In general, the PKCS #11 function return
codes are defined in the PKCS #11 specification. However, the following
function return codes have a meaning specific to z/OS®:
- CKR_TOKEN_NOT_PRESENT
- ICSF is not running or the TKDS is not properly configured. Note
that this return code has no relationship to the slot flag CKF_TOKEN_PRESENT.
- CKR_TOKEN_NOT_RECOGNIZED
- The caller is not authorized to perform the action requested.
- CKR_MECHANISM_INVALID
- The specified mechanism is either unknown or not supported by
the current cryptographic hardware configuration.
- CKR_DEVICE_REMOVED
- The token no longer exists. When this error is detected, the token
flags are cleared indicating that the token is no longer initialized.
It can be re-initialized as a new token, if desired.
Other ICSF-related errors are returned as vendor-defined error
codes (CKR_VENDOR_DEFINED). The ICSF return and reason codes are combined
into the single return code as follows:
#define CKR_IBM_ICSF_ERROR 0xC0000000 /* High order byte mask indicating ICSF error */
#define CKR_IBM_ICSF_ERROR_RET 0x00FF0000 /* Second byte is the return code */
#define CKR_IBM_ICSF_ERROR_RSN 0x0000FFFF /* low order half word is reason code */
This
mapping is also used to store the ICSF return and reason code values
in the CK_SESSION_INFO ulDeviceError field.
The following constants are defined for select ICSF return reason
codes:
/* ICSF not configured for FIPS mode OR system does not
support FIPS mode */
#define CKR_IBM_ICSF_NOT_FIPS_MODE 0xC0080BFD
/* Algorithm or key size is not valid in FIPS mode */
#define CKR_IBM_ICSF_NOT_VALID_FIPS 0xC0080BFE
/* FIPS known answer tests failed */
#define CKR_IBM_ICSF_FIPS_KAT_FAILED 0xC00C8D3C
/* Service or algorithm not available on current system */
#define CKR_IBM_ICSF_SERV_NOTAVAIL 0xC00C0008
/* A clear key is required for this operation, but a secure
key was supplied */
#define CKR_IBM_CLEAR_KEY_REQ 0xC0080C81
/* Clear key creation denied by policy */
#define CKR_IBM_DENIED_BY_POLICY 0xC0083E88
/* Key object in more restrictive compliance mode than
current setting of the Enterprise PKCS #11 coprocessors */
#define CKR_IBM_KEY_MODE_ERROR 0xC00C3200