# FreeHSM C --- PKCS#11 v3.2 mechanism dispatch reference

*Auto-generated by `scripts/gen_p11_thunks.py`. Do not edit by hand.*

**Profile generated**: `fips-strict`
**Total mechanisms**: 76
**Approved**: 64
**Non-approved**: 12

## Reading this table

- **FIPS** column : `✅` = approved (dispatchable in fips-strict),
  `❌` = non-approved (rejected with `FHSM_RV_FIPS_NOT_APPROVED`
  in fips-strict, dispatchable but audited in interop).
- **Op** column : the PKCS#11 operation category.
- **Handler** : the C symbol invoked after argument validation.
  In fips-strict, non-approved mechanisms have their handler
  replaced by `dispatch_reject_fips` at code-gen time.

## AES

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_AES_KEY_GEN` | `0x00001080` | keygen | ✅ | `dispatch_aes_keygen` | FIPS 197 |
| `CKM_AES_CBC` | `0x00001082` | encrypt | ✅ | `dispatch_aes_cbc` | FIPS 197, SP 800-38A |
| `CKM_AES_CBC_PAD` | `0x00001085` | encrypt | ✅ | `dispatch_aes_cbc_pad` | FIPS 197, SP 800-38A, RFC 5652 (PKCS#7 padding) |
| | | | | | _No integrity: decryption reports whether the PKCS#7 padding was valid, which is a padding oracle (Vaudenay 2002, POODLE). Inherent to the mechanism and not fixable in the module -- C_Decrypt has to return something. Prefer CKM_AES_GCM or CKM_AES_KEY_WRAP where an attacker can submit chosen ciphertexts. See R2 in docs/PKCS11_CHECK_FINDINGS.md._ |
| `CKM_AES_GCM` | `0x00001087` | encrypt | ✅ | `dispatch_aes_gcm` | FIPS 197, SP 800-38D |
| | | | | | _IV length fixed at 96 bits; tag length fixed at 128 bits in approved mode._ |
| `CKM_AES_CCM` | `0x00001088` | encrypt | ✅ | `dispatch_aes_ccm` | FIPS 197, SP 800-38C |
| `CKM_AES_CTR` | `0x00001086` | encrypt | ✅ | `dispatch_aes_ctr` | FIPS 197, SP 800-38A |
| `CKM_AES_KEY_WRAP` | `0x00002109` | wrap | ✅ | `dispatch_aes_kw` | FIPS 197, SP 800-38F, RFC 3394 |
| `CKM_AES_KEY_WRAP_KWP` | `0x0000210B` | wrap | ✅ | `dispatch_aes_kwp` | FIPS 197, SP 800-38F §6.3, RFC 5649 |
| `CKM_AES_CMAC` | `0x0000108A` | sign | ✅ | `dispatch_aes_cmac` | FIPS 197, SP 800-38B |
| `CKM_AES_ECB` | `0x00001081` | encrypt | ✅ | `dispatch_aes_ecb` | FIPS 197, SP 800-38A |
| | | | | | _ECB single-block only; rejected for any input > 16 bytes._ |

## Composite-Sig

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_COMPOSITE_MLDSA65_ED25519` | `0x80004202` | sign | ❌ | `dispatch_composite_mldsa65_ed25519` | draft-ietf-lamps-pq-composite-sigs-19, id-MLDSA65-Ed25519-SHA512, OID 1.3.6.1.5.5.7.6.48 |
| | | | | | _Composite ML-DSA as specified: both components sign the message representative M' = Prefix || Label || len(ctx) || ctx || SHA-512(M), the ML-DSA component receives the Label as its FIPS 204 context, and the output is mldsaSig || tradSig. Unlike CKM_HYBRID_ED25519_ML_DSA_65 the components are NOT separable: neither half verifies against the bare message. Interop-only -- see the comment in gen_p11_thunks.py for why it is not announced as approved._ |

## DES

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_DES_KEY_GEN` | `0x00000120` | keygen | ❌ | `dispatch_reject_fips` | — |
| | | | | | _Single-DES forbidden by SP 800-131A rev. 2._ |

## DH

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_DH_PKCS_KEY_PAIR_GEN` | `0x00000020` | keypair | ❌ | `dispatch_reject_fips` | — |
| | | | | | _Finite-field DH < 2048 bits forbidden; modern code should use ECDH / X25519._ |

## DSA

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_DSA_KEY_PAIR_GEN` | `0x00000010` | keypair | ❌ | `dispatch_reject_fips` | — |
| | | | | | _DSA was withdrawn by FIPS 186-5._ |

## EC

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_EC_KEY_PAIR_GEN` | `0x00001040` | keypair | ✅ | `dispatch_ec_keypair` | FIPS 186-5 |
| | | | | | _Approved curves : P-256, P-384, P-521 only._ |
| `CKM_ECDSA` | `0x00001041` | sign | ✅ | `dispatch_ecdsa` | FIPS 186-5 |
| `CKM_ECDSA_SHA256` | `0x00001044` | sign | ✅ | `dispatch_ecdsa_sha256` | FIPS 186-5 |
| `CKM_ECDSA_SHA384` | `0x00001045` | sign | ✅ | `dispatch_ecdsa_sha384` | FIPS 186-5 |
| `CKM_ECDSA_SHA512` | `0x00001046` | sign | ✅ | `dispatch_ecdsa_sha512` | FIPS 186-5 |
| `CKM_ECDH1_DERIVE` | `0x00001050` | derive | ✅ | `dispatch_ecdh1` | SP 800-56A rev. 3 |
| `CKM_ECDH1_COFACTOR_DERIVE` | `0x00001051` | derive | ✅ | `dispatch_ecdh1_cofactor` | SP 800-56A rev. 3 |

## ECM

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_EC_MONTGOMERY_KEY_PAIR_GEN` | `0x00001056` | keypair | ✅ | `dispatch_ecm_keypair` | SP 800-56A rev. 3 (X25519/X448 added in rev. 3 §5.7.1) |
| `CKM_X25519_DERIVE` | `0x00001052` | derive | ✅ | `dispatch_x25519` | SP 800-56A rev. 3, RFC 7748 |
| `CKM_X448_DERIVE` | `0x00001054` | derive | ✅ | `dispatch_x448` | SP 800-56A rev. 3, RFC 7748 |

## EdDSA

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_EC_EDWARDS_KEY_PAIR_GEN` | `0x00001055` | keypair | ✅ | `dispatch_eddsa_keypair` | FIPS 186-5 |
| | | | | | _Ed25519 (curve = 1.3.101.112) and Ed448 (curve = 1.3.101.113)._ |
| `CKM_EDDSA` | `0x00001057` | sign | ✅ | `dispatch_eddsa` | FIPS 186-5, RFC 8032 |

## GENERIC

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_GENERIC_SECRET_KEY_GEN` | `0x00000350` | keygen | ✅ | `dispatch_generic_secret_keygen` | SP 800-133 rev. 2 |

## HKDF

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_HKDF_DERIVE` | `0x0000402A` | derive | ✅ | `dispatch_hkdf` | SP 800-56C rev. 2 |
| `CKM_HKDF_DATA` | `0x0000402B` | derive | ✅ | `dispatch_hkdf_data` | SP 800-56C rev. 2 |
| `CKM_HKDF_KEY_GEN` | `0x0000402C` | keygen | ✅ | `dispatch_hkdf_keygen` | SP 800-56C rev. 2 |

## HMAC

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_SHA256_HMAC` | `0x00000251` | sign | ✅ | `dispatch_hmac_sha256` | FIPS 198-1, FIPS 180-4 |
| `CKM_SHA384_HMAC` | `0x00000261` | sign | ✅ | `dispatch_hmac_sha384` | FIPS 198-1, FIPS 180-4 |
| `CKM_SHA512_HMAC` | `0x00000271` | sign | ✅ | `dispatch_hmac_sha512` | FIPS 198-1, FIPS 180-4 |
| `CKM_SHA3_256_HMAC` | `0x000002B1` | sign | ✅ | `dispatch_hmac_sha3_256` | FIPS 198-1, FIPS 202 |
| `CKM_SHA3_384_HMAC` | `0x000002C1` | sign | ✅ | `dispatch_hmac_sha3_384` | FIPS 198-1, FIPS 202 |
| `CKM_SHA3_512_HMAC` | `0x000002D1` | sign | ✅ | `dispatch_hmac_sha3_512` | FIPS 198-1, FIPS 202 |

## Hybrid-KEM

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_HYBRID_X25519_ML_KEM_768` | `0x80004200` | encap | ✅ | `dispatch_hybrid_x25519_ml_kem_768` | SP 800-227, draft-ietf-pquip-pqt-hybrid, draft-ietf-tls-hybrid-design |
| | | | | | _ss = SHA3-256(ss_x25519 || ss_ml_kem_768 || ct_pqkem || ct_x25519)_ |

## Hybrid-Sig

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_HYBRID_ED25519_ML_DSA_65` | `0x80004201` | sign | ✅ | `dispatch_hybrid_ed25519_ml_dsa_65` | RFC 9794 (PQ/T hybrid terminology) |
| | | | | | _A PQ/T hybrid of local design: Ed25519 and ML-DSA-65 each sign the message and the two signatures are concatenated; verify requires both. It is NOT Composite ML-DSA (draft-ietf-lamps-pq-composite-sigs): there is no signature combiner, so no Prefix/Label/ctx binding and no non-separability -- the Ed25519 half is a valid standalone signature over the same message. Not usable in X.509 or CMS, which need a registered composite OID. See docs/COMPOSITE_SIGS_GAP.md; conforming Composite ML-DSA is task zero of #112._ |

## KDF

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_NIST_PRF_KDF` | `0x00000384` | derive | ✅ | `dispatch_nist_prf_kdf` | SP 800-108 |

## KDF-concat

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_CONCATENATE_BASE_AND_KEY` | `0x00000360` | derive | ✅ | `dispatch_concat_base_and_key` | PKCS#11 v3.2 §6.20.1 |
| `CKM_CONCATENATE_BASE_AND_DATA` | `0x00000362` | derive | ✅ | `dispatch_concat_base_and_data` | PKCS#11 v3.2 §6.20.2 |
| | | | | | _Also exposed as CKM_CONCATENATE_BASE_AND_DATA_KDF (alias)._ |
| `CKM_CONCATENATE_DATA_AND_BASE` | `0x00000363` | derive | ✅ | `dispatch_concat_data_and_base` | PKCS#11 v3.2 §6.20.3 |
| `CKM_XOR_BASE_AND_DATA` | `0x00000364` | derive | ✅ | `dispatch_xor_base_and_data` | PKCS#11 v3.2 §6.20.4 |

## KMAC

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_KMAC128` | `0x00004080` | sign | ✅ | `dispatch_kmac128` | SP 800-185 §4 |
| | | | | | _Streaming-friendly via EVP_MAC_init/update/final ; PKCS#11 v3.2 §6.22._ |
| `CKM_KMAC256` | `0x00004081` | sign | ✅ | `dispatch_kmac256` | SP 800-185 §4 |

## MD5

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_MD5` | `0x00000210` | digest | ❌ | `dispatch_md5` | RFC 1321 |
| | | | | | _Forbidden by SP 800-131A rev. 2._ |

## ML-DSA

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_ML_DSA_KEY_PAIR_GEN` | `0x0000001C` | keypair | ✅ | `dispatch_ml_dsa_keypair` | FIPS 204 |
| | | | | | _Parameter set selected via CKA_PARAMETER_SET = ML-DSA-{44,65,87}._ |
| `CKM_ML_DSA` | `0x0000001D` | sign | ✅ | `dispatch_ml_dsa` | FIPS 204 |

## ML-KEM

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_ML_KEM_KEY_PAIR_GEN` | `0x0000000F` | keypair | ✅ | `dispatch_ml_kem_keypair` | FIPS 203 |
| | | | | | _Parameter set selected via CKA_PARAMETER_SET = ML-KEM-{512,768,1024}._ |
| `CKM_ML_KEM` | `0x00000017` | encap | ✅ | `dispatch_ml_kem_encap` | FIPS 203 |

## PBKDF2

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_PKCS5_PBKD2` | `0x000003B0` | derive | ✅ | `dispatch_pbkdf2` | SP 800-132, PKCS #5 v2.1 |
| | | | | | _Minimum 200_000 iterations enforced by fhsm_pbkdf2()._ |

## RC4

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_RC4` | `0x00000111` | encrypt | ❌ | `dispatch_reject_fips` | — |

## RSA

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_RSA_PKCS_KEY_PAIR_GEN` | `0x00000000` | keypair | ✅ | `dispatch_rsa_keypair` | FIPS 186-5 |
| `CKM_RSA_PKCS_PSS` | `0x0000000D` | sign | ✅ | `dispatch_rsa_pss` | FIPS 186-5, RFC 8017 §8.1 |
| `CKM_SHA256_RSA_PKCS_PSS` | `0x00000043` | sign | ✅ | `dispatch_rsa_pss_sha256` | FIPS 186-5 |
| `CKM_SHA384_RSA_PKCS_PSS` | `0x00000044` | sign | ✅ | `dispatch_rsa_pss_sha384` | FIPS 186-5 |
| `CKM_SHA512_RSA_PKCS_PSS` | `0x00000045` | sign | ✅ | `dispatch_rsa_pss_sha512` | FIPS 186-5 |
| `CKM_RSA_PKCS_OAEP` | `0x00000009` | encrypt | ✅ | `dispatch_rsa_oaep` | RFC 8017 §7.1 |
| `CKM_RSA_PKCS` | `0x00000001` | encrypt | ❌ | `dispatch_rsa_pkcs` | RFC 8017 §7.2 |
| | | | | | _PKCS#1 v1.5 encryption is deprecated by NIST; padding-oracle risk._ |
| `CKM_RSA_X_509` | `0x00000003` | encrypt | ❌ | `dispatch_rsa_x509` | — |
| | | | | | _Raw RSA --- forbidden in approved mode._ |
| `CKM_SHA1_RSA_PKCS` | `0x00000006` | sign | ❌ | `dispatch_sha1_rsa` | — |
| | | | | | _SHA-1 is forbidden for signature generation per SP 800-131A rev. 2._ |

## SHA1

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_SHA_1` | `0x00000220` | digest | ❌ | `dispatch_sha1` | FIPS 180-4 |
| | | | | | _Disallowed for digital signature generation; legacy verify only._ |

## SHA2

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_SHA256` | `0x00000250` | digest | ✅ | `dispatch_sha256` | FIPS 180-4 |
| `CKM_SHA384` | `0x00000260` | digest | ✅ | `dispatch_sha384` | FIPS 180-4 |
| `CKM_SHA512` | `0x00000270` | digest | ✅ | `dispatch_sha512` | FIPS 180-4 |
| `CKM_SHA224` | `0x00000255` | digest | ✅ | `dispatch_sha224` | FIPS 180-4 |
| `CKM_SHA512_224` | `0x00000048` | digest | ✅ | `dispatch_sha512_224` | FIPS 180-4 |
| `CKM_SHA512_256` | `0x0000004C` | digest | ✅ | `dispatch_sha512_256` | FIPS 180-4 |

## SHA3

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_SHA3_224` | `0x000002B5` | digest | ✅ | `dispatch_sha3_224` | FIPS 202 |
| `CKM_SHA3_256` | `0x000002B0` | digest | ✅ | `dispatch_sha3_256` | FIPS 202 |
| `CKM_SHA3_384` | `0x000002C0` | digest | ✅ | `dispatch_sha3_384` | FIPS 202 |
| `CKM_SHA3_512` | `0x000002D0` | digest | ✅ | `dispatch_sha3_512` | FIPS 202 |

## SLH-DSA

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_SLH_DSA_KEY_PAIR_GEN` | `0x0000002D` | keypair | ✅ | `dispatch_slh_dsa_keypair` | FIPS 205 |
| | | | | | _Parameter set selected via CKA_PARAMETER_SET = SLH-DSA-{SHA2,SHAKE}-{128,192,256}{s,f}._ |
| `CKM_SLH_DSA` | `0x0000002E` | sign | ✅ | `dispatch_slh_dsa` | FIPS 205 |

## TDES

| Mechanism | Value | Op | FIPS | Handler | Reference |
|---|---|---|---|---|---|
| `CKM_DES3_KEY_GEN` | `0x00000131` | keygen | ❌ | `dispatch_des3_keygen` | — |
| | | | | | _Triple-DES disallowed for encryption after Dec 31 2023 (SP 800-131A rev. 2)._ |
| `CKM_DES3_CBC` | `0x00000133` | encrypt | ❌ | `dispatch_des3_cbc` | — |

## Cross-references

- The single source of truth for this table is `scripts/gen_p11_thunks.py`.
- The runtime dispatch table is generated into `src/gen/fhsm_dispatch.c`.
- The public CKM_* values are generated into `include/fhsm_pkcs11_mechanisms.h`.
- The Security Policy §4 (`docs/FIPS_140_3.md`) lists the same
  approved algorithms grouped by family --- the evaluator can diff
  the two documents to confirm conformance.
