FreeHSM C — PKCS#11 v3.2 mechanism dispatch reference

Auto-generated by scripts/gen_p11_thunks.py. Do not edit by hand.

Profile generated: all-mechanisms Total mechanisms: 94 Approved: 81 Non-approved: 13

Reading this table

• FIPS column : ✅ = approved (dispatchable in nist-approved-only), ❌ = non-approved (rejected with FHSM_RV_FIPS_NOT_APPROVED in nist-approved-only, dispatchable but audited in all-mechanisms).
• Op column : the PKCS#11 operation category.

• Handler : the C symbol invoked after argument validation. In nist-approved-only, non-approved mechanisms have their handler replaced by dispatch_reject_fips at code-gen time.

  Two axes, not one. This table is about the BUILD profile: what is compiled in at all. Whether a compiled-in but non-approved mechanism may then run is the runtime mode (FHSM_MODE=strict or permissive), and no setting there can reach a mechanism this table shows as absent.

Documented deviations from the specification

Things this module does that PKCS#11 permits but does not require, or that it refuses where the specification allows more. Listed so that a caller meets them here rather than in a failure.

AAD length, AES-GCM and AES-CCM

ulAADLen is capped at 1 MiB. Longer is CKR_MECHANISM_PARAM_INVALID.

PKCS#11 v3.2 allows up to 2^32-1 and RFC 3610 allows more. This module is loaded into the calling application’s process, and the AAD has to be copied at C_EncryptInit time because the mechanism parameter block belongs to the caller and the specification only guarantees it for the duration of that call. Honouring the specification’s ceiling literally would mean allocating up to 4 GB on the strength of a caller-supplied length field.

The cap was 4096 bytes and fixed, which refused the ACVP CCM vectors at 8192 (reported by petrn, issue #15). It is now a bound on a heap allocation rather than the size of an array, and two orders of magnitude above anything the module is measured against.

AES-GMAC requires an IV

CKM_AES_GMAC without a parameter block is CKR_MECHANISM_PARAM_INVALID, and a raw IV shorter than 12 bytes is refused. It previously became CKM_AES_CMAC silently. Set FHSM_OPENSC_GMAC_ALIAS=1 to restore the old substitution.

AES

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_AES_KEY_GEN	0x00001080	keygen	✅	dispatch_aes_keygen	FIPS 197
CKM_AES_CBC	0x00001082	encrypt	✅	dispatch_aes_cbc	FIPS 197, SP 800-38A
CKM_AES_CBC_PAD	0x00001085	encrypt	✅	dispatch_aes_cbc_pad	FIPS 197, SP 800-38A, RFC 5652 (PKCS#7 padding)
					No integrity: decryption reports whether the PKCS#7 padding was valid, which is a padding oracle (Vaudenay 2002, POODLE). Inherent to the mechanism and not fixable in the module – C_Decrypt has to return something. Prefer CKM_AES_GCM or CKM_AES_KEY_WRAP where an attacker can submit chosen ciphertexts. See R2 in docs/PKCS11_CHECK_FINDINGS.md.
CKM_AES_GCM	0x00001087	encrypt	✅	dispatch_aes_gcm	FIPS 197, SP 800-38D
					IV length fixed at 96 bits; tag length fixed at 128 bits in approved mode.
CKM_AES_CCM	0x00001088	encrypt	✅	dispatch_aes_ccm	FIPS 197, SP 800-38C
CKM_AES_CTR	0x00001086	encrypt	✅	dispatch_aes_ctr	FIPS 197, SP 800-38A
CKM_AES_KEY_WRAP	0x00002109	wrap+encrypt	✅	dispatch_aes_kw	FIPS 197, SP 800-38F, RFC 3394
					PKCS#11 v3.2 §6.16.3: single-part wrap/unwrap AND single-part encrypt/decrypt. Encrypt input must be an exact multiple of the 8-byte semiblock; use KWP for other lengths.
CKM_AES_KEY_WRAP_KWP	0x0000210B	wrap+encrypt	✅	dispatch_aes_kwp	FIPS 197, SP 800-38F §6.3, RFC 5649
					PKCS#11 v3.2 §6.16.3: wraps a key or encrypts a data block of any length, zero-padded per SP 800-38F §6.3.
CKM_AES_CMAC	0x0000108A	sign	✅	dispatch_aes_cmac	FIPS 197, SP 800-38B
CKM_AES_GMAC	0x0000108E	sign	✅	dispatch_aes_gmac	FIPS 197, SP 800-38D §6.4
					GCM with AAD and no plaintext; the output is the 16-byte tag. Distinct from CKM_AES_CMAC (SP 800-38B), whose code point 0x108A this mechanism was once confused with.
CKM_AES_ECB	0x00001081	encrypt	✅	dispatch_aes_ecb	FIPS 197, SP 800-38A
					ECB single-block only; rejected for any input > 16 bytes.

Composite-Sig

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_COMPOSITE_MLDSA65_ED25519	0x80004202	sign	❌	dispatch_composite_mldsa65_ed25519	draft-ietf-lamps-pq-composite-sigs-19, id-MLDSA65-Ed25519-SHA512, OID 1.3.6.1.5.5.7.6.48
					_Composite ML-DSA as specified: both components sign the message representative M’ = Prefix		Label		len(ctx)		ctx		SHA-512(M), the ML-DSA component receives the Label as its FIPS 204 context, and the output is mldsaSig		tradSig. Unlike CKM_HYBRID_ED25519ML_DSA_65 the components are NOT separable: neither half verifies against the bare message. Interop-only – see the comment in gen_p11_thunks.py for why it is not announced as approved.

DES

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_DES_KEY_GEN	0x00000120	keygen	❌	dispatch_reject_fips	—
					Single-DES forbidden by SP 800-131A rev. 2.

DH

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_DH_PKCS_KEY_PAIR_GEN	0x00000020	keypair	❌	dispatch_reject_fips	—
					Finite-field DH < 2048 bits forbidden; modern code should use ECDH / X25519.

DSA

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_DSA_KEY_PAIR_GEN	0x00000010	keypair	❌	dispatch_reject_fips	—
					DSA was withdrawn by FIPS 186-5.

EC

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_EC_KEY_PAIR_GEN	0x00001040	keypair	✅	dispatch_ec_keypair	FIPS 186-5
					Approved curves : P-256, P-384, P-521 only.
CKM_ECDSA	0x00001041	sign	✅	dispatch_ecdsa	FIPS 186-5
CKM_ECDSA_SHA256	0x00001044	sign	✅	dispatch_ecdsa_sha256	FIPS 186-5
CKM_ECDSA_SHA384	0x00001045	sign	✅	dispatch_ecdsa_sha384	FIPS 186-5
CKM_ECDSA_SHA512	0x00001046	sign	✅	dispatch_ecdsa_sha512	FIPS 186-5
CKM_ECDH1_DERIVE	0x00001050	derive	✅	dispatch_ecdh1	SP 800-56A rev. 3
CKM_ECDH1_COFACTOR_DERIVE	0x00001051	derive	✅	dispatch_ecdh1_cofactor	SP 800-56A rev. 3

ECM

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_EC_MONTGOMERY_KEY_PAIR_GEN	0x00001056	keypair	❌	dispatch_ecm_keypair	RFC 7748
					Absent from the OpenSSL FIPS provider; all-mechanisms profile only.

EdDSA

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_EC_EDWARDS_KEY_PAIR_GEN	0x00001055	keypair	✅	dispatch_eddsa_keypair	FIPS 186-5
					Ed25519 (curve = 1.3.101.112) and Ed448 (curve = 1.3.101.113).
CKM_EDDSA	0x00001057	sign	✅	dispatch_eddsa	FIPS 186-5, RFC 8032

GENERIC

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_GENERIC_SECRET_KEY_GEN	0x00000350	keygen	✅	dispatch_generic_secret_keygen	SP 800-133 rev. 2

HKDF

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_HKDF_DERIVE	0x0000402A	derive	✅	dispatch_hkdf	SP 800-56C rev. 2
CKM_HKDF_DATA	0x0000402B	derive	✅	dispatch_hkdf_data	SP 800-56C rev. 2
CKM_HKDF_KEY_GEN	0x0000402C	keygen	✅	dispatch_hkdf_keygen	SP 800-56C rev. 2

HMAC

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_SHA_1_HMAC	0x00000221	sign	✅	dispatch_hmac_sha1	FIPS 198-1, SP 800-131A rev. 2
CKM_SHA224_HMAC	0x00000256	sign	✅	dispatch_hmac_sha224	FIPS 198-1, FIPS 180-4
CKM_SHA512_224_HMAC	0x00000049	sign	✅	dispatch_hmac_sha512_224	FIPS 198-1, FIPS 180-4
CKM_SHA512_256_HMAC	0x0000004D	sign	✅	dispatch_hmac_sha512_256	FIPS 198-1, FIPS 180-4
CKM_SHA256_HMAC	0x00000251	sign	✅	dispatch_hmac_sha256	FIPS 198-1, FIPS 180-4
CKM_SHA384_HMAC	0x00000261	sign	✅	dispatch_hmac_sha384	FIPS 198-1, FIPS 180-4
CKM_SHA512_HMAC	0x00000271	sign	✅	dispatch_hmac_sha512	FIPS 198-1, FIPS 180-4
CKM_SHA3_224_HMAC	0x000002B6	sign	✅	dispatch_hmac_sha3_224	FIPS 198-1, FIPS 202
CKM_SHA3_256_HMAC	0x000002B1	sign	✅	dispatch_hmac_sha3_256	FIPS 198-1, FIPS 202
CKM_SHA3_384_HMAC	0x000002C1	sign	✅	dispatch_hmac_sha3_384	FIPS 198-1, FIPS 202
CKM_SHA3_512_HMAC	0x000002D1	sign	✅	dispatch_hmac_sha3_512	FIPS 198-1, FIPS 202

KDF-concat

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_CONCATENATE_BASE_AND_KEY	0x00000360	derive	✅	dispatch_concat_base_and_key	PKCS#11 v3.2 §6.20.1
CKM_CONCATENATE_BASE_AND_DATA	0x00000362	derive	✅	dispatch_concat_base_and_data	PKCS#11 v3.2 §6.20.2
					Also exposed as CKM_CONCATENATE_BASE_AND_DATA_KDF (alias).
CKM_CONCATENATE_DATA_AND_BASE	0x00000363	derive	✅	dispatch_concat_data_and_base	PKCS#11 v3.2 §6.20.3
CKM_XOR_BASE_AND_DATA	0x00000364	derive	✅	dispatch_xor_base_and_data	PKCS#11 v3.2 §6.20.4

MD5

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_MD5	0x00000210	digest	❌	dispatch_md5	RFC 1321
					Forbidden by SP 800-131A rev. 2.

ML-DSA

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_ML_DSA_KEY_PAIR_GEN	0x0000001C	keypair	✅	dispatch_ml_dsa_keypair	FIPS 204
					Parameter set selected via CKA_PARAMETER_SET = ML-DSA-{44,65,87}.
CKM_ML_DSA	0x0000001D	sign	✅	dispatch_ml_dsa	FIPS 204
CKM_HASH_ML_DSA	0x0000001F	sign	✅	dispatch_ml_dsa	FIPS 204
					Data is PH(M); the hash is named in CK_HASH_SIGN_ADDITIONAL_CONTEXT. Single-part.
CKM_HASH_ML_DSA_SHA224	0x00000023	sign	✅	dispatch_ml_dsa	FIPS 204
CKM_HASH_ML_DSA_SHA256	0x00000024	sign	✅	dispatch_ml_dsa	FIPS 204
CKM_HASH_ML_DSA_SHA384	0x00000025	sign	✅	dispatch_ml_dsa	FIPS 204
CKM_HASH_ML_DSA_SHA512	0x00000026	sign	✅	dispatch_ml_dsa	FIPS 204
CKM_HASH_ML_DSA_SHA3_224	0x00000027	sign	✅	dispatch_ml_dsa	FIPS 204
CKM_HASH_ML_DSA_SHA3_256	0x00000028	sign	✅	dispatch_ml_dsa	FIPS 204
CKM_HASH_ML_DSA_SHA3_384	0x00000029	sign	✅	dispatch_ml_dsa	FIPS 204
CKM_HASH_ML_DSA_SHA3_512	0x0000002A	sign	✅	dispatch_ml_dsa	FIPS 204
CKM_HASH_ML_DSA_SHAKE128	0x0000002B	sign	✅	dispatch_ml_dsa	FIPS 204
CKM_HASH_ML_DSA_SHAKE256	0x0000002C	sign	✅	dispatch_ml_dsa	FIPS 204

ML-KEM

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_ML_KEM_KEY_PAIR_GEN	0x0000000F	keypair	✅	dispatch_ml_kem_keypair	FIPS 203
					Parameter set selected via CKA_PARAMETER_SET = ML-KEM-{512,768,1024}.
CKM_ML_KEM	0x00000017	encap	✅	dispatch_ml_kem_encap	FIPS 203

PBKDF2

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_PKCS5_PBKD2	0x000003B0	keygen	✅	dispatch_pbkdf2	SP 800-132, PKCS #5 v2.1
					C_GenerateKey with CK_PKCS5_PBKD2_PARAMS2. fhsm_pbkdf2() enforces the SP 800-132 minimum of 1,000 iterations; the token’s own KEK passes 200,000.

RC4

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_RC4	0x00000111	encrypt	❌	dispatch_reject_fips	—

RSA

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_RSA_PKCS_KEY_PAIR_GEN	0x00000000	keypair	✅	dispatch_rsa_keypair	FIPS 186-5
CKM_RSA_PKCS_PSS	0x0000000D	sign	✅	dispatch_rsa_pss	FIPS 186-5, RFC 8017 §8.1
CKM_SHA256_RSA_PKCS_PSS	0x00000043	sign	✅	dispatch_rsa_pss_sha256	FIPS 186-5
CKM_SHA384_RSA_PKCS_PSS	0x00000044	sign	✅	dispatch_rsa_pss_sha384	FIPS 186-5
CKM_SHA512_RSA_PKCS_PSS	0x00000045	sign	✅	dispatch_rsa_pss_sha512	FIPS 186-5
CKM_RSA_PKCS_OAEP	0x00000009	encrypt	✅	dispatch_rsa_oaep	RFC 8017 §7.1
CKM_RSA_PKCS	0x00000001	encrypt	❌	dispatch_rsa_pkcs	RFC 8017 §7.2
					PKCS#1 v1.5 encryption is deprecated by NIST; padding-oracle risk.
CKM_RSA_X_509	0x00000003	encrypt	❌	dispatch_rsa_x509	—
					Raw RSA — forbidden in approved mode.
CKM_SHA1_RSA_PKCS	0x00000006	sign	❌	dispatch_sha1_rsa	—
					SHA-1 is forbidden for signature generation per SP 800-131A rev. 2. Kept for interop with applications that still verify legacy signatures; refused in the nist-approved-only profile.
CKM_SHA256_RSA_PKCS	0x00000040	sign	✅	dispatch_rsa_pkcs_sha256	FIPS 186-5, RFC 8017 §8.2
CKM_SHA384_RSA_PKCS	0x00000041	sign	✅	dispatch_rsa_pkcs_sha384	FIPS 186-5, RFC 8017 §8.2
CKM_SHA512_RSA_PKCS	0x00000042	sign	✅	dispatch_rsa_pkcs_sha512	FIPS 186-5, RFC 8017 §8.2
CKM_SHA224_RSA_PKCS	0x00000046	sign	✅	dispatch_rsa_pkcs_sha224	FIPS 186-5, RFC 8017 §8.2
CKM_SHA3_224_RSA_PKCS	0x00000066	sign	✅	dispatch_rsa_pkcs_sha3_224	FIPS 186-5, FIPS 202, RFC 8017 §8.2
CKM_SHA3_256_RSA_PKCS	0x00000060	sign	✅	dispatch_rsa_pkcs_sha3_256	FIPS 186-5, FIPS 202, RFC 8017 §8.2
CKM_SHA3_384_RSA_PKCS	0x00000061	sign	✅	dispatch_rsa_pkcs_sha3_384	FIPS 186-5, FIPS 202, RFC 8017 §8.2
CKM_SHA3_512_RSA_PKCS	0x00000062	sign	✅	dispatch_rsa_pkcs_sha3_512	FIPS 186-5, FIPS 202, RFC 8017 §8.2

SHA1

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_SHA_1	0x00000220	digest	❌	dispatch_sha1	FIPS 180-4
					Disallowed for digital signature generation; legacy verify only.

SHA2

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_SHA256	0x00000250	digest	✅	dispatch_sha256	FIPS 180-4
CKM_SHA384	0x00000260	digest	✅	dispatch_sha384	FIPS 180-4
CKM_SHA512	0x00000270	digest	✅	dispatch_sha512	FIPS 180-4
CKM_SHA224	0x00000255	digest	✅	dispatch_sha224	FIPS 180-4
CKM_SHA512_224	0x00000048	digest	✅	dispatch_sha512_224	FIPS 180-4
CKM_SHA512_256	0x0000004C	digest	✅	dispatch_sha512_256	FIPS 180-4

SHA3

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_SHA3_224	0x000002B5	digest	✅	dispatch_sha3_224	FIPS 202
CKM_SHA3_256	0x000002B0	digest	✅	dispatch_sha3_256	FIPS 202
CKM_SHA3_384	0x000002C0	digest	✅	dispatch_sha3_384	FIPS 202
CKM_SHA3_512	0x000002D0	digest	✅	dispatch_sha3_512	FIPS 202

SLH-DSA

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_SLH_DSA_KEY_PAIR_GEN	0x0000002D	keypair	✅	dispatch_slh_dsa_keypair	FIPS 205
					Parameter set selected via CKA_PARAMETER_SET = SLH-DSA-{SHA2,SHAKE}-{128,192,256}{s,f}.
CKM_SLH_DSA	0x0000002E	sign	✅	dispatch_slh_dsa	FIPS 205

TDES

Mechanism	Value	Op	FIPS	Handler	Reference
CKM_DES3_KEY_GEN	0x00000131	keygen	❌	dispatch_des3_keygen	—
					Triple-DES disallowed for encryption after Dec 31 2023 (SP 800-131A rev. 2).
CKM_DES3_CBC	0x00000133	encrypt	❌	dispatch_des3_cbc	—

Cross-references

• The single source of truth for this table is scripts/gen_p11_thunks.py.
• The runtime dispatch table is generated into src/gen/fhsm_dispatch.c.
• The public CKM_* values are generated into include/fhsm_pkcs11_mechanisms.h.
• The Security Policy §4 (docs/FIPS_140_3.md) lists the same approved algorithms grouped by family — the evaluator can diff the two documents to confirm conformance.