RFE: CKA_UNWRAP_TEMPLATE Support
Open
Nobody has claimed this yet.
enhancement
- Dominant language
- Python
- Stars
- 170
- Forks
- 79
- PR merge metrics
- No merged PRs in 30d
Description
Hi!
Are you able to add support for CKA_UNWRAP_TEMPLATE?
I'd like to generate wrapping keys that cannot be used to bypass CKA_EXTRACTABLE via wrap+unwrap operations.
key = session.generate_key(pkcs11.KeyType.AES, key_length=256, label='ABC1234', store=True, template={
pkcs11.Attribute.SENSITIVE: True,
pkcs11.Attribute.EXTRACTABLE: False,
pkcs11.Attribute.WRAP: True,
pkcs11.Attribute.UNWRAP: True,
pkcs11.Attribute.UNWRAP_TEMPLATE: {pkcs11.Attribute.EXTRACTABLE: False},
});
The above code produces:
NotImplementedError: Can't pack this Attribute.UNWRAP_TEMPLATE. Expand ATTRIBUTE_TYPES!
Thanks for the great library!
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at ATTRIBUTE_TYPES and follow the packing path reached by session.generate_key with Attribute.UNWRAP_TEMPLATE. Check how nested attribute templates are represented, then add coverage for the example template and confirm that key generation no longer raises NotImplementedError.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cryptography
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100