feat(hsm-emulator): materialize default key-usage attributes per object class

materializeDefaults now sets CKA_ENCRYPT/DECRYPT/SIGN/VERIFY/SIGN_RECOVER/VERIFY_RECOVER/WRAP/UNWRAP/DERIVE (plus ALWAYS_AUTHENTICATE for private keys) to CK_FALSE when absent, per CKO_PUBLIC_KEY/PRIVATE_KEY/SECRET_KEY; smoke sets the RSA wrap and recover usage flags.

PROJECTS/advanced/hsm-emulator/examples/smoke.zig

@@ -319,11 +319,15 @@ pub fn main() !void {
     var rsapub_tmpl = [_]ck.CK_ATTRIBUTE{
         .{ .type = ck.CKA_MODULUS_BITS, .pValue = &rsa_bits, .ulValueLen = @sizeOf(ck.CK_ULONG) },
         .{ .type = ck.CKA_VERIFY, .pValue = &ck_yes, .ulValueLen = 1 },
+        .{ .type = ck.CKA_VERIFY_RECOVER, .pValue = &ck_yes, .ulValueLen = 1 },
         .{ .type = ck.CKA_ENCRYPT, .pValue = &ck_yes, .ulValueLen = 1 },
+        .{ .type = ck.CKA_WRAP, .pValue = &ck_yes, .ulValueLen = 1 },
     };
     var rsapriv_tmpl = [_]ck.CK_ATTRIBUTE{
         .{ .type = ck.CKA_SIGN, .pValue = &ck_yes, .ulValueLen = 1 },
+        .{ .type = ck.CKA_SIGN_RECOVER, .pValue = &ck_yes, .ulValueLen = 1 },
         .{ .type = ck.CKA_DECRYPT, .pValue = &ck_yes, .ulValueLen = 1 },
+        .{ .type = ck.CKA_UNWRAP, .pValue = &ck_yes, .ulValueLen = 1 },
         .{ .type = ck.CKA_PRIVATE, .pValue = &ck_false, .ulValueLen = 1 },
     };
     var h_rsapub: ck.CK_OBJECT_HANDLE = 0;

PROJECTS/advanced/hsm-emulator/src/api/object.zig

@@ -86,6 +86,21 @@ pub fn materializeDefaults(obj: *Object, allocator: std.mem.Allocator, class: ck
         const def: u8 = if (class == ck.CKO_PRIVATE_KEY) ck.CK_TRUE else ck.CK_FALSE;
         try obj.set(allocator, ck.CKA_PRIVATE, &[_]u8{def});
     }
+    switch (class) {
+        ck.CKO_PUBLIC_KEY => {
+            const attrs = [_]ck.CK_ATTRIBUTE_TYPE{ ck.CKA_ENCRYPT, ck.CKA_VERIFY, ck.CKA_VERIFY_RECOVER, ck.CKA_WRAP, ck.CKA_DERIVE };
+            for (attrs) |a| if (!obj.has(a)) try obj.set(allocator, a, &[_]u8{ck.CK_FALSE});
+        },
+        ck.CKO_PRIVATE_KEY => {
+            const attrs = [_]ck.CK_ATTRIBUTE_TYPE{ ck.CKA_DECRYPT, ck.CKA_SIGN, ck.CKA_SIGN_RECOVER, ck.CKA_UNWRAP, ck.CKA_DERIVE, ck.CKA_ALWAYS_AUTHENTICATE };
+            for (attrs) |a| if (!obj.has(a)) try obj.set(allocator, a, &[_]u8{ck.CK_FALSE});
+        },
+        ck.CKO_SECRET_KEY => {
+            const attrs = [_]ck.CK_ATTRIBUTE_TYPE{ ck.CKA_ENCRYPT, ck.CKA_DECRYPT, ck.CKA_SIGN, ck.CKA_VERIFY, ck.CKA_WRAP, ck.CKA_UNWRAP, ck.CKA_DERIVE };
+            for (attrs) |a| if (!obj.has(a)) try obj.set(allocator, a, &[_]u8{ck.CK_FALSE});
+        },
+        else => {},
+    }
 }
 
 pub fn insertNew(inst: *state.Instance, sess: *session.Session, obj_in: Object, phObject: *ck.CK_OBJECT_HANDLE) ck.CK_RV {