object stored on a token.
    The Private Key object is searched for using the following attribute values:
```
      CKA_CLASS =     CKO_PRIVATE_KEY
      CKA_TOKEN =     true
      CKA_PRIVATE =   true
      CKA_LABEL =     "DELETE THIS"
 
```
    Note:
    
    Because private keys always exist in private memory, the normal user must be logged in
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    
    Returns:
    [FIPS 140-2 data output] the object handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the object handle
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getDecryptionKeyHandle
```
public long getDecryptionKeyHandle(long sessionHandle,
                          byte[] id)
                            throws UserFatalException
```
    Obtains the object handle for a decryption key object stored on a token.
    The Private Key object is searched for using the following attribute values:
```
      CKA_CLASS =     CKO_PRIVATE_KEY
      CKA_TOKEN =     true
      CKA_PRIVATE =   true
      CKA_LABEL =     "Private Keys"
      CKA_ID =        <CODE>id</CODE>
 
```
    Note:
    
    Because private keys always exist in private memory, the normal user must be logged in
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    id - [FIPS 140-2 data input] the private key's key identifier on the token
    
    Returns:
    [FIPS 140-2 data output] the object handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the object handle
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getAllDecryptionKeyHandles
```
public long[] getAllDecryptionKeyHandles(long sessionHandle)
                                  throws UserFatalException
```
    Obtains the object handles for a all decryption key objects stored on a token.
    The Private Key objects are searched for using the following attribute values:
```
      CKA_CLASS =     CKO_PRIVATE_KEY
      CKA_TOKEN =     true
      CKA_PRIVATE =   true
      CKA_LABEL =     "Private Keys"
 
```
    Note:
    
    Because private keys always exist in private memory, the normal user must be logged in
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    
    Returns:
    [FIPS 140-2 data output] the object handles
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the object handles
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getPrivateKeyHandle
```
public long getPrivateKeyHandle(long sessionHandle,
                       java.lang.String label)
                         throws UserFatalException
```
    Obtains the object handle for a private key object stored on a token.
    The Private Key object is searched for using the following attribute values:
```
      CKA_CLASS =     CKO_PRIVATE_KEY
      CKA_TOKEN =     true
      CKA_PRIVATE =   true
      CKA_LABEL =     <CODE>label</CODE>
 
```
    Note:
    
    Because private keys always exist in private memory, the normal user must be logged in
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    label - [FIPS 140-2 data input] the object's current label on the token
    
    Returns:
    [FIPS 140-2 data output] the object handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the object handle
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - getPrivateKeyHandle
```
public long getPrivateKeyHandle(long sessionHandle,
                       byte[] id)
                         throws UserFatalException
```
    Obtains the object handle for a private key object stored on a token.
    The Private Key object is searched for using the following attribute values:
```
      CKA_CLASS =     CKO_PRIVATE_KEY
      CKA_TOKEN =     true
      CKA_PRIVATE =   true
      CKA_ID =        <CODE>id</CODE>
 
```
    Note:
    
    Because private keys always exist in private memory, the normal user must be logged in
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    id - [FIPS 140-2 data input] the private key's key identifier on the token
    
    Returns:
    [FIPS 140-2 data output] the object handle
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the object handle
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - getPrivateKeyHandles
```
public long[] getPrivateKeyHandles(long sessionHandle,
                          java.lang.String label)
                            throws UserFatalException
```
    Obtains the object handles for a set private key objects stored on a token.
    The Private Key objects are searched for using the following attribute values:
```
      CKA_CLASS =     CKO_PRIVATE_KEY
      CKA_TOKEN =     true
      CKA_PRIVATE =   true
      CKA_LABEL =     <CODE>label</CODE>
 
```
    Note:
    
    Because private keys always exist in private memory, the normal user must be logged in
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    label - [FIPS 140-2 data input] the objects' current label on the token (OPTIONAL)
    
    Returns:
    [FIPS 140-2 data output] the object handles
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while obtaining the object handles
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - encryptInit
```
public void encryptInit(long sessionHandle,
               long mechanism,
               long keyHandle)
                 throws UserFatalException
```
    Initializes an encryption operation.
    After calling encryptInit, the application can call either encrypt (to encrypt data in a single part), or encryptUpdate zero or more times, followed by encryptFinal (to encrypt data in multiple parts). The encryption operation is active until the application uses a call to encrypt, or to encryptFinal to obtain the final piece of ciphertext. To process additional data (in single or multiple parts), the application must call encryptInit again.
    
    Do not use this call when using symmetric ciphers which require an initialization vector; use encryptInit(long, long, long, byte[]) instead.
    FIPS 140-2:
    
    FIPS Service: Initialization
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    mechanism - [FIPS 140-2 control input] the encryption mechanism
    keyHandle - [FIPS 140-2 control input] the handle of the encryption key
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while initializing the encryption operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - encryptInit
```
public void encryptInit(long sessionHandle,
               long mechanism,
               long keyHandle,
               byte[] iv)
                 throws UserFatalException
```
    Initializes an encryption operation, passing in a byte array to use as an initialization vector with a symmetric cipher.
    After calling encryptInit, the application can call either encrypt (to encrypt data in a single part), or encryptUpdate zero or more times, followed by encryptFinal (to encrypt data in multiple parts). The encryption operation is active until the application uses a call to encrypt, or to encryptFinal to obtain the final piece of ciphertext. To process additional data (in single or multiple parts), the application must call encryptInit again.
    FIPS 140-2:
    
    FIPS Service: Initialization
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    mechanism - [FIPS 140-2 control input] the encryption mechanism
    keyHandle - [FIPS 140-2 control input] the handle of the encryption key
    iv - [FIPS 140-2 data input] a bytes array containing the initialization vector to use with symmetric ciphers. May be null, in which case this call is equivalent to encryptInit(long, long, long)
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while initializing the encryption operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.2 SP2 Patch
  - encrypt
```
public byte[] encrypt(long sessionHandle,
             byte[] plaintext)
               throws UserFatalException
```
    Encrypts single-part data.
    The encryption operation must have been initialized with encryptInit. A call to encrypt always terminates the active encryption operation unless it fails with error CKR_BUFFER_TOO_SMALL. It cannot be used to terminate a multi-part operation, and must be called after encryptInit without intervening encryptUpdate calls.
    
    For some encryption mechanisms, the input plaintext data has certain length constraints (either because the mechanism can encrypt only relatively short pieces of plaintext, or because the mechanism's input data must consist of an integral number of blocks). If these constraints are not satisfied, encrypt will fail with error CKR_DATA_LEN_RANGE.
    FIPS 140-2:
    
    FIPS Service: Cryptographic Operation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    plaintext - [FIPS 140-2 data input] the data to encrypt
    
    Returns:
    [FIPS 140-2 data output] the resulting cipher text
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs during the encryption operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - encryptUpdate
```
public byte[] encryptUpdate(long sessionHandle,
                   byte[] plaintext)
                     throws UserFatalException
```
    Continues a multiple-part encryption operation, processing another data part.
    The encryption operation must have been initialized with encryptInit. This function can be called any number of times in succession. A call to encryptUpdate, that results in an error other than CKR_BUFFER_TOO_SMALL, terminates the current encryption operation.
    FIPS 140-2:
    
    FIPS Service: Cryptographic Operation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    plaintext - [FIPS 140-2 data input] the data part to encrypt
    
    Returns:
    [FIPS 140-2 data output] the resulting cipher text
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs during the encryption operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - encryptUpdate
```
public int encryptUpdate(long sessionHandle,
                byte[] input,
                int inputOffset,
                int inputLength,
                byte[] output,
                int outputOffset)
                  throws UserFatalException
```
    Continues a multiple-part encryption operation, processing another data part and placing the result in a pre-allocated array. If the array is not large enough to contain the result, a UserFatalException is thrown with error CKR_BUFFER_TOO_SMALL. The operation may then be repeated with a larger buffer.
    The encryption operation must have been initialized with encryptInit. This function can be called any number of times in succession. A call to encryptUpdate that results in an error other than CKR_BUFFER_TOO_SMALL terminates the current encryption operation.
    FIPS 140-2:
    
    FIPS Service: Cryptographic Operation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    input - [FIPS 140-2 data input] the input data to encrypt
    inputOffset - [FIPS 140-2 data input] the offset in to the input array. Data is encrypted starting at this offset.
    inputLength - [FIPS 140-2 data input] the number of bytes in the input array to encrypt, starting from offset inputOffset.
    output - [FIPS 140-2 data output] the array in which the encrypted output is placed.
    outputOffset - [FIPS 140-2 data input] the offset in to the output array. Encrypted data is written to the array starting at this offset.
    
    Returns:
    [FIPS 140-2 data output] the number of bytes written to the output array.
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs during the encryption operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.2 SP2 Patch
  - getEncryptUpdateLength
```
public int getEncryptUpdateLength(long sessionHandle,
                         byte[] input,
                         int inputLength)
                           throws UserFatalException
```
    When performing a multiple-part encryption operation, this call returns the number of bytes that would be required in an array passed to encryptUpdate to hold the output.
    The encryption operation must have been initialized with encryptInit prior to calling this method.
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 data input] the session's handle
    input - [FIPS 140-2 data input] the input data to encrypt
    inputLength - [FIPS 140-2 data input] the number of bytes in the input array to encrypt.
    
    Returns:
    [FIPS 140-2 data output] the number of encrypted bytes of data that would be returned were encryptUpdate to be called with this input and number of bytes to encrypt. The actual call to encryptUpdate may return fewer bytes than the number returned by this method, but it will not return more.
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs during the call to find the output length.
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - encryptFinal
```
public byte[] encryptFinal(long sessionHandle)
                    throws UserFatalException
```
    Finishes a multiple-part encryption operation.
    The encryption operation must have been initialized with encryptInit. A call to encryptFinal always terminates the active encryption operation unless it returns a CKR_BUFFER_TOO_SMALL error.
    
    For some multi-part encryption mechanisms, the input plaintext data has certain length constraints, because the mechanism's input data must consist of an integral number of blocks. If these constraints are not satisfied, encryptFinal will fail with error CKR_DATA_LEN_RANGE.
    FIPS 140-2:
    
    FIPS Service: Cryptographic Operation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    
    Returns:
    [FIPS 140-2 data output] the resulting cipher text
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs during the encryption operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - decryptInit
```
public void decryptInit(long sessionHandle,
               long mechanism,
               long keyHandle)
                 throws UserFatalException
```
    Initializes a decryption operation.
    After calling decryptInit, the application can call either decrypt (to decrypt data in a single part), or decryptUpdate zero or more times, followed by decryptFinal (to decrypt data in multiple parts). The decryption operation is active until the application uses a call to decrypt or to decryptFinal to obtain the final piece of plaintext. To process additional data (in single or multiple parts), the application must call decryptInit again.
    
    Do not use this call when using symmetric ciphers which require an initialization vector; use decryptInit(long, long, long, byte[]) instead.
    FIPS 140-2:
    
    FIPS Service: Initialization
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    mechanism - [FIPS 140-2 control input] the decryption mechanism
    keyHandle - [FIPS 140-2 control input] the handle of the decryption key
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while initializing the decryption operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - decryptInit
```
public void decryptInit(long sessionHandle,
               long mechanism,
               long keyHandle,
               byte[] iv)
                 throws UserFatalException
```
    Initializes a decryption operation, passing in a byte array to use as an initialization vector with a symmetric cipher.
    After calling decryptInit, the application can call either decrypt (to decrypt data in a single part), or decryptUpdate zero or more times, followed by decryptFinal (to decrypt data in multiple parts). The decryption operation is active until the application uses a call to decrypt or to decryptFinal to obtain the final piece of plaintext. To process additional data (in single or multiple parts), the application must call decryptInit again.
    FIPS 140-2:
    
    FIPS Service: Initialization
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    mechanism - [FIPS 140-2 control input] the decryption mechanism
    keyHandle - [FIPS 140-2 control input] the handle of the decryption key
    iv - [FIPS 140-2 data input] a bytes array containing the initialization vector to use with symmetric ciphers. May be null, in which case this call is equivalent to decryptInit(long, long, long)
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while initializing the decryption operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.2 SP2 Patch
  - decrypt
```
public byte[] decrypt(long sessionHandle,
             byte[] ciphertext)
               throws UserFatalException
```
    Decrypts encrypted data in a single part.
    The decryption operation must have been initialized with decryptInit. A call to decrypt always terminates the active decryption operation unless it fails with error CKR_BUFFER_TOO_SMALL. It cannot be used to terminate a multi-part operation, and must be called after decryptInit without intervening decryptUpdate calls.
    
    If the input ciphertext data cannot be decrypted because it has an inappropriate length, it might fail with error CKR_ENCRYPTED_DATA_INVALID or CKR_ENCRYPTED_DATA_LEN_RANGE.
    FIPS 140-2:
    
    FIPS Service: Cryptographic Operation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    ciphertext - [FIPS 140-2 data input] the data to decrypt
    
    Returns:
    [FIPS 140-2 data output] the resulting plain text
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs during the decryption operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - decryptUpdate
```
public byte[] decryptUpdate(long sessionHandle,
                   byte[] ciphertext)
                     throws UserFatalException
```
    Continues a multiple-part decryption operation, processing another encrypted data part.
    The decryption operation must have been initialized with decryptInit. This method can be called any number of times in succession. A call to decryptUpdate that results in an error other than CKR_BUFFER_TOO_SMALL terminates the current decryption operation.
    FIPS 140-2:
    
    FIPS Service: Cryptographic Operation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    ciphertext - [FIPS 140-2 data input] the data part to decrypt
    
    Returns:
    [FIPS 140-2 data output] the resulting plain text
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs during the decryption operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - decryptUpdate
```
public int decryptUpdate(long sessionHandle,
                byte[] input,
                int inputOffset,
                int inputLength,
                byte[] output,
                int outputOffset)
                  throws UserFatalException
```
    Continues a multiple-part decryption operation, processing another encrypted data part and placing the result in a pre-allocated array. If the array is not large enough to contain the result, a UserFatalException is thrown with error CKR_BUFFER_TOO_SMALL. The operation may then be repeated with a larger buffer.
    The encryption operation must have been initialized with decryptInit. This function can be called any number of times in succession. A call to decryptUpdate that results in an error other than CKR_BUFFER_TOO_SMALL terminates the current encryption operation.
    FIPS 140-2:
    
    FIPS Service: Cryptographic Operation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    input - [FIPS 140-2 data input] the encrypted data to decrypt
    inputOffset - [FIPS 140-2 data input] the offset in to the input array. Data is decrypted starting at this offset.
    inputLength - [FIPS 140-2 data input] the number of bytes in the input array to decrypt, starting from offset inputOffset.
    output - [FIPS 140-2 data output] the array in which the decrypted output is placed.
    outputOffset - [FIPS 140-2 data input] the offset in to the output array. Decrypted data is written to the array starting at this offset.
    
    Returns:
    [FIPS 140-2 data output] the number of bytes written to the output array.
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs during the decryption operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.2 SP2 Patch
  - getDecryptUpdateLength
```
public int getDecryptUpdateLength(long sessionHandle,
                         byte[] input,
                         int inputLength)
                           throws UserFatalException
```
    When performing a multiple-part decryption operation, this call returns the number of bytes that would be required in an array passed to decryptUpdate to hold the output.
    The decryption operation must have been initialized with decryptInit prior to calling this method.
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    input - [FIPS 140-2 data input] the input data to decrypt
    inputLength - [FIPS 140-2 data input] the number of bytes in the input array to decrypt.
    
    Returns:
    [FIPS 140-2 data output] the number of decrypted bytes of data that would be returned were decryptUpdate to be called with this input and number of bytes to decrypt. The actual call to decryptUpdate may return fewer bytes than the number returned by this method, but it will not return more.
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs during the call to find the output length.
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - decryptFinal
```
public byte[] decryptFinal(long sessionHandle)
                    throws UserFatalException
```
    Finishes a multiple-part decryption operation.
    The decryption operation must have been initialized with decryptInit. A call to C_DecryptFinal always terminates the active decryption operation unless it fails with error CKR_BUFFER_TOO_SMALL.
    
    If the input ciphertext data cannot be decrypted because it has an inappropriate length, then it might fail with error CKR_ENCRYPTED_DATA_INVALID or CKR_ENCRYPTED_DATA_LEN_RANGE.
    FIPS 140-2:
    
    FIPS Service: Cryptographic Operation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    
    Returns:
    [FIPS 140-2 data output] the resulting plain text
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs during the decryption operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - signInit
```
public void signInit(long sessionHandle,
            long mechanism,
            long keyHandle)
              throws UserFatalException
```
    Initializes a signature operation, where the signature is an appendix to the data.
    After calling signInit, the application can call either sign (to sign in a single part) or signUpdate one or more times, followed by signFinal (to sign data in multiple parts). The signature operation is active until the application uses a call to sign or to signFinal to obtain the signature. To process additional data (in single or multiple parts), the application must call signInit again.
    FIPS 140-2:
    
    FIPS Service: Initialization
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    mechanism - [FIPS 140-2 control input] the signature mechanism
    keyHandle - [FIPS 140-2 control input] the handle of the signature key
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while initializing the signing operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - SignInitWithRSAPSSParameters
```
public void SignInitWithRSAPSSParameters(long sessionHandle,
                                long mechanism,
                                long keyHandle,
                                long hashAlg,
                                long mgfType,
                                long saltLength)
                                  throws UserFatalException
```
    Initializes a signature operation, where the signature is an appendix to the data. Same as signInit(long sessionHandle, long mechanism, long keyHandle) but you can pass in mechanism parameters if required.
    FIPS 140-2:
    
    FIPS Service: Initialization
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    mechanism - [FIPS 140-2 control input] the signature mechanism
    keyHandle - [FIPS 140-2 control input] the handle of the signature key
    hashAlg - [FIPS 140-2 control input] hash algorithm used in the PSS encoding; if the signature mechanism does not include message hashing, then this value must be the mechanism used by the application to generate the message hash; if the signature mechanism includes hashing, then this value must match the hash algorithm indicated by the signature mechanism
    mgfType - [FIPS 140-2 control input] mask generation function to use on the encoded block
    saltLength - [FIPS 140-2 data input] length, in bytes, of the salt value used in the PSS encoding; typical values are the length of the message hash and zero
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while initializing the signing operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - sign
```
public byte[] sign(long sessionHandle,
          byte[] data)
            throws UserFatalException
```
    Signs data in a single part, where the signature is an appendix to the data.
    The signing operation must have been initialized with signInit. A call to sign always terminates the active signing operation unless it fails with error CKR_BUFFER_TOO_SMALL. It cannot be used to terminate a multi-part operation, and must be called after signInit without intervening signUpdate calls.
    FIPS 140-2:
    
    FIPS Service: Digital Signature Generation/Verification
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    data - [FIPS 140-2 data input] the data to sign
    
    Returns:
    [FIPS 140-2 data output] the resulting signature
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs during the signing operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - signUpdate
```
public void signUpdate(long sessionHandle,
              byte[] part)
                throws UserFatalException
```
    Continues a multiple-part signature operation, processing another data part.
    The signing operation must have been initialized with signInit. This function can be called any number of times in succession. A call to signUpdate that results in an error terminates the current signature operation.
    FIPS 140-2:
    
    FIPS Service: Digital Signature Generation/Verification
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    part - [FIPS 140-2 data input] the data part to sign
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs during the signing operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - signUpdate
```
public void signUpdate(long sessionHandle,
              byte[] part,
              int offset,
              int length)
                throws UserFatalException
```
    Continues a multiple-part signature operation, processing another data part.
    The signing operation must have been initialized with signInit. This function can be called any number of times in succession. A call to signUpdate that results in an error terminates the current signature operation.
    FIPS 140-2:
    
    FIPS Service: Digital Signature Generation/Verification
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    part - [FIPS 140-2 data input] the array containing the data to sign
    offset - [FIPS 140-2 data input] the offset in to the part array from which to read the data.
    length - [FIPS 140-2 data input] the number of bytes in part to include in the signature, starting from offset.
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs during the signing operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - signFinal
```
public byte[] signFinal(long sessionHandle)
                 throws UserFatalException
```
    Finishes a multiple-part signature operation, returning the signature.
    The signing operation must have been initialized with signInit. A call to signFinal always terminates the active signing operation unless it fails with error CKR_BUFFER_TOO_SMALL.
    FIPS 140-2:
    
    FIPS Service: Digital Signature Generation/Verification
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    
    Returns:
    [FIPS 140-2 data output] the resulting signature
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs during the signing operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - verifyInit
```
public void verifyInit(long sessionHandle,
              long mechanism,
              long keyHandle)
                throws UserFatalException
```
    Initializes a verification operation, where the signature is an appendix to the data.
    After calling verifyInit, the application can call either verify (to verify a signature on data in a single part) or verifyUpdate one or more times, followed by verifyFinal (to verify a signature on data in multiple parts). The verification operation is active until the application calls verify or verifyFinal. To process additional data (in single or multiple parts), the application must call verifyInit again.
    FIPS 140-2:
    
    FIPS Service: Initialization
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    mechanism - [FIPS 140-2 control input] the verification mechanism
    keyHandle - [FIPS 140-2 control input] the handle of the verification key
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while initializing the verification operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - verify
```
public boolean verify(long sessionHandle,
             byte[] data,
             byte[] signature)
               throws UserFatalException
```
    Verifies a signature in a single-part operation, where the signature is an appendix to the data.
    The verification operation must have been initialized with verifyInit. A call to verify always terminates the active verification operation. It cannot be used to terminate a multi-part operation, and must be called after verifyInit without intervening verifyUpdate calls.
    
    A successful call to verify should return either true (indicating that the supplied signature is valid) or false (indicating that the supplied signature is invalid). If the signature can be seen to be invalid purely on the basis of its length, the operation fails with error CKR_SIGNATURE_LEN_RANGE. In any of these cases, the active signing operation is terminated.
    FIPS 140-2:
    
    FIPS Service: Digital Signature Generation/Verification
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    data - [FIPS 140-2 data input] the data the signature is over
    signature - [FIPS 140-2 data input] the signature to verify
    
    Returns:
    [FIPS 140-2 data output] true if the signature was verified, false otherwise
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs during the verification operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - verifyUpdate
```
public void verifyUpdate(long sessionHandle,
                byte[] part)
                  throws UserFatalException
```
    Continues a multiple-part verification operation, processing another data part.
    The verification operation must have been initialized with verifyInit. This function can be called any number of times in succession. A call to verifyUpdate that results in an error terminates the current verification operation.
    FIPS 140-2:
    
    FIPS Service: Digital Signature Generation/Verification
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    part - [FIPS 140-2 data input] the data part the signature is over
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs during the verification operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - verifyFinal
```
public boolean verifyFinal(long sessionHandle,
                  byte[] signature)
                    throws UserFatalException
```
    Finishes a multiple-part verification operation, checking the signature.
    The verification operation must have been initialized with verifyInit. A call to verifyFinal always terminates the active verification operation.
    
    A successful call to verifyFinal should return either true (indicating that the supplied signature is valid) or false (indicating that the supplied signature is invalid). If the signature can be seen to be invalid purely on the basis of its length, the operation fails with error CKR_SIGNATURE_LEN_RANGE. In any of these cases, the active verifying operation is terminated.
    FIPS 140-2:
    
    FIPS Service: Digital Signature Generation/Verification
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    signature - [FIPS 140-2 data input] the signature to verify
    
    Returns:
    [FIPS 140-2 data output] true if the signature was verified, false otherwise
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs during the verification operation
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - createRSASigningKeys
```
public long[] createRSASigningKeys(long sessionHandle,
                          int strength)
                            throws UserFatalException
```
    Generates an RSA signing key pair on the token.
    The private key is created on the token and the public key is created as a session object (not saved on the token). This method returns an array containing the handle for the public key [0] and the handle for the private key [1].
    
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 "Signing Key"
      CKA_KEY_TYPE =              CKK_RSA
      CKA_ID =                    default
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 true
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               false
      CKA_SIGN =                  true
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_MODULUS =               generated
      CKA_PUBLIC_EXPONENT =       generated
      CKA_PRIVATE_EXPONENT =      generated
      CKA_PRIME_1 =               generated
      CKA_PRIME_2 =               generated
      CKA_EXPONENT_1 =            generated
      CKA_EXPONENT_2 =            generated
      CKA_COEFFICIENT =           generated
 
```
    The Public Key object is created with the following attribute values:
```
      CKA_CLASS =             CKO_PUBLIC_KEY
      CKA_TOKEN =             false
      CKA_PRIVATE =           default
      CKA_MODIFIABLE =        default
      CKA_LABEL =             default
      CKA_KEY_TYPE =          CKK_RSA
      CKA_ID =                default
      CKA_START_DATE =        default
      CKA_END_DATE =          default
      CKA_DERIVE =            default
      CKA_LOCAL =             true
      CKA_SUBJECT =           default
      CKA_ENCRYPT =           false
      CKA_VERIFY =            true
      CKA_VERIFY_RECOVER =    default
      CKA_WRAP =              default
      CKA_MODULUS =           generated
      CKA_MODULUS_BITS =      <CODE>strength</CODE>
      CKA_PUBLIC_EXPONENT =   generated
 
```
    Note:
    
    Because the private key is created as a private object, the normal user must be logged in. Because the private key is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    
    Because the public key is created as a session object, once the session is closed, the public key object will be destroyed and can no longer be accessed.
    FIPS 140-2:
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 crypto officer role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    strength - [FIPS 140-2 data input] the strength (modulus length) of the RSA key pair
    
    Returns:
    [FIPS 140-2 data output] the handle of the public key [0] and private key [1]
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while generating the RSA key pair
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - createRSASigningKeys
```
public long[] createRSASigningKeys(long sessionHandle,
                          int strength,
                          byte[] publicExponent)
                            throws UserFatalException
```
    Generates an RSA signing key pair on the token.
    The private key is created on the token and the public key is created as a session object (not saved on the token). This method returns an array containing the handle for the public key [0] and the handle for the private key [1].
    
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 "Signing Key"
      CKA_KEY_TYPE =              CKK_RSA
      CKA_ID =                    default
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 true
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               false
      CKA_SIGN =                  true
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_MODULUS =               generated
      CKA_PUBLIC_EXPONENT =       <CODE>publicExponent</CODE>
      CKA_PRIVATE_EXPONENT =      generated
      CKA_PRIME_1 =               generated
      CKA_PRIME_2 =               generated
      CKA_EXPONENT_1 =            generated
      CKA_EXPONENT_2 =            generated
      CKA_COEFFICIENT =           generated
 
```
    The Public Key object is created with the following attribute values:
```
      CKA_CLASS =             CKO_PUBLIC_KEY
      CKA_TOKEN =             false
      CKA_PRIVATE =           default
      CKA_MODIFIABLE =        default
      CKA_LABEL =             default
      CKA_KEY_TYPE =          CKK_RSA
      CKA_ID =                default
      CKA_START_DATE =        default
      CKA_END_DATE =          default
      CKA_DERIVE =            default
      CKA_LOCAL =             true
      CKA_SUBJECT =           default
      CKA_ENCRYPT =           false
      CKA_VERIFY =            true
      CKA_VERIFY_RECOVER =    default
      CKA_WRAP =              default
      CKA_MODULUS =           generated
      CKA_MODULUS_BITS =      <CODE>strength</CODE>
      CKA_PUBLIC_EXPONENT =   <CODE>publicExponent</CODE>
 
```
    Note:
    
    Because the private key is created as a private object, the normal user must be logged in. Because the private key is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    
    Because the public key is created as a session object, once the session is closed, the public key object will be destroyed and can no longer be accessed.
    FIPS 140-2:
    
    FIPS Service: Key Generation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 crypto officer role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    strength - [FIPS 140-2 data input] the strength (modulus length) of the RSA key pair
    publicExponent - [FIPS 140-2 data input] [FIPS 140-2 CSP] the public exponent value (e) of the RSA key pair
    
    Returns:
    [FIPS 140-2 data output] the handle of the public key [0] and private key [1]
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while generating the RSA key pair
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - createDSASigningKeys
```
public long[] createDSASigningKeys(long sessionHandle,
                          int strength)
                            throws UserFatalException
```
    Generates an DSA signing key pair on the token.
    The private key is created on the token and the public key is created as a session object (not saved on the token). This method returns an array containing the handle for the public key [0] and the handle for the private key [1].
    
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 "Signing Key"
      CKA_KEY_TYPE =              CKK_DSA
      CKA_ID =                    default
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 true
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               false
      CKA_SIGN =                  true
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_PRIME =                 generated
      CKA_SUBPRIME =              generated
      CKA_BASE =                  generated
      CKA_VALUE =                 generated
 
```
    The Public Key object is created with the following attribute values:
```
      CKA_CLASS =             CKO_PUBLIC_KEY
      CKA_TOKEN =             false
      CKA_PRIVATE =           default
      CKA_MODIFIABLE =        default
      CKA_LABEL =             default
      CKA_KEY_TYPE =          CKK_DSA
      CKA_ID =                default
      CKA_START_DATE =        default
      CKA_END_DATE =          default
      CKA_DERIVE =            default
      CKA_LOCAL =             true
      CKA_SUBJECT =           default
      CKA_ENCRYPT =           false
      CKA_VERIFY =            true
      CKA_VERIFY_RECOVER =    default
      CKA_WRAP =              default
      CKA_PRIME =             generated
      CKA_SUBPRIME =          generated
      CKA_BASE =              generated
      CKA_VALUE =             generated
 
```
    Note:
    
    Because the private key is created as a private object, the normal user must be logged in. Because the private key is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    
    Because the public key is created as a session object, once the session is closed, the public key object will be destroyed and can no longer be accessed.
    FIPS 140-2:
    
    FIPS Service: Key Generation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 crypto officer role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    strength - [FIPS 140-2 data input] the strength of the DSA key pair
    
    Returns:
    [FIPS 140-2 data output] the handle of the public key [0] and private key [1]
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while generating the DSA key pair
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - createDSASigningKeys
```
public long[] createDSASigningKeys(long sessionHandle,
                          byte[] prime,
                          byte[] subprime,
                          byte[] base)
                            throws UserFatalException
```
    Generates an DSA signing key pair on the token.
    The private key is created on the token and the public key is created as a session object (not saved on the token). This method returns an array containing the handle for the public key [0] and the handle for the private key [1].
    
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 "Signing Key"
      CKA_KEY_TYPE =              CKK_DSA
      CKA_ID =                    default
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 true
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               false
      CKA_SIGN =                  true
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_PRIME =                 <CODE>prime</CODE>
      CKA_SUBPRIME =              <CODE>subprime</CODE>
      CKA_BASE =                  <CODE>base</CODE>
      CKA_VALUE =                 generated
 
```
    The Public Key object is created with the following attribute values:
```
      CKA_CLASS =             CKO_PUBLIC_KEY
      CKA_TOKEN =             false
      CKA_PRIVATE =           default
      CKA_MODIFIABLE =        default
      CKA_LABEL =             default
      CKA_KEY_TYPE =          CKK_DSA
      CKA_ID =                default
      CKA_START_DATE =        default
      CKA_END_DATE =          default
      CKA_DERIVE =            default
      CKA_LOCAL =             true
      CKA_SUBJECT =           default
      CKA_ENCRYPT =           false
      CKA_VERIFY =            true
      CKA_VERIFY_RECOVER =    default
      CKA_WRAP =              default
      CKA_PRIME =             <CODE>prime</CODE>
      CKA_SUBPRIME            <CODE>subprime</CODE>
      CKA_BASE =              <CODE>base</CODE>
      CKA_VALUE =             generated
 
```
    Note:
    
    Because the private key is created as a private object, the normal user must be logged in. Because the private key is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    
    Because the public key is created as a session object, once the session is closed, the public key object will be destroyed and can no longer be accessed.
    FIPS 140-2:
    
    FIPS Service: Key Generation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 crypto officer role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    prime - [FIPS 140-2 data input] the prime value (p) of the DSA key pair
    subprime - [FIPS 140-2 data input] the subprime value (q) of the DSA key pair
    base - [FIPS 140-2 data input] the base value (g) of the DSA key pair
    
    Returns:
    [FIPS 140-2 data output] the handle of the public key [0] and private key [1]
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while generating the DSA key pair
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - createECSigningKeys
```
public long[] createECSigningKeys(long sessionHandle,
                         java.security.spec.ECParameterSpec ecDomainParams)
                           throws UserFatalException
```
    Generates an EC signing key pair on the token.
    An attempt is first made to generate the key pair using EC domain parameters encoded in 'named' format. If this fails, a second attempt is made to generate the key pair using EC domain parameters encoded in 'specified' format.
    
    The private key is created on the token and the public key is created as a session object (not saved on the token). This method returns an array containing the handle for the public key [0] and the handle for the private key [1].
    
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 "Signing Key"
      CKA_KEY_TYPE =              CKK_EC
      CKA_ID =                    default
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 true
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               false
      CKA_SIGN =                  true
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_EC_PARAMS =             DER-encoding of <CODE>ecDomainParams</CODE>
      CKA_VALUE =                 generated
 
```
    The Public Key object is created with the following attribute values:
```
      CKA_CLASS =             CKO_PUBLIC_KEY
      CKA_TOKEN =             false
      CKA_PRIVATE =           default
      CKA_MODIFIABLE =        default
      CKA_LABEL =             default
      CKA_KEY_TYPE =          CKK_EC
      CKA_ID =                default
      CKA_START_DATE =        default
      CKA_END_DATE =          default
      CKA_DERIVE =            default
      CKA_LOCAL =             true
      CKA_SUBJECT =           default
      CKA_ENCRYPT =           false
      CKA_VERIFY =            true
      CKA_VERIFY_RECOVER =    default
      CKA_WRAP =              default
      CKA_EC_PARAMS =         DER-encoding of <CODE>ecDomainParams</CODE>
      CKA_VALUE =             generated
 
```
    Note:
    
    Because the private key is created as a private object, the normal user must be logged in. Because the private key is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    
    Because the public key is created as a session object, once the session is closed, the public key object will be destroyed and can no longer be accessed.
    FIPS 140-2:
    
    FIPS Service: Key Generation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 crypto officer role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    ecDomainParams - [FIPS 140-2 data input] EC domain parameters
    
    Returns:
    [FIPS 140-2 data output] the handle of the public key [0] and private key [1]
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while generating the EC key pair
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.2 SP2
  - createRSADecryptionKeys
```
public long[] createRSADecryptionKeys(long sessionHandle,
                             int strength)
                               throws UserFatalException
```
    Generates an RSA encryption key pair on the token.
    The private key is created on the token and the public key is created as a session object (not saved on the token). This method returns an array containing the handle for the public key [0] and the handle for the private key [1].
    
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 "Private Keys"
      CKA_KEY_TYPE =              CKK_RSA
      CKA_ID =                    default
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 true
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               true
      CKA_SIGN =                  false
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_MODULUS =               generated
      CKA_PUBLIC_EXPONENT =       generated
      CKA_PRIVATE_EXPONENT =      generated
      CKA_PRIME_1 =               generated
      CKA_PRIME_2 =               generated
      CKA_EXPONENT_1 =            generated
      CKA_EXPONENT_2 =            generated
      CKA_COEFFICIENT =           generated
 
```
    The Public Key object is created with the following attribute values:
```
      CKA_CLASS =             CKO_PUBLIC_KEY
      CKA_TOKEN =             false
      CKA_PRIVATE =           default
      CKA_MODIFIABLE =        default
      CKA_LABEL =             default
      CKA_KEY_TYPE =          CKK_RSA
      CKA_ID =                default
      CKA_START_DATE =        default
      CKA_END_DATE =          default
      CKA_DERIVE =            default
      CKA_LOCAL =             true
      CKA_SUBJECT =           default
      CKA_ENCRYPT =           true
      CKA_VERIFY =            false
      CKA_VERIFY_RECOVER =    default
      CKA_WRAP =              default
      CKA_MODULUS =           generated
      CKA_MODULUS_BITS =      <CODE>strength</CODE>
      CKA_PUBLIC_EXPONENT =   generated
 
```
    Note:
    
    Because the private key is created as a private object, the normal user must be logged in. Because the private key is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    
    Because the public key is created as a session object, once the session is closed, the public key object will be destroyed and can no longer be accessed.
    FIPS 140-2:
    
    FIPS Service: Key Generation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 crypto officer role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    strength - [FIPS 140-2 data input] the strength (modulus length) of the RSA key pair
    
    Returns:
    [FIPS 140-2 data output] the handle of the public key [0] and private key [1]
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while generating the RSA key pair
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - createRSADecryptionKeys
```
public long[] createRSADecryptionKeys(long sessionHandle,
                             int strength,
                             byte[] publicExponent)
                               throws UserFatalException
```
    Generates an RSA decryption key pair on the token.
    The private key is created on the token and the public key is created as a session object (not saved on the token). This method returns an array containing the handle for the public key [0] and the handle for the private key [1].
    
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 "Signing Key"
      CKA_KEY_TYPE =              CKK_RSA
      CKA_ID =                    default
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 true
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               true
      CKA_SIGN =                  false
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_MODULUS =               generated
      CKA_PUBLIC_EXPONENT =       <CODE>publicExponent</CODE>
      CKA_PRIVATE_EXPONENT =      generated
      CKA_PRIME_1 =               generated
      CKA_PRIME_2 =               generated
      CKA_EXPONENT_1 =            generated
      CKA_EXPONENT_2 =            generated
      CKA_COEFFICIENT =           generated
 
```
    The Public Key object is created with the following attribute values:
```
      CKA_CLASS =             CKO_PUBLIC_KEY
      CKA_TOKEN =             false
      CKA_PRIVATE =           default
      CKA_MODIFIABLE =        default
      CKA_LABEL =             default
      CKA_KEY_TYPE =          CKK_RSA
      CKA_ID =                default
      CKA_START_DATE =        default
      CKA_END_DATE =          default
      CKA_DERIVE =            default
      CKA_LOCAL =             true
      CKA_SUBJECT =           default
      CKA_ENCRYPT =           true
      CKA_VERIFY =            false
      CKA_VERIFY_RECOVER =    default
      CKA_WRAP =              default
      CKA_MODULUS =           generated
      CKA_MODULUS_BITS =      <CODE>strength</CODE>
      CKA_PUBLIC_EXPONENT =   <CODE>publicExponent</CODE>
 
```
    Note:
    
    Because the private key is created as a private object, the normal user must be logged in. Because the private key is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    
    Because the public key is created as a session object, once the session is closed, the public key object will be destroyed and can no longer be accessed.
    FIPS 140-2:
    
    FIPS Service: Key Generation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 crypto officer role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    strength - [FIPS 140-2 data input] the strength (modulus length) of the RSA key pair
    publicExponent - [FIPS 140-2 data input] [FIPS 140-2 CSP] the public exponent value (e) of the RSA key pair
    
    Returns:
    [FIPS 140-2 data output] the handle of the public key [0] and private key [1]
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while generating the RSA key pair
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - generateRSAKeyPair
```
public long[] generateRSAKeyPair(long sessionHandle,
                        java.lang.String label,
                        boolean encryptAllowed,
                        boolean signAllowed,
                        int strength,
                        byte[] publicExponent)
                          throws UserFatalException
```
    Generates an RSA key pair on the token.
    The private key is created on the token and the public key is created as a session object (not saved on the token). This method returns an array containing the handle for the public key [0] and the handle for the private key [1].
    
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 <CODE>label</CODE>
      CKA_KEY_TYPE =              CKK_RSA
      CKA_ID =                    default
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 true
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               <CODE>encryptAllowed</CODE>
      CKA_SIGN =                  <CODE>signAllowed</CODE>
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_MODULUS =               generated
      CKA_PUBLIC_EXPONENT =       <CODE>publicExponent</CODE>
      CKA_PRIVATE_EXPONENT =      generated
      CKA_PRIME_1 =               generated
      CKA_PRIME_2 =               generated
      CKA_EXPONENT_1 =            generated
      CKA_EXPONENT_2 =            generated
      CKA_COEFFICIENT =           generated
 
```
    The Public Key object is created with the following attribute values:
```
      CKA_CLASS =             CKO_PUBLIC_KEY
      CKA_TOKEN =             false
      CKA_PRIVATE =           default
      CKA_MODIFIABLE =        default
      CKA_LABEL =             default
      CKA_KEY_TYPE =          CKK_RSA
      CKA_ID =                default
      CKA_START_DATE =        default
      CKA_END_DATE =          default
      CKA_DERIVE =            default
      CKA_LOCAL =             true
      CKA_SUBJECT =           default
      CKA_ENCRYPT =           <CODE>encryptAllowed</CODE>
      CKA_VERIFY =            <CODE>signAllowed</CODE>
      CKA_VERIFY_RECOVER =    default
      CKA_WRAP =              default
      CKA_MODULUS =           generated
      CKA_MODULUS_BITS =      <CODE>strength</CODE>
      CKA_PUBLIC_EXPONENT =   <CODE>publicExponent</CODE>
 
```
    Note:
    
    Because the private key is created as a private object, the normal user must be logged in. Because the private key is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    
    Because the public key is created as a session object, once the session is closed, the public key object will be destroyed and can no longer be accessed.
    FIPS 140-2:
    
    FIPS Service: Key Generation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 crypto officer role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    label - [FIPS 140-2 data input] the private key object's label on the token — a description of the object
    encryptAllowed - [FIPS 140-2 control input] indicates if the key pair can be used for encryption/decryption
    signAllowed - [FIPS 140-2 control input] indicates if the key pair can be used for signing/verification
    strength - [FIPS 140-2 data input] the strength (modulus length) of the RSA key pair
    publicExponent - [FIPS 140-2 data input] [FIPS 140-2 CSP] the public exponent value (e) of the RSA key pair
    
    Returns:
    [FIPS 140-2 data output] the handle of the public key [0] and private key [1]
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while generating the RSA key pair
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - generateDSAKeyPair
```
public long[] generateDSAKeyPair(long sessionHandle,
                        java.lang.String label,
                        boolean encryptAllowed,
                        boolean signAllowed,
                        byte[] prime,
                        byte[] subprime,
                        byte[] base)
                          throws UserFatalException
```
    Generates an DSA key pair on the token.
    The private key is created on the token and the public key is created as a session object (not saved on the token). This method returns an array containing the handle for the public key [0] and the handle for the private key [1].
    
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 <CODE>label</CODE>
      CKA_KEY_TYPE =              CKK_DSA
      CKA_ID =                    default
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 true
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               <CODE>encryptAllowed</CODE>
      CKA_SIGN =                  <CODE>signAllowed</CODE>
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_PRIME =                 <CODE>prime</CODE>
      CKA_SUBPRIME =              <CODE>subprime</CODE>
      CKA_BASE =                  <CODE>base</CODE>
      CKA_VALUE =                 generated
 
```
    The Public Key object is created with the following attribute values:
```
      CKA_CLASS =             CKO_PUBLIC_KEY
      CKA_TOKEN =             false
      CKA_PRIVATE =           default
      CKA_MODIFIABLE =        default
      CKA_LABEL =             default
      CKA_KEY_TYPE =          CKK_DSA
      CKA_ID =                default
      CKA_START_DATE =        default
      CKA_END_DATE =          default
      CKA_DERIVE =            default
      CKA_LOCAL =             true
      CKA_SUBJECT =           default
      CKA_ENCRYPT =           <CODE>encryptAllowed</CODE>
      CKA_VERIFY =            <CODE>signAllowed</CODE>
      CKA_VERIFY_RECOVER =    default
      CKA_WRAP =              default
      CKA_PRIME =             <CODE>prime</CODE>
      CKA_SUBPRIME =          <CODE>subprime</CODE>
      CKA_BASE =              <CODE>base</CODE>
      CKA_VALUE =             generated
 
```
    Note:
    
    Because the private key is created as a private object, the normal user must be logged in. Because the private key is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    
    Because the public key is created as a session object, once the session is closed, the public key object will be destroyed and can no longer be accessed.
    FIPS 140-2:
    
    FIPS Service: Key Generation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 crypto officer role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    label - [FIPS 140-2 data input] the private key object's label on the token — a description of the object
    encryptAllowed - [FIPS 140-2 control input] indicates if the key pair can be used for encryption/decryption
    signAllowed - [FIPS 140-2 control input] indicates if the key pair can be used for signing/verification
    prime - [FIPS 140-2 data input] the prime value (p) of the DSA key pair
    subprime - [FIPS 140-2 data input] the subprime value (q) of the DSA key pair
    base - [FIPS 140-2 data input] the base value (g) of the DSA key pair
    
    Returns:
    [FIPS 140-2 data output] the handle of the public key [0] and private key [1]
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while generating the DSA key pair
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - generateECKeyPair
```
public long[] generateECKeyPair(long sessionHandle,
                       java.lang.String label,
                       boolean encryptAllowed,
                       boolean signAllowed,
                       java.security.spec.ECParameterSpec ecDomainParams)
                         throws UserFatalException
```
    Generates an EC key pair on the token.
    An attempt is first made to generate the key pair using EC domain parameters encoded in 'named' format. If this fails, a second attempt is made to generate the key pair using EC domain parameters encoded in 'specified' format.
    
    The private key is created on the token and the public key is created as a session object (not saved on the token). This method returns an array containing the handle for the public key [0] and the handle for the private key [1].
    
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 "Signing Key"
      CKA_KEY_TYPE =              CKK_EC
      CKA_ID =                    default
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 true
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               false
      CKA_SIGN =                  true
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_EC_PARAMS =             DER-encoding of <CODE>ecDomainParams</CODE>
      CKA_VALUE =                 generated
 
```
    The Public Key object is created with the following attribute values:
```
      CKA_CLASS =             CKO_PUBLIC_KEY
      CKA_TOKEN =             false
      CKA_PRIVATE =           default
      CKA_MODIFIABLE =        default
      CKA_LABEL =             default
      CKA_KEY_TYPE =          CKK_EC
      CKA_ID =                default
      CKA_START_DATE =        default
      CKA_END_DATE =          default
      CKA_DERIVE =            default
      CKA_LOCAL =             true
      CKA_SUBJECT =           default
      CKA_ENCRYPT =           false
      CKA_VERIFY =            true
      CKA_VERIFY_RECOVER =    default
      CKA_WRAP =              default
      CKA_EC_PARAMS =         DER-encoding of <CODE>ecDomainParams</CODE>
      CKA_VALUE =             generated
 
```
    Note:
    
    Because the private key is created as a private object, the normal user must be logged in. Because the private key is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    
    Because the public key is created as a session object, once the session is closed, the public key object will be destroyed and can no longer be accessed.
    FIPS 140-2:
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    label - [FIPS 140-2 data input] the private key object's label on the token — a description of the object
    encryptAllowed - [FIPS 140-2 control input] indicates if the key pair can be used for encryption/decryption
    signAllowed - [FIPS 140-2 control input] indicates if the key pair can be used for signing/verification
    ecDomainParams - [FIPS 140-2 data input] EC domain parameters
    
    Returns:
    [FIPS 140-2 data output] the handle of the public key [0] and private key [1]
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while generating the EC key pair
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.2 SP2
  - create3DESKey
```
public long create3DESKey(long sessionHandle)
                   throws UserFatalException
```
    Generates an DESede unwrapping key on the token.
    The Secret Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_SECRET_KEY
      CKA_TOKEN =                 true/false
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 default
      CKA_KEY_TYPE =              CKK_DES3
      CKA_SENSITIVE =             default
      CKA_ENCRYPT =               default
      CKA_DECRYPT =               default
      CKA_SIGN =                  default
      CKA_VERIFY =                default
      CKA_WRAP                    default
      CKA_UNWRAP                  true
      CKA_EXTRACTABLE             true
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (false)
      CKA_VALUE =                 generated
      CKA_VALUE_LEN =             default
 
```
    An attempt is first made to generate the DESede key as a token object, if that fails, a second attempt is made to generate the DESede key as a session object (required to support DataKey).
    FIPS 140-2:
    
    FIPS Service: Key Generation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 crypto officer role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    
    Returns:
    [FIPS 140-2 data output] the handle of the secret key
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while generating the DESede key
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - get3DESKeySecure
```
public SecretKey get3DESKeySecure(long sessionHandle,
                         long keyHandle)
                           throws UserFatalException
```
    Securely obtains a DESede secret key from a token using RSA wrapping.
    The DESede secret key is obtained as follows:
    - Create an RSA key pair in software
    - Wrap the DESede key on the token using the public RSA key
    - Transfer the wrapped DESede key on the token to the software
    - Unwrap the DESede key in software using the private RSA key
    FIPS 140-2:
    
    FIPS Service: Key Transport (primitive)
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    keyHandle - [FIPS 140-2 control input] the handle of the DESede key to be securely obtain
    
    Returns:
    [FIPS 140-2 data output] [FIPS 140-2 CSP] the DESede secret key from the token
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while securely obtaining the DESede key object from the token
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - wrapKeyRSA
```
public byte[] wrapKeyRSA(long sessionHandle,
                long keyHandle,
                byte[] modulus,
                byte[] publicExponent)
                  throws UserFatalException
```
    Wraps a DESede key on the token with the provided RSA public key.
    FIPS 140-2:
    
    FIPS Service: Key Transport (primitive)
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    keyHandle - [FIPS 140-2 control input] the handle of the DESede key to be wrapped
    modulus - [FIPS 140-2 data input] [FIPS 140-2 CSP] the modulus value (n) of the RSA public key
    publicExponent - [FIPS 140-2 data input] [FIPS 140-2 CSP] the public exponent value (e) of the RSA public key
    
    Returns:
    [FIPS 140-2 data output] the wrapped DESede key as a byte array
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while wrapping the DESede key
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - unwrapDecryptionKey
```
public long unwrapDecryptionKey(long sessionHandle,
                       long wrappingKeyHandle,
                       byte[] wrappedKey,
                       byte[] id)
                         throws UserFatalException
```
    Unwraps an RSA decryption key on the token using the specified DESede secret key.
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 "Private Keys"
      CKA_KEY_TYPE =              CKK_RSA
      CKA_ID =                    <CODE>id</CODE>
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 false
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               true
      CKA_SIGN =                  false
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_MODULUS =               unwrapped
      CKA_PUBLIC_EXPONENT =       unwrapped
      CKA_PRIVATE_EXPONENT =      unwrapped
      CKA_PRIME_1 =               unwrapped
      CKA_PRIME_2 =               unwrapped
      CKA_EXPONENT_1 =            unwrapped
      CKA_EXPONENT_2 =            unwrapped
      CKA_COEFFICIENT =           unwrapped
 
```
    Note:
    
    Because this object is created as a private object, the normal user must be logged in. Because the object is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    FIPS 140-2:
    
    FIPS Service: Key Transport (primitive)
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    wrappingKeyHandle - [FIPS 140-2 control input] the handle of the DESede key used for unwrapping
    wrappedKey - [FIPS 140-2 data input] [FIPS 140-2 CSP] the DESede wrapped decryption key to be unwrapped
    id - [FIPS 140-2 data input] key identifier for the decryption key
    
    Returns:
    [FIPS 140-2 data output] the handle of the unwrapped RSA decryption key
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while unwrapping the decryption key
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - unwrapRSAPrivateKey
```
public long unwrapRSAPrivateKey(long sessionHandle,
                       long wrappingKeyHandle,
                       java.lang.String label,
                       byte[] id,
                       boolean encryptAllowed,
                       boolean signAllowed,
                       byte[] wrappedKey)
                         throws UserFatalException
```
    Unwraps an RSA private key on the token using the specified DESede secret key.
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 <CODE>label</CODE>
      CKA_KEY_TYPE =              CKK_RSA
      CKA_ID =                    <CODE>id</CODE>
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 false
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               <CODE>encryptAllowed</CODE>
      CKA_SIGN =                  <CODE>signAllowed</CODE>
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_MODULUS =               unwrapped
      CKA_PUBLIC_EXPONENT =       unwrapped
      CKA_PRIVATE_EXPONENT =      unwrapped
      CKA_PRIME_1 =               unwrapped
      CKA_PRIME_2 =               unwrapped
      CKA_EXPONENT_1 =            unwrapped
      CKA_EXPONENT_2 =            unwrapped
      CKA_COEFFICIENT =           unwrapped
 
```
    Note:
    
    Because this object is created as a private object, the normal user must be logged in. Because the object is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    FIPS 140-2:
    
    FIPS Service: Key Transport (primitive)
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    wrappingKeyHandle - [FIPS 140-2 control input] the handle of the DESede key used for unwrapping
    id - [FIPS 140-2 data input] key identifier for the private key
    encryptAllowed - [FIPS 140-2 control input] indicates if the private key can be used for encryption/decryption
    signAllowed - [FIPS 140-2 control input] indicates if the private key can be used for signing/verification
    wrappedKey - [FIPS 140-2 data input] [FIPS 140-2 CSP] the DESede wrapped RSA key to be unwrapped
    
    Returns:
    [FIPS 140-2 data output] the handle of the unwrapped RSA private key
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while unwrapping the private key
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - unwrapDSAPrivateKey
```
public long unwrapDSAPrivateKey(long sessionHandle,
                       long wrappingKeyHandle,
                       java.lang.String label,
                       byte[] id,
                       boolean encryptAllowed,
                       boolean signAllowed,
                       byte[] wrappedKey)
                         throws UserFatalException
```
    Unwraps an DSA private key on the token using the specified DESede secret key.
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 <CODE>label</CODE>
      CKA_KEY_TYPE =              CKK_DSA
      CKA_ID =                    <CODE>id</CODE>
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 false
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               <CODE>encryptAllowed</CODE>
      CKA_SIGN =                  <CODE>signAllowed</CODE>
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_PRIME =                 unwrapped
      CKA_SUBPRIME =              unwrapped
      CKA_BASE =                  unwrapped
      CKA_VALUE =                 unwrapped
 
```
    Note:
    
    Because this object is created as a private object, the normal user must be logged in. Because the object is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    FIPS 140-2:
    
    FIPS Service: Key Transport (primitive)
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    wrappingKeyHandle - [FIPS 140-2 control input] the handle of the DESede key used for unwrapping
    id - [FIPS 140-2 data input] key identifier for the private key
    encryptAllowed - [FIPS 140-2 control input] indicates if the private key can be used for encryption/decryption
    signAllowed - [FIPS 140-2 control input] indicates if the private key can be used for signing/verification
    wrappedKey - [FIPS 140-2 data input] [FIPS 140-2 CSP] the DESede wrapped DSA key to be unwrapped
    
    Returns:
    [FIPS 140-2 data output] the handle of the unwrapped DSA private key
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while unwrapping the private key
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.0
  - unwrapECPrivateKey
```
public long unwrapECPrivateKey(long sessionHandle,
                      long wrappingKeyHandle,
                      java.lang.String label,
                      byte[] id,
                      boolean encryptAllowed,
                      boolean signAllowed,
                      byte[] wrappedKey)
                        throws UserFatalException
```
    Unwraps an EC private key on the token using the specified DESede secret key.
    The Private Key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_PRIVATE_KEY
      CKA_TOKEN =                 true
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_LABEL =                 <CODE>label</CODE>
      CKA_KEY_TYPE =              CKK_EC
      CKA_ID =                    <CODE>id</CODE>
      CKA_START_DATE =            default
      CKA_END_DATE =              default
      CKA_DERIVE =                default
      CKA_LOCAL =                 false
      CKA_SUBJECT =               default
      CKA_SENSITIVE =             true
      CKA_DECRYPT =               <CODE>encryptAllowed</CODE>
      CKA_SIGN =                  <CODE>signAllowed</CODE>
      CKA_SIGN_RECOVER =          default
      CKA_UNWRAP =                default
      CKA_EXTRACTABLE =           false
      CKA_ALWAYS_SENSITIVE =      automatic (true)
      CKA_NEVER_EXTRACTABLE =     automatic (true)
      CKA_EC_PARAMS =             unwrapped
      CKA_VALUE =                 unwrapped
 
```
    Note:
    
    Because this object is created as a private object, the normal user must be logged in. Because the object is created as a 'sensitive' and 'non-extractable' object, certain attributes cannot be later retrieved from the token.
    FIPS 140-2:
    
    FIPS Service: Key Transport (primitive)
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    wrappingKeyHandle - [FIPS 140-2 control input] the handle of the DESede key used for unwrapping
    id - [FIPS 140-2 data input] key identifier for the private key
    encryptAllowed - [FIPS 140-2 control input] indicates if the private key can be used for encryption/decryption
    signAllowed - [FIPS 140-2 control input] indicates if the private key can be used for signing/verification
    wrappedKey - [FIPS 140-2 data input] [FIPS 140-2 CSP] the DESede wrapped DSA key to be unwrapped
    
    Returns:
    [FIPS 140-2 data output] the handle of the unwrapped EC private key
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while unwrapping the private key
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.2 SP2
  - createSymmetricKey
```
public long createSymmetricKey(long sessionHandle,
                      java.lang.String label,
                      SymmetricKeyType keyType,
                      int keySizeInBytes,
                      boolean tokenObject,
                      boolean extractable,
                      boolean forEncrypt,
                      boolean forMac)
                        throws UserFatalException
```
    Creates a symmetric key object of the given type, return the handle to it.
    The key object is created with the following attribute values:
```
      CKA_CLASS =                 CKO_SECRET_KEY
      CKA_LABEL =                 label
      CKA_TOKEN =                 tokenObject
      CKA_PRIVATE =               true
      CKA_MODIFIABLE =            default
      CKA_KEY_TYPE =              keyType
      CKA_SENSITIVE =             default
      CKA_ENCRYPT =               forEncrypt
      CKA_DECRYPT =               forEncrypt
      CKA_SIGN =                  forMac
      CKA_VERIFY =                forMac
      CKA_WRAP                    forEncrypt
      CKA_UNWRAP                  forEncrypt
      CKA_EXTRACTABLE             extractable
      CKA_VALUE =                 generated
      CKA_VALUE_LEN =             keySizeInBytes
 
```
    An attempt is first made to generate the DESede key as a token object, if that fails, a second attempt is made to generate the DESede key as a session object (required to support DataKey).
    FIPS 140-2:
    
    FIPS Service: Key Generation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 crypto officer role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data input interface (parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    label - [FIPS 140-2 control input] the text label to give to the key.
    keyType - [FIPS 140-2 data input] the type of the key to create.
    keySizeInBytes - [FIPS 140-2 data input] the number of bytes in the key. To use the default key length for the given key type, set this value to 0.
    tokenObject - [FIPS 140-2 control input] whether or not this key should be created as a token object or a session object.
    extractable - [FIPS 140-2 control input] the value to give to the CKA_EXTRACTABLE attribute in the key's template. Note that marking a key as extractable does not necessarily mean the actual key can be extracted in plain form.
    forEncypt - [FIPS 140-2 control input] whether or not this key is to be used for encryption, decryption, and key wrapping purposes.
    forMac - [FIPS 140-2 control input] whether or not this key is to be used for calculating MAC values.
    
    Returns:
    [FIPS 140-2 data output] the handle of the secret key.
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs while generating the key.
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
    Since:
    
    7.2 SP2 Patch
  - getSecretKeyLength
```
public int getSecretKeyLength(long sessionHandle,
                     long objectHandle)
                       throws UserFatalException
```
    Obtains the key length from a secret key object stored on a token by reading the CKA_VALUE_LEN attribute of the object.
    
    Note:
    
    Unless the normal user is logged in, only public objects can be accessed.
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    sessionHandle - [FIPS 140-2 control input] the session's handle
    objectHandle - [FIPS 140-2 control input] the secret key's object handle
    
    Returns:
    [FIPS 140-2 data output] the key length (in bytes)
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] if an error occurs while obtaining the secret key object's length
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - getTemporarySession
```
public long getTemporarySession(long slotID)
                         throws UserFatalException
```
    Gets a temporary session handle from the PKCS11 library, to be used when crypto operations may be executed by multiple threads simultaneously.
    FIPS 140-2:
    
    FIPS Service: Query Object
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    data output interface (return value)
    
    status output interface (exceptions)
    Parameters:
    slotID - [FIPS 140-2 control input] the ID of the slot on which to obtain the session
    
    Returns:
    [FIPS 140-2 data output] the handle to the temporary session
    
    Throws:
    
    UserFatalException - [FIPS 140-2 status output] thrown if an error occurs getting a session
    
    Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations
  - releaseTemporarySession
```
public void releaseTemporarySession(long slotID,
                           long sessionHandle)
```
    Releases a temporary session handle previously obtained through a call to getTemporarySession(long).
    It is important to call this function when you are finished with a session, as only a limited number of sessions will be allowed by the PKCS#11 library.
    FIPS 140-2:
    
    FIPS Service: Non-Cryptographic Operation
    
    This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces:
    
    control input interface (API call, parameters)
    
    status output interface (exceptions)
    Parameters:
    slotID - [FIPS 140-2 control input] the ID of the slot on which to release the session
    sessionHandle - [FIPS 140-2 control input] the handle of the session to be released
  - closeTemporarySessions
```
public void closeTemporarySessions(long slotID)
                            throws UserFatalException
```
    Closes all released temporary session handles for a particular slot.
    A released temporary session handle is a session handle that was previously obtained through a call to getTemporarySession(long) and also released through a call to releaseTemporarySession(long, long) .
    It is important to call this function once all temporary sessions for a particular slot have been released, and you are finished using these temporary sessions on the slot; otherwise a later attempt to login a Security Officer could fail with a CKR_SESION_READ_ONLY_EXISTS. FIPS 140-2: FIPS Service: Non-Cryptographic Operation This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces: control input interface (API call, parameters) status output interface (exceptions)
    Parameters: slotID - [FIPS 140-2 control input] the ID of the slot on which to close the sessions Throws: UserFatalException - [FIPS 140-2 status output] thrown if an error while closing the temporary sessions Since: 7.0
  getEcdsaDigestFormat public JNIPKCS11.EcdsaDigestFormat getEcdsaDigestFormat(long slotId) throws UserFatalException Determines the ECDSA digest format used by the PKCS#11 device. Refer to JNIPKCS11.EcdsaDigestFormat for additional details. FIPS 140-2: FIPS Service: Query Object This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces: control input interface (API call, parameters) status output interface (exceptions) Parameters: slotId - [FIPS 140-2 control input] a slot ID on the PKCS#11 device that the normal user is currently logged into Returns: [FIPS 140-2 status output] the ECDSA digest format Throws: UserFatalException - [FIPS 140-2 status output] if an error occurred while attempting to determine the ECDSA digest format Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations Since: 7.2 SP2 formatEcdsaDigest public static byte[] formatEcdsaDigest(byte[] digest, JNIPKCS11.EcdsaDigestFormat format, java.security.spec.ECParameterSpec ecDomainParams) Formats a digest using one of the supported ECDSA digest format methods. Refer to JNIPKCS11.EcdsaDigestFormat for additional details. FIPS 140-2: FIPS Service: Non-Cryptographic Operation This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces: control input interface (API call, parameters) data input interface (parameters) data output interface (return value) status output interface (exceptions) Parameters: [FIPS - 140-2 data input] digest the digest [FIPS - 140-2 control input] format the ECDSA digest format to be applied [FIPS - 140-2 data input] ecDomainParams the EC domain parameters of the key being used to perform the ECDSA operation Returns: [FIPS 140-2 data output] the formatted digest Throws: Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations Since: 7.2 SP2 convertEcdsaSignaturePkcs11ToAnsix963 public static byte[] convertEcdsaSignaturePkcs11ToAnsix963(byte[] signature) Converts an ECDSA signature produced by a PKCS#11 device to standard ASNI X9-63-2005 format. PKCS#11 devices produce signatures in a format that differs from what ASNI X9-63-2005; both signature formats are described below. PKCS #11 v2.20, Section 12.3.1 For the purposes of these mechanisms, an ECDSA signature is an octet string of even length which is at most two times nLen octets, where nLen is the length in octets of the base point order n. The signature octets correspond to the concatenation of the ECDSA values r and s, both represented as an octet string of equal length of at most nLen with the most significant byte first. If r and s have different octet length, the shorter of both must be padded with leading zero octets such that both have the same octet length. Loosely spoken, the first half of the signature is r and the second half is s. For signatures created by a token, the resulting signature is always of length 2nLen. For signatures passed to a token for verification, the signature may have a shorter length but must be composed as specified before. ASNI X9-63-2005 Section E.8 - Digital Signatures When a digital signature is represented with ASN.1, the digital signature shall be ASN.1 encoded using the following syntax: ECDSA-Sig-Value ::= SEQUENCE { r INTEGER, s INTEGER } FIPS 140-2: FIPS Service: Non-Cryptographic Operation This API is part of the logical interface to the Toolkit's FIPS 140-2 cryptographic module; use of this API causes the caller to assume the FIPS 140-2 user role and accesses the following FIPS 140-2 logical interfaces: control input interface (API call) data input interface (parameters) data output interface (return value) status output interface (exceptions) Parameters: [FIPS - 140-2 data input] signature an ECDSA signature produced by a PKCS#11 device Returns: [FIPS 140-2 data output] the signature in ASNI X9-63-2005 ECDSA signature format Throws: Fips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not allowed to perform cryptographic operations Since: 7.2 SP2

Class JNIPKCS11

Nested Class Summary

Field Summary

Method Summary

Methods inherited from class java.lang.Object

Field Detail

CKK_RSA

CKK_DSA

CKK_EC

CKU_SO

CKU_USER

CKG_MGF1_SHA1

CKG_MGF1_SHA256

CKG_MGF1_SHA384

CKG_MGF1_SHA512

CKG_MGF1_SHA224

Method Detail

getInfo

getSlotList

getSlotInfo

getTokenInfo

getMechanismList

getMechanismInfo

initToken

initPin

setPin

openSession

closeSession

closeAllSessions

getSessionInfo

login

logout

setStringObject

setStringObject

setIntObject

setByteArrayObject

setByteArrayObject

setCertificate

setCertificate

setCertificate

setCertificate

setRSASigningKey

setDSASigningKey

addDecryptionKey

setRSAPrivateKey

setDSAPrivateKey

setECPrivateKey

addDecryptionKeySecure

setRSAPrivateKeySecure

setDSAPrivateKeySecure

setECPrivateKeySecure

destroyObject

getStringObject

getByteArrayObject

getCertificate

getLabel

getKeyID

getKeyType

getSigningKeyType

getRSAPublicKeyModulus

getRSAPrivateKeyModulus

getRSAPublicKeyPublicExp

getDSAPublicKeyY

getDSAParams

getECPublicPoint

getECDomainParams

setNewLabel

setKeyID

getAllObjectHandles

getStringHandle

getByteArrayHandle

getDataObjectHandle

getDataObjectHandles

getDataObjectHandles

getCertificateHandle

getCertificateHandle

getCertificateHandles

getSigningKeyHandle

getOldSigningKeyHandle

getDecryptionKeyHandle