Update NSS to NSS_3_16_RC0.

nss/lib/softoken/pkcs11c.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * This file implements PKCS 11 on top of our existing security modules
  *
  * For more information about PKCS 11 See PKCS 11 Token Inteface Standard.
  *   This implementation has two slots:
  *      slot 1 is our generic crypto support. It does not require login.
  *   It supports Public Key ops, and all they bulk ciphers and hashes. 
@@ skipping 44 matching lines @@
 typedef struct {
     PRUint8 client_version[2];
     PRUint8 random[46];
 } SSL3RSAPreMasterSecret;
 
 static void sftk_Null(void *data, PRBool freeit)
 {
     return;
 } 
 
-#ifdef NSS_ENABLE_ECC
+#ifndef NSS_DISABLE_ECC
 #ifdef EC_DEBUG
 #define SEC_PRINT(str1, str2, num, sitem) \
     printf("pkcs11c.c:%s:%s (keytype=%d) [len=%d]\n", \
             str1, str2, num, sitem->len); \
     for (i = 0; i < sitem->len; i++) { \
             printf("%02x:", sitem->data[i]); \
     } \
     printf("\n") 
 #else
 #define SEC_PRINT(a, b, c, d) 
 #endif
-#endif /* NSS_ENABLE_ECC */
+#endif /* NSS_DISABLE_ECC */
 
 /*
  * free routines.... Free local type  allocated data, and convert
  * other free routines to the destroy signature.
  */
 static void
 sftk_FreePrivKey(NSSLOWKEYPrivateKey *key, PRBool freeit)
 {
     nsslowkey_DestroyPrivateKey(key);
 }
@@ skipping 25 matching lines @@
         case SEC_ERROR_NO_MEMORY:
             return CKR_HOST_MEMORY;
         case SEC_ERROR_BAD_SIGNATURE:
             return CKR_SIGNATURE_INVALID;
         case SEC_ERROR_INVALID_KEY:
             return CKR_KEY_SIZE_RANGE;
         case SEC_ERROR_BAD_KEY:  /* an EC public key that fails validation */
             return CKR_KEY_SIZE_RANGE;  /* the closest error code */
         case SEC_ERROR_UNSUPPORTED_EC_POINT_FORM:
             return CKR_TEMPLATE_INCONSISTENT;
-        /* EC functions set this error if NSS_ENABLE_ECC is not defined */
+        /* EC functions set this error if NSS_DISABLE_ECC is defined */
         case SEC_ERROR_UNSUPPORTED_KEYALG:
             return CKR_MECHANISM_INVALID;
         case SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE:
             return CKR_DOMAIN_PARAMS_INVALID;
         /* key pair generation failed after max number of attempts */
         case SEC_ERROR_NEED_RANDOM:
             return CKR_FUNCTION_FAILED;
     }
     return CKR_DEVICE_ERROR;
 }
@@ skipping 2221 matching lines @@
     digest.data = (unsigned char *)dataBuf;
     digest.len = dataLen;
     rv = DSA_SignDigest(&(key->u.dsa), &signature, &digest);
     if (rv != SECSuccess && PORT_GetError() == SEC_ERROR_LIBRARY_FAILURE) {
         sftk_fatalError = PR_TRUE;
     }
     *sigLen = signature.len;
     return rv;
 }
 
-#ifdef NSS_ENABLE_ECC
+#ifndef NSS_DISABLE_ECC
 static SECStatus
 nsc_ECDSAVerifyStub(void *ctx, void *sigBuf, unsigned int sigLen,
                     void *dataBuf, unsigned int dataLen)
 {
     SECItem signature, digest;
     NSSLOWKEYPublicKey *key = (NSSLOWKEYPublicKey *)ctx;
 
     signature.data = (unsigned char *)sigBuf;
     signature.len = sigLen;
     digest.data = (unsigned char *)dataBuf;
@@ skipping 14 matching lines @@
     signature.len = maxSigLen;
     digest.data = (unsigned char *)dataBuf;
     digest.len = dataLen;
     rv = ECDSA_SignDigest(&(key->u.ec), &signature, &digest);
     if (rv != SECSuccess && PORT_GetError() == SEC_ERROR_LIBRARY_FAILURE) {
         sftk_fatalError = PR_TRUE;
     }
     *sigLen = signature.len;
     return rv;
 }
-#endif /* NSS_ENABLE_ECC */
+#endif /* NSS_DISABLE_ECC */
 
 /* NSC_SignInit setups up the signing operations. There are three basic
  * types of signing:
  *      (1) the tradition single part, where "Raw RSA" or "Raw DSA" is applied
  *  to data in a single Sign operation (which often looks a lot like an
  *  encrypt, with data coming in and data going out).
  *      (2) Hash based signing, where we continually hash the data, then apply
  *  some sort of signature to the end.
  *      (3) Block Encryption CBC MAC's, where the Data is encrypted with a key,
  *  and only the final block is part of the mac.
@@ skipping 131 matching lines @@
             break;
         }
         context->cipherInfo = privKey;
         context->update     = (SFTKCipher) nsc_DSA_Sign_Stub;
         context->destroy    = (privKey == key->objectInfo) ?
                 (SFTKDestroy) sftk_Null:(SFTKDestroy)sftk_FreePrivKey;
         context->maxLen     = DSA_MAX_SIGNATURE_LEN;
 
         break;
 
-#ifdef NSS_ENABLE_ECC
+#ifndef NSS_DISABLE_ECC
     case CKM_ECDSA_SHA1:
         context->multi = PR_TRUE;
         crv = sftk_doSubSHA1(context);
         if (crv != CKR_OK) break;
         /* fall through */
     case CKM_ECDSA:
         if (key_type != CKK_EC) {
             crv = CKR_KEY_TYPE_INCONSISTENT;
             break;
         }
         privKey = sftk_GetPrivKey(key,CKK_EC,&crv);
         if (privKey == NULL) {
             crv = CKR_HOST_MEMORY;
             break;
         }
         context->cipherInfo = privKey;
         context->update     = (SFTKCipher) nsc_ECDSASignStub;
         context->destroy    = (privKey == key->objectInfo) ?
                 (SFTKDestroy) sftk_Null:(SFTKDestroy)sftk_FreePrivKey;
         context->maxLen     = MAX_ECKEY_LEN * 2;
 
         break;
-#endif /* NSS_ENABLE_ECC */
+#endif /* NSS_DISABLE_ECC */
 
 #define INIT_HMAC_MECH(mmm) \
     case CKM_ ## mmm ## _HMAC_GENERAL: \
         crv = sftk_doHMACInit(context, HASH_Alg ## mmm ,key, \
                                 *(CK_ULONG *)pMechanism->pParameter); \
         break; \
     case CKM_ ## mmm ## _HMAC: \
         crv = sftk_doHMACInit(context, HASH_Alg ## mmm ,key, mmm ## _LENGTH); \
         break; 
 
@@ skipping 587 matching lines @@
             break;
         }
         pubKey = sftk_GetPubKey(key,CKK_DSA,&crv);
         if (pubKey == NULL) {
             break;
         }
         context->cipherInfo = pubKey;
         context->verify     = (SFTKVerify) nsc_DSA_Verify_Stub;
         context->destroy    = sftk_Null;
         break;
-#ifdef NSS_ENABLE_ECC
+#ifndef NSS_DISABLE_ECC
     case CKM_ECDSA_SHA1:
         context->multi = PR_TRUE;
         crv = sftk_doSubSHA1(context);
         if (crv != CKR_OK) break;
         /* fall through */
     case CKM_ECDSA:
         if (key_type != CKK_EC) {
             crv = CKR_KEY_TYPE_INCONSISTENT;
             break;
         }
         pubKey = sftk_GetPubKey(key,CKK_EC,&crv);
         if (pubKey == NULL) {
             crv = CKR_HOST_MEMORY;
             break;
         }
         context->cipherInfo = pubKey;
         context->verify     = (SFTKVerify) nsc_ECDSAVerifyStub;
         context->destroy    = sftk_Null;
         break;
-#endif /* NSS_ENABLE_ECC */
+#endif /* NSS_DISABLE_ECC */
 
     INIT_HMAC_MECH(MD2)
     INIT_HMAC_MECH(MD5)
     INIT_HMAC_MECH(SHA224)
     INIT_HMAC_MECH(SHA256)
     INIT_HMAC_MECH(SHA384)
     INIT_HMAC_MECH(SHA512)
 
     case CKM_SHA_1_HMAC_GENERAL:
         crv = sftk_doHMACInit(context,HASH_AlgSHA1,key,
@@ skipping 1113 matching lines @@
         switch (keyType) {
         case CKK_RSA:
             signature_length = modulusLen;
             mech.mechanism = CKM_RSA_PKCS;
             break;
         case CKK_DSA:
             signature_length = DSA_MAX_SIGNATURE_LEN;
             pairwise_digest_length = subPrimeLen;
             mech.mechanism = CKM_DSA;
             break;
-#ifdef NSS_ENABLE_ECC
+#ifndef NSS_DISABLE_ECC
         case CKK_EC:
             signature_length = MAX_ECKEY_LEN * 2;
             mech.mechanism = CKM_ECDSA;
             break;
 #endif
         default:
             return CKR_DEVICE_ERROR;
         }
         
         /* Allocate space for signature data. */
@@ skipping 102 matching lines @@
 
     /* DSA */
     PQGParams           pqgParam;
     DHParams            dhParam;
     DSAPrivateKey *     dsaPriv;
 
     /* Diffie Hellman */
     int                 private_value_bits = 0;
     DHPrivateKey *      dhPriv;
 
-#ifdef NSS_ENABLE_ECC
+#ifndef NSS_DISABLE_ECC
     /* Elliptic Curve Cryptography */
     SECItem             ecEncodedParams;  /* DER Encoded parameters */
     ECPrivateKey *      ecPriv;
     ECParams *          ecParams;
-#endif /* NSS_ENABLE_ECC */
+#endif /* NSS_DISABLE_ECC */
 
     CHECK_FORK();
 
     if (!slot) {
         return CKR_SESSION_HANDLE_INVALID;
     }
     /*
      * now lets create an object to hang the attributes off of
      */
     publicKey = sftk_NewObject(slot); /* fill in the handle later */
@@ skipping 309 matching lines @@
         if (crv != CKR_OK) goto dhgn_done;
 
         crv=sftk_AddAttributeType(privateKey, CKA_VALUE, 
                               sftk_item_expand(&dhPriv->privateValue));
 
 dhgn_done:
         /* should zeroize, since this function doesn't. */
         PORT_FreeArena(dhPriv->arena, PR_TRUE);
         break;
 
-#ifdef NSS_ENABLE_ECC
+#ifndef NSS_DISABLE_ECC
     case CKM_EC_KEY_PAIR_GEN:
         sftk_DeleteAttributeType(privateKey,CKA_EC_PARAMS);
         sftk_DeleteAttributeType(privateKey,CKA_VALUE);
         sftk_DeleteAttributeType(privateKey,CKA_NETSCAPE_DB);
         key_type = CKK_EC;
 
         /* extract the necessary parameters and copy them to private keys */
         crv = sftk_Attribute2SSecItem(NULL, &ecEncodedParams, publicKey, 
                                       CKA_EC_PARAMS);
         if (crv != CKR_OK) break;
@@ skipping 42 matching lines @@
         crv = sftk_AddAttributeType(privateKey, CKA_VALUE, 
                               sftk_item_expand(&ecPriv->privateValue));
         if (crv != CKR_OK) goto ecgn_done;
 
         crv = sftk_AddAttributeType(privateKey,CKA_NETSCAPE_DB,
                            sftk_item_expand(&ecPriv->publicValue));
 ecgn_done:
         /* should zeroize, since this function doesn't. */
         PORT_FreeArena(ecPriv->ecParams.arena, PR_TRUE);
         break;
-#endif /* NSS_ENABLE_ECC */
+#endif /* NSS_DISABLE_ECC */
 
     default:
         crv = CKR_MECHANISM_INVALID;
     }
 
     if (crv != CKR_OK) {
         sftk_FreeObject(privateKey);
         sftk_FreeObject(publicKey);
         return crv;
     }
@@ skipping 99 matching lines @@
 static SECItem *sftk_PackagePrivateKey(SFTKObject *key, CK_RV *crvp)
 {
     NSSLOWKEYPrivateKey *lk = NULL;
     NSSLOWKEYPrivateKeyInfo *pki = NULL;
     SFTKAttribute *attribute = NULL;
     PLArenaPool *arena = NULL;
     SECOidTag algorithm = SEC_OID_UNKNOWN;
     void *dummy, *param = NULL;
     SECStatus rv = SECSuccess;
     SECItem *encodedKey = NULL;
-#ifdef NSS_ENABLE_ECC
+#ifndef NSS_DISABLE_ECC
     SECItem *fordebug;
     int savelen;
 #endif
 
     if(!key) {
         *crvp = CKR_KEY_HANDLE_INVALID; /* really can't happen */
         return NULL;
     }
 
     attribute = sftk_FindAttribute(key, CKA_KEY_TYPE);
@@ skipping 34 matching lines @@
             break;
         case NSSLOWKEYDSAKey:
             prepare_low_dsa_priv_key_export_for_asn1(lk);
             dummy = SEC_ASN1EncodeItem(arena, &pki->privateKey, lk,
                                        nsslowkey_DSAPrivateKeyExportTemplate);
             prepare_low_pqg_params_for_asn1(&lk->u.dsa.params);
             param = SEC_ASN1EncodeItem(NULL, NULL, &(lk->u.dsa.params),
                                        nsslowkey_PQGParamsTemplate);
             algorithm = SEC_OID_ANSIX9_DSA_SIGNATURE;
             break;
-#ifdef NSS_ENABLE_ECC       
+#ifndef NSS_DISABLE_ECC
         case NSSLOWKEYECKey:
             prepare_low_ec_priv_key_for_asn1(lk);
             /* Public value is encoded as a bit string so adjust length
              * to be in bits before ASN encoding and readjust 
              * immediately after.
              *
              * Since the SECG specification recommends not including the
              * parameters as part of ECPrivateKey, we zero out the curveOID
              * length before encoding and restore it later.
              */
             lk->u.ec.publicValue.len <<= 3;
             savelen = lk->u.ec.ecParams.curveOID.len;
             lk->u.ec.ecParams.curveOID.len = 0;
             dummy = SEC_ASN1EncodeItem(arena, &pki->privateKey, lk,
                                        nsslowkey_ECPrivateKeyTemplate);
             lk->u.ec.ecParams.curveOID.len = savelen;
             lk->u.ec.publicValue.len >>= 3;
 
             fordebug = &pki->privateKey;
             SEC_PRINT("sftk_PackagePrivateKey()", "PrivateKey", lk->keyType,
                       fordebug);
 
             param = SECITEM_DupItem(&lk->u.ec.ecParams.DEREncoding);
 
             algorithm = SEC_OID_ANSIX962_EC_PUBLIC_KEY;
             break;
-#endif /* NSS_ENABLE_ECC */
+#endif /* NSS_DISABLE_ECC */
         case NSSLOWKEYDHKey:
         default:
             dummy = NULL;
             break;
     }
  
     if(!dummy || ((lk->keyType == NSSLOWKEYDSAKey) && !param)) {
         *crvp = CKR_DEVICE_ERROR; /* should map NSS SECError */
         rv = SECFailure;
         goto loser;
@@ skipping 12 matching lines @@
     if(!dummy) {
         *crvp = CKR_DEVICE_ERROR; /* should map NSS SECError */
         rv = SECFailure;
         goto loser;
     }
 
     encodedKey = SEC_ASN1EncodeItem(NULL, NULL, pki, 
                                     nsslowkey_PrivateKeyInfoTemplate);
     *crvp = encodedKey ? CKR_OK : CKR_DEVICE_ERROR;
 
-#ifdef NSS_ENABLE_ECC
+#ifndef NSS_DISABLE_ECC
     fordebug = encodedKey;
     SEC_PRINT("sftk_PackagePrivateKey()", "PrivateKeyInfo", lk->keyType,
               fordebug);
 #endif
 loser:
     if(arena) {
         PORT_FreeArena(arena, PR_TRUE);
     }
 
     if(lk && (lk != key->objectInfo)) {
@@ skipping 205 matching lines @@
             break;
         case SEC_OID_ANSIX9_DSA_SIGNATURE:
             keyTemplate = nsslowkey_DSAPrivateKeyExportTemplate;
             paramTemplate = nsslowkey_PQGParamsTemplate;
             paramDest = &(lpk->u.dsa.params);
             lpk->keyType = NSSLOWKEYDSAKey;
             prepare_low_dsa_priv_key_export_for_asn1(lpk);
             prepare_low_pqg_params_for_asn1(&lpk->u.dsa.params);
             break;
         /* case NSSLOWKEYDHKey: */
-#ifdef NSS_ENABLE_ECC
+#ifndef NSS_DISABLE_ECC
         case SEC_OID_ANSIX962_EC_PUBLIC_KEY:
             keyTemplate = nsslowkey_ECPrivateKeyTemplate;
             paramTemplate = NULL;
             paramDest = &(lpk->u.ec.ecParams.DEREncoding);
             lpk->keyType = NSSLOWKEYECKey;
             prepare_low_ec_priv_key_for_asn1(lpk);
             prepare_low_ecparams_for_asn1(&lpk->u.ec.ecParams);
             break;
-#endif /* NSS_ENABLE_ECC */
+#endif /* NSS_DISABLE_ECC */
         default:
             keyTemplate = NULL;
             paramTemplate = NULL;
             paramDest = NULL;
             break;
     }
 
     if(!keyTemplate) {
         goto loser;
     }
 
     /* decode the private key and any algorithm parameters */
     rv = SEC_QuickDERDecodeItem(arena, lpk, keyTemplate, &pki->privateKey);
 
-#ifdef NSS_ENABLE_ECC
+#ifndef NSS_DISABLE_ECC
     if (lpk->keyType == NSSLOWKEYECKey) {
         /* convert length in bits to length in bytes */
         lpk->u.ec.publicValue.len >>= 3;
         rv = SECITEM_CopyItem(arena, 
                               &(lpk->u.ec.ecParams.DEREncoding),
                               &(pki->algorithm.parameters));
         if(rv != SECSuccess) {
             goto loser;
         }
     }
-#endif /* NSS_ENABLE_ECC */
+#endif /* NSS_DISABLE_ECC */
 
     if(rv != SECSuccess) {
         goto loser;
     }
     if(paramDest && paramTemplate) {
         rv = SEC_QuickDERDecodeItem(arena, paramDest, paramTemplate, 
                                  &(pki->algorithm.parameters));
         if(rv != SECSuccess) {
             goto loser;
         }
@@ skipping 74 matching lines @@
             if(crv != CKR_OK) break;
             break;
 #ifdef notdef
         case NSSLOWKEYDHKey:
             template = dhTemplate;
             templateCount = sizeof(dhTemplate)/sizeof(CK_ATTRIBUTE);
             keyType = CKK_DH;
             break;
 #endif
         /* what about fortezza??? */
-#ifdef NSS_ENABLE_ECC
+#ifndef NSS_DISABLE_ECC
         case NSSLOWKEYECKey:
             keyType = CKK_EC;
             crv = (sftk_hasAttribute(key, CKA_NETSCAPE_DB)) ? CKR_OK :
                                                 CKR_KEY_TYPE_INCONSISTENT;
             if(crv != CKR_OK) break;
             crv = sftk_AddAttributeType(key, CKA_KEY_TYPE, &keyType, 
                                                 sizeof(keyType));
             if(crv != CKR_OK) break;
             crv = sftk_AddAttributeType(key, CKA_SIGN, &cktrue, 
                                                 sizeof(CK_BBOOL));
             if(crv != CKR_OK) break;
             crv = sftk_AddAttributeType(key, CKA_SIGN_RECOVER, &cktrue, 
                                                 sizeof(CK_BBOOL)); 
             if(crv != CKR_OK) break;
             crv = sftk_AddAttributeType(key, CKA_DERIVE, &cktrue, 
                                                 sizeof(CK_BBOOL)); 
             if(crv != CKR_OK) break;
             crv = sftk_AddAttributeType(key, CKA_EC_PARAMS,
                                  sftk_item_expand(&lpk->u.ec.ecParams.DEREncoding));
             if(crv != CKR_OK) break;
             crv = sftk_AddAttributeType(key, CKA_VALUE, 
                         sftk_item_expand(&lpk->u.ec.privateValue));
             if(crv != CKR_OK) break;
             /* XXX Do we need to decode the EC Params here ?? */
             break;
-#endif /* NSS_ENABLE_ECC */
+#endif /* NSS_DISABLE_ECC */
         default:
             crv = CKR_KEY_TYPE_INCONSISTENT;
             break;
     }
 
 loser:
     if(lpk) {
         nsslowkey_DestroyPrivateKey(lpk);
     }
 
@@ skipping 289 matching lines @@
         return 16;
     case CKK_DES3:
         return 24;
     /* IDEA and CAST need to be added */
     default:
         break;
     }
     return 0;
 }
 
-#ifdef NSS_ENABLE_ECC
+#ifndef NSS_DISABLE_ECC
 /* Inputs:
  *  key_len: Length of derived key to be generated.
  *  SharedSecret: a shared secret that is the output of a key agreement primitive.
  *  SharedInfo: (Optional) some data shared by the entities computing the secret key.
  *  SharedInfoLen: the length in octets of SharedInfo
  *  Hash: The hash function to be used in the KDF
  *  HashLen: the length in octets of the output of Hash
  * Output:
  *  key: Pointer to a buffer containing derived key, if return value is SECSuccess.
  */
@@ skipping 90 matching lines @@
                                  SharedInfoLen, SHA256_HashBuf, SHA256_LENGTH);
     else if (kdf == CKD_SHA384_KDF)
         return sftk_compute_ANSI_X9_63_kdf(key, key_len, SharedSecret, SharedInfo,
                                  SharedInfoLen, SHA384_HashBuf, SHA384_LENGTH);
     else if (kdf == CKD_SHA512_KDF)
         return sftk_compute_ANSI_X9_63_kdf(key, key_len, SharedSecret, SharedInfo,
                                  SharedInfoLen, SHA512_HashBuf, SHA512_LENGTH);
     else
         return CKR_MECHANISM_INVALID;
 }
-#endif
+#endif /* NSS_DISABLE_ECC */
 
 /*
  * SSL Key generation given pre master secret
  */
 #define NUM_MIXERS 9
 static const char * const mixers[NUM_MIXERS] = { 
     "A", 
     "BB", 
     "CCC", 
     "DDDD", 
@@ skipping 925 matching lines @@
      
         if (rv == SECSuccess) {
             sftk_forceAttribute(key, CKA_VALUE, derived.data, derived.len);
             PORT_ZFree(derived.data, derived.len);
         } else
             crv = CKR_HOST_MEMORY;
             
         break;
       }
 
-#ifdef NSS_ENABLE_ECC
+#ifndef NSS_DISABLE_ECC
     case CKM_ECDH1_DERIVE:
     case CKM_ECDH1_COFACTOR_DERIVE:
       {
         SECItem  ecScalar, ecPoint;
         SECItem  tmp;
         PRBool   withCofactor = PR_FALSE;
         unsigned char *secret;
         unsigned char *keyData = NULL;
         int secretlen, curveLen, pubKeyLen;
         CK_ECDH1_DERIVE_PARAMS *mechParams;
@@ skipping 137 matching lines @@
         crv = CKR_ARGUMENTS_BAD;
         PORT_Free(ecScalar.data);
         if (privKey != sourceKey->objectInfo)
             nsslowkey_DestroyPrivateKey(privKey);
         if (arena) {
             PORT_FreeArena(arena, PR_FALSE);
         }
         break;
 
       }
-#endif /* NSS_ENABLE_ECC */
+#endif /* NSS_DISABLE_ECC */
 
     /* See RFC 5869 and CK_NSS_HKDFParams for documentation. */
     case CKM_NSS_HKDF_SHA1:   hashType = HASH_AlgSHA1;   goto hkdf;
     case CKM_NSS_HKDF_SHA256: hashType = HASH_AlgSHA256; goto hkdf;
     case CKM_NSS_HKDF_SHA384: hashType = HASH_AlgSHA384; goto hkdf;
     case CKM_NSS_HKDF_SHA512: hashType = HASH_AlgSHA512; goto hkdf;
 hkdf: {
         const CK_NSS_HKDFParams * params =
             (const CK_NSS_HKDFParams *) pMechanism->pParameter;
         const SECHashObject * rawHash;
@@ skipping 398 matching lines @@
     att = sftk_FindAttribute(key,CKA_VALUE);
     sftk_FreeObject(key);
     if (!att) {
         return CKR_KEY_HANDLE_INVALID;        
     }
     crv = NSC_DigestUpdate(hSession,(CK_BYTE_PTR)att->attrib.pValue,
                            att->attrib.ulValueLen);
     sftk_FreeAttribute(att);
     return crv;
 }