### Configure and Install on Linux

Source: https://github.com/mastercard/pkcs11-tools/wiki/Installation

Standard installation procedure for Linux. Installs binaries into a bin subdirectory of the current working directory.

```bash
$ ./configure --prefix=$PWD
$ make
$ make install
```

--------------------------------

### Typical Linux Installation

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Standard build and installation process for pkcs11-tools on Linux.

```bash
$ ./configure
$ make
$ sudo make install
```

--------------------------------

### Compile and Install on Solaris

Source: https://github.com/mastercard/pkcs11-tools/wiki/Installation

Compiles and installs the pkcs11-tools on Solaris after configuration.

```bash
$ make install
```

--------------------------------

### Install pkcs11-tools on Solaris

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Compile and install the toolkit on Solaris after configuring the build.

```bash
$ sudo make install
```

--------------------------------

### Install pkcs11-tools on FreeBSD

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Use this command to install the toolkit as a package on FreeBSD 12 and above.

```bash
$ pkg install pkcs11-tools
```

--------------------------------

### Configure and Install pkcs11-tools on MacOS

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Use this command to configure the build on macOS, specifying the path to OpenSSL 1.1. Then, build and install the tools.

```bash
$ ./configure PKG_CONFIG_PATH=/usr/local/opt/openssl@1.1/lib/pkgconfig LIBCRYPTO_RPATH=/usr/local/opt/openssl@1.1/lib
$ make
$ sudo make install
```

--------------------------------

### Install OpenSSL on FreeBSD

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Install the OpenSSL package using pkg on older FreeBSD versions before building pkcs11-tools.

```bash
$ pkg install openssl
```

--------------------------------

### Configure PKCS11 Password and Token Label

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/MANUAL.md

Create a .pkcs11rc file to set default environment variables for PKCS#11 tools. This example sets the password and token label for SoftHSM.

```bash
$ cat >$HOME/.pkcs11rc
PKCS11PASSWORD=mytokenpassword
PKCS11TOKENLABEL=my-token-label
```

--------------------------------

### Configure and Compile for Windows (Linux)

Source: https://github.com/mastercard/pkcs11-tools/wiki/Installation

Configure and compile the project for Windows using a cross-compiler and OpenSSL installed via Wine.

```bash
$ CFLAGS="-I$(pwd)/openssl-win64/include" LDFLAGS=-L$(pwd)/openssl-win32 ./configure --host=x86_64-w64-mingw32 --prefix=$PWD
$ make install
```

--------------------------------

### Linux Install with Custom OpenSSL Path

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Configure pkcs11-tools to use a custom OpenSSL 1.1.1 installation, specifying paths for pkgconfig and libraries.

```bash
$ ./configure PKG_CONFIG_PATH=/opt/openssl-1.1.1/lib/pkgconfig LIBCRYPTO_RPATH=/opt/openssl-1.1.1/lib
$ make
$ sudo make install
```

--------------------------------

### Install OpenSSL Development Headers

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Installs the OpenSSL development headers and libraries on Debian-based systems. OpenSSL v1.1.1e or above is required for compiling the toolkit.

```bash
$ sudo apt-get install libssl-dev
```

--------------------------------

### Build OpenSSL 1.1.1 Dynamically on Linux

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Configure and build OpenSSL 1.1.1 with dynamic libraries. Assumes installation to `/opt/openssl-1.1.1`.

```bash
$ ./config no-zlib shared --prefix=/opt/openssl-1.1.1 linux-x86_64
$ make
$ sudo make install
```

--------------------------------

### Install Lex/Flex and Yacc/Bison on Debian-based Systems

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Installs optional tools like bison and flex on Debian-based systems. These are used for lexing and parsing, but pre-generated files can be used if these tools are unavailable.

```bash
$ sudo apt-get install bison flex
```

--------------------------------

### Build RPM Package

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Steps to build an RPM package, including configuring the build, copying spec and source files, and running rpmbuild. Assumes rpmbuild is installed and OpenSSL 1.1.1 is the default.

```bash
$ ./configure [...] --prefix=$PWD
$ make dist
$ cp dist/redhat/pkcs11-tools.spec $HOME/rpmbuild/SPECS
$ cp pkcs11-tools-[VERSION].tar.gz $HOME/rpmbuild/SOURCES
$ rpmbuild -ba $HOME/rpmbuild/SPECS/pkcs11-tools.spec
```

--------------------------------

### Build OpenSSL 1.1.1 Statically on Linux

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Configure and build OpenSSL 1.1.1 with static libraries. Assumes installation to `/opt/openssl-1.1.1`.

```bash
$ ./config no-zlib no-shared --prefix=/opt/openssl-1.1.1 linux-x86_64
$ make
$ sudo make install
```

--------------------------------

### PKCS#11 Attribute Grammar Example

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/MANUAL.md

This example demonstrates the flexible grammar for specifying PKCS#11 attributes, including boolean values, optional prefixes, and nested template attributes. Use this syntax when providing attributes to commands that support them.

```plaintext
encrypt decrypt=true sign=on verify=off wrap, no unwrap, unwrap_template = { not extractable, sign }
```

--------------------------------

### Linux Install with Custom OpenSSL Flags

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Configure pkcs11-tools using explicit CFLAGS and LIBS for a custom OpenSSL 1.1.1 installation, and optionally specify RPATH.

```bash
$ ./configure LIBCRYPTO_CFLAGS='-I/opt/openssl-1.1.1i/include' LIBCRYPTO_LIBS='-L/opt/openssl-1.1.1/lib -lcrypto' LIBCRYPTO_RPATH=/opt/openssl-1.1.1/lib
$ make
$ sudo make install
```

--------------------------------

### Install Autotools on Debian-based Systems

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Installs the autotools suite, including autoconf, automake, libtool, and pkg-config, on Debian-based systems. These are necessary for the build process.

```bash
$ sudo apt-get install autoconf-archive autoconf automake libtool pkg-config
```

--------------------------------

### Build RPM Package

Source: https://github.com/mastercard/pkcs11-tools/wiki/Installation

Build an RPM package for the project, assuming rpmbuild is installed and configured.

```bash
$ ./configure [...] --prefix=$PWD
$ make dist
$ cp dist/redhat/pkcs11-tools.spec $HOME/rpmbuild/SPECS
$ cp pkcs11-tools-[VERSION].tar.gz $HOME/rpmbuild/SRPMS
$ rpmbuild -ba $HOME/rpmbuild/SPECS/pkcs11-tools.spec
```

--------------------------------

### Import Public Key with Wrapping Constraints

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/MANUAL.md

Import a public key with specific wrapping constraints using p11importpubk. This example imports a key for wrapping and specifies a wrap template that only allows wrapping keys with 'encrypt' set to false.

```bash
$ p11importpubk -f test-public-rsa-key.rsa -i test-public-rsa-key wrap=1 wrap_template={ not encrypt }
PEM format detected
p11importpubk: import of public key succeeded.
```

--------------------------------

### Configure OpenSSL for Static Linking on Linux

Source: https://github.com/mastercard/pkcs11-tools/wiki/Installation

Configures and installs OpenSSL in a specified home directory for static linking. This is a prerequisite for creating portable binaries.

```bash
$ ./configure zlib no-shared --prefix=$HOME/openssl linux-x86_64
$ make install
```

--------------------------------

### Configure pkcs11-tools for 64-bit Binaries on Solaris Sparc

Source: https://github.com/mastercard/pkcs11-tools/wiki/Installation

Configures pkcs11-tools to build 64-bit (sparcv9) binaries on Solaris Sparc, using a statically linked OpenSSL library and specifying the installation prefix.

```bash
$ CFLAGS='-m64 -mcpu=ultrasparc3 -I$HOME/openssl/include' LDFLAGS=-L$HOME/openssl ./configure --prefix=$PWD
```

--------------------------------

### Configure and Build pkcs11-tools on FreeBSD (Custom OpenSSL Path)

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Configure and build the toolkit on older FreeBSD versions if OpenSSL was installed in a non-standard location. Specify LIBCRYPTO_RPATH to set the run path to OpenSSL libraries.

```bash
$ ./configure CC=clang PKG_CONFIG_PATH=/opt/openssl-1.1.1/lib/pkgconfig LIBCRYPTO_RPATH=/opt/openssl-1.1.1/lib
$ make
$ sudo make install
```

--------------------------------

### Install OpenSSL on AIX 7.1 with IBM XLC Compiler

Source: https://github.com/mastercard/pkcs11-tools/wiki/Installation

Installs OpenSSL on AIX 7.1, preparing for static linking. This step is necessary before configuring the pkcs11-tools.

```bash
$ PATH=/usr/vac/bin:$PATH
$ ./configure no-hw no-zlib no-shared --prefix=[OPENSSL_TARGET_DIR]
$ make
$ make install
```

--------------------------------

### Install Build Dependencies on Debian-based Systems

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Installs essential build tools like gcc, make, and perl on Debian-based systems (e.g., Ubuntu). These are required for compiling from source.

```bash
$ sudo apt-get install gcc make perl
```

--------------------------------

### Invoke Wrapper Script with SoftHSM

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/MANUAL.md

Use a wrapper script like `with_softhsm` to simplify invoking PKCS#11 tools. This example assumes a .pkcs11rc file is configured.

```bash
$ with_softhsm p11ls
```

--------------------------------

### Display Buildx Help

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Displays the help message for the `buildx.sh` script, outlining available options and usage instructions.

```bash
$ ./buildx.sh --help
```

--------------------------------

### Build PKCS#11 Tools

Source: https://github.com/mastercard/pkcs11-tools/blob/master/README.md

Execute these commands to build the source code. Ensure you have the necessary privileges.

```bash
$ ./bootstrap.sh
$ ./configure
$ make install
```

--------------------------------

### Configure Static Build for 32-bit Binaries on Solaris

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Configure the toolkit for a static build of 32-bit binaries on Solaris, specifying include and library paths for OpenSSL.

```bash
$ CFLAGS='-I/opt/openssl-1.1.1/include' LDFLAGS=-L/opt/openssl-1.1.1/lib ./configure --prefix=$PWD
```

--------------------------------

### Build Generic Binary Distribution

Source: https://github.com/mastercard/pkcs11-tools/wiki/Installation

Create a generic binary distribution tarball for all platforms.

```bash
$ ./configure [...] --prefix=$PWD
$ make dist-bin
```

--------------------------------

### Bootstrap pkcs11-tools Environment

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Clone the repository and run the bootstrap script to set up autotools and libtool environment.

```bash
$ git clone https://github.com/Mastercard/pkcs11-tools.git
$ cd pkcs11-tools
$ ./bootstrap.sh
```

--------------------------------

### NSS Keystore Integration

Source: https://context7.com/mastercard/pkcs11-tools/llms.txt

Demonstrates how to interface pkcs11-tools with Mozilla NSS keystores, which require a non-standard C_Initialize() call. Use the -m flag or PKCS11NSSDIR environment variable to specify the NSS database directory.

```bash
# Create and initialize an NSS database (SQLite3 format)
$ modutil -dbdir sql:. -create
$ modutil -dbdir sql:. -changepw "NSS Certificate DB"

# List NSS slots
$ p11slotinfo -l /usr/lib/libsoftokn3.so -m sql:.

# List objects in NSS token (slot 1 = "NSS Certificate DB")
$ p11ls -l /usr/lib/libsoftokn3.so -m sql:. -s 1

# Generate an RSA key in the NSS token
$ p11keygen -l /usr/lib/libsoftokn3.so -m sql:. -s 1 \
    -k rsa -b 2048 -i nss-rsa-key sign verify

# Use wrapper script for NSS
export PKCS11NSSDIR=sql:.
with_nss p11ls
```

--------------------------------

### Build Solaris Package

Source: https://github.com/mastercard/pkcs11-tools/wiki/Installation

Build a Solaris package for the project.

```bash
$ ./configure [...] --prefix=$PWD
$ make dist-solaris
```

--------------------------------

### Configure pkcs11-tools with Duplicate Object Creation Enabled

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Enable the creation of objects with the same labels by using the --enable-duplicate argument during configuration.

```bash
$ ./configure [...] --enable-duplicate
```

--------------------------------

### Import Public Key with p11importpubk

Source: https://github.com/mastercard/pkcs11-tools/wiki/Home

Import a public key into the keystore using `p11importpubk`. This is useful for making public keys available on the token.

```bash
p11importpubk
```

--------------------------------

### Create New NSS Keystore

Source: https://github.com/mastercard/pkcs11-tools/wiki/Working-with-NSS-keystores

Use `modutil` to create a new NSS database. Specify `sql:.` for a new-style SQLite3 database in the current directory. Be aware of potential corruption if the browser is running.

```bash
$ modutil -dbdir sql:. -create

WARNING: Performing this operation while the browser is running could cause
corruption of your security databases. If the browser is currently running,
you should exit browser before continuing this operation. Type
'q <enter>' to abort, or <enter> to continue: y
$
```

--------------------------------

### List PKCS#11 Token Mechanisms

Source: https://github.com/mastercard/pkcs11-tools/blob/master/README.md

Use `p11slotinfo` to display available mechanisms on a PKCS#11 token. You can specify the PKCS11 library path using the `PKCS11LIB` environment variable.

```bash
$ using PKCS11LIB at /opt/softhsm2-devel/lib/softhsm/libsofthsm2.so
PKCS#11 Library
---------------
Name        : /opt/softhsm2-devel/lib/softhsm/libsofthsm2.so
Lib version : 2.6
API version : 2.40
Description : Implementation of PKCS11
Manufacturer: SoftHSM

PKCS#11 module slot list:
Slot index: 0
----------------
Description : SoftHSM slot ID 0x4fbfdc13
Token Label : token1
Manufacturer: SoftHSM project


Enter slot index: 0

Slot[0]
-------------
Slot Number : 1337973779
Description : SoftHSM slot ID 0x4fbfdc13
Manufacturer: SoftHSM project
Slot Flags  : [ CKF_TOKEN_PRESENT ]

Token
-------------
Label       : first token
Manufacturer: SoftHSM project

Token Flags : [ CKF_RNG CKF_LOGIN_REQUIRED CKF_USER_PIN_INITIALIZED CKF_RESTORE_KEY_NOT_NEEDED CKF_TOKEN_INITIALIZED ]

Mechanisms:
-----------
CKM_MD5                                   --- --- hsh --- --- --- --- --- --- --- --- --- SW (00000210)
CKM_SHA_1                                 --- --- hsh --- --- --- --- --- --- --- --- --- SW (00000220)
CKM_SHA224                                --- --- hsh --- --- --- --- --- --- --- --- --- SW (00000255)
CKM_SHA256                                --- --- hsh --- --- --- --- --- --- --- --- --- SW (00000250)
CKM_SHA384                                --- --- hsh --- --- --- --- --- --- --- --- --- SW (00000260)
CKM_SHA512                                --- --- hsh --- --- --- --- --- --- --- --- --- SW (00000270)
CKM_MD5_HMAC                              --- --- --- sig --- vfy --- --- --- --- --- --- SW (00000211)
CKM_SHA_1_HMAC                            --- --- --- sig --- vfy --- --- --- --- --- --- SW (00000221)
CKM_SHA224_HMAC                           --- --- --- sig --- vfy --- --- --- --- --- --- SW (00000256)
CKM_SHA256_HMAC                           --- --- --- sig --- vfy --- --- --- --- --- --- SW (00000251)
CKM_SHA384_HMAC                           --- --- --- sig --- vfy --- --- --- --- --- --- SW (00000261)
CKM_SHA512_HMAC                           --- --- --- sig --- vfy --- --- --- --- --- --- SW (00000271)
CKM_RSA_PKCS_KEY_PAIR_GEN                 --- --- --- --- --- --- --- --- gkp --- --- --- SW (00000000)
CKM_RSA_PKCS                              enc dec --- sig --- vfy --- --- --- wra unw --- SW (00000001)
...
```

--------------------------------

### Build PKCS#11 Tools

Source: https://github.com/mastercard/pkcs11-tools/wiki/Home

Build the source code for the PKCS#11 tools. Requires appropriate privileges.

```bash
$ ./configure
$ make install
```

--------------------------------

### Extract Non-Sensitive Object Data

Source: https://github.com/mastercard/pkcs11-tools/wiki/Home

Extract the value of a non-sensitive object from a PKCS#11 token. This example shows extracting a public RSA key.

```bash
$ p11cat pubk/rsa
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2zd+HKrd1u7TBMfvlpO2
1eT8uoY+aLw6/yT9treLk67czyA6XQ8NMtspacgxLXbC0XbaObGJDOswFN2o+zjA
hgKkBY6mEZKO3dzmqtQupQvxybyrj0pg0e+YoZe34rIjVvCdJ9T48etvCyrDZata

```

--------------------------------

### Configure Static Build for SPARCv9 64-bit Binaries on Solaris

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Configure the toolkit for a static build of SPARCv9 64-bit binaries on Solaris, including specific CPU flags and OpenSSL paths.

```bash
$ CFLAGS='-m64 -mcpu=ultrasparc3 -I/opt/openssl-1.1.1/include' LDFLAGS=-L/opt/openssl-1.1.1/lib ./configure --prefix=$PWD
```

--------------------------------

### Configure pkcs11-tools with Statically Linked OpenSSL on Linux

Source: https://github.com/mastercard/pkcs11-tools/wiki/Installation

Configures the pkcs11-tools to use a statically linked OpenSSL library. This ensures the binaries are portable and do not depend on external OpenSSL installations.

```bash
$ CFLAGS=-I$HOME/openssl/include LDFLAGS=-L$HOME/openssl/lib LIBS="-lz -ldl" ./configure --prefix=$PWD
$ make install
```

--------------------------------

### Build Docker Image for Ubuntu 24.04

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Builds the toolkit using Docker for a specified distribution. This command automates the process for various distributions and architectures.

```bash
$ ./buildx.sh ubuntu2404
```

--------------------------------

### Invoke Wrapper Script with Slot Info

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/MANUAL.md

Use the `NOSLOT=1` environment variable with a wrapper script to trigger interactive mode, which is helpful for checking available slots. This example invokes `p11slotinfo` using the SoftHSM wrapper.

```bash
$ NOSLOT=1 with_softhsm p11slotinfo
```

--------------------------------

### Build Docker Image for Multiple Distributions

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Builds the toolkit using Docker for multiple specified distributions simultaneously. This allows for efficient building across different target environments.

```bash
$ ./buildx.sh ol9 ubuntu2404 deb12
```

--------------------------------

### Build pkcs11-tools on AIX 7.1 (IBM XLC)

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Build the toolkit on AIX 7.1 using the IBM XLC compiler. Ensure the PATH is set correctly and use the provided configure flags.

```bash
$ PATH=/usr/vac/bin:$PATH
$ ./configure --prefix=$PWD -C AR='ar -X64' CFLAGS='-q64' PKG_CONFIG_PATH=/opt/openssl-1.1.1/lib/pkgconfig
$ make
$ sudo make install
```

--------------------------------

### Import Data with p11importdata

Source: https://github.com/mastercard/pkcs11-tools/wiki/Home

Import arbitrary data into the keystore using `p11importdata`. This can be used for storing various types of data on the token.

```bash
p11importdata
```

--------------------------------

### List All Objects on a Token with p11ls

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/MANUAL.md

Execute this command to display all objects found on the token, including their attributes and key types. The output provides a concise summary of each object's properties.

```bash
$ p11ls
```

--------------------------------

### Configure pkcs11-tools for 32-bit Binaries on Solaris Sparc

Source: https://github.com/mastercard/pkcs11-tools/wiki/Installation

Configures pkcs11-tools to build 32-bit binaries on Solaris Sparc, using a statically linked OpenSSL library.

```bash
$ CFLAGS='-I$HOME/openssl/include' LDFLAGS=-L$HOME/openssl ./configure
```

--------------------------------

### Configure pkcs11-tools on AIX 7.1 with Statically Linked OpenSSL

Source: https://github.com/mastercard/pkcs11-tools/wiki/Installation

Configures pkcs11-tools on AIX 7.1 to use a statically linked OpenSSL library. Requires specific compiler and linker flags for 64-bit compilation.

```bash
$ PATH=/usr/vac/bin:$PATH
$ AR='ar -X64' CFLAGS='-q64 -qlanglvl=extc99 -I[OPENSSL_TARGET_DIR]/include' LDFLAGS=-L[OPENSSL_TARGET_DIR]/lib ./configure --prefix=$PWD -C
$ make
$ make install
```

--------------------------------

### Display PKCS#11 Slot and Token Information

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/MANUAL.md

Use this command to retrieve detailed information about a PKCS#11 library, its slots, and the tokens present in those slots. It lists supported mechanisms and their capabilities, indicating whether operations are hardware or software-based.

```bash
$ p11slotinfo -l /usr/local/opt/softhsm/lib/softhsm/libsofthsm2.so -s 0
PKCS#11 Library
---------------
Name        : /usr/local/lib/softhsm/libsofthsm2.so
Lib version : 2.6
API version : 2.40
Description : Implementation of PKCS11
Manufacturer: SoftHSM

Slot[0]
-------------
Slot Number : 1575777370
Description : SoftHSM slot ID 0x5dec745a
Manufacturer: SoftHSM project
Slot Flags  : [ CKF_TOKEN_PRESENT ]

Token
-------------
Label       : sofhsm-token-1
Manufacturer: SoftHSM project

Token Flags : [ CKF_RNG CKF_LOGIN_REQUIRED CKF_USER_PIN_INITIALIZED CKF_RESTORE_KEY_NOT_NEEDED CKF_TOKEN_INITIALIZED ]

Mechanisms:
-----------
CKM_MD5                                   --- --- hsh --- --- --- --- --- --- --- --- --- SW (00000210)
CKM_SHA_1                                 --- --- hsh --- --- --- --- --- --- --- --- --- SW (00000220)
CKM_SHA224                                --- --- hsh --- --- --- --- --- --- --- --- --- SW (00000255)
CKM_SHA256                                --- --- hsh --- --- --- --- --- --- --- --- --- SW (00000250)
CKM_SHA384                                --- --- hsh --- --- --- --- --- --- --- --- --- SW (00000260)
CKM_SHA512                                --- --- hsh --- --- --- --- --- --- --- --- --- SW (00000270)
CKM_MD5_HMAC                              --- --- --- sig --- vfy --- --- --- --- --- --- SW (00000211)
CKM_SHA_1_HMAC                            --- --- --- sig --- vfy --- --- --- --- --- --- SW (00000221)
CKM_SHA224_HMAC                           --- --- --- sig --- vfy --- --- --- --- --- --- SW (00000256)
CKM_SHA256_HMAC                           --- --- --- sig --- vfy --- --- --- --- --- --- SW (00000251)
CKM_SHA384_HMAC                           --- --- --- sig --- vfy --- --- --- --- --- --- SW (00000261)
CKM_SHA512_HMAC                           --- --- --- sig --- vfy --- --- --- --- --- --- SW (00000271)
CKM_RSA_PKCS_KEY_PAIR_GEN                 --- --- --- --- --- --- --- --- gkp --- --- --- SW (00000000)
CKM_RSA_PKCS                              enc dec --- sig --- vfy --- --- --- wra unw --- SW (00000001)
CKM_RSA_X_509                             enc dec --- sig --- vfy --- --- --- --- --- --- SW (00000003)
CKM_MD5_RSA_PKCS                          --- --- --- sig --- vfy --- --- --- --- --- --- SW (00000005)
CKM_SHA1_RSA_PKCS                         --- --- --- sig --- vfy --- --- --- --- --- --- SW (00000006)
CKM_RSA_PKCS_OAEP                         enc dec --- --- --- --- --- --- --- wra unw --- SW (00000009)
CKM_SHA224_RSA_PKCS                       --- --- --- sig --- vfy --- --- --- --- --- --- SW (00000046)
CKM_SHA256_RSA_PKCS                       --- --- --- sig --- vfy --- --- --- --- --- --- SW (00000040)
CKM_SHA384_RSA_PKCS                       --- --- --- sig --- vfy --- --- --- --- --- --- SW (00000041)
CKM_SHA512_RSA_PKCS                       --- --- --- sig --- vfy --- --- --- --- --- --- SW (00000042)
CKM_RSA_PKCS_PSS                          --- --- --- sig --- vfy --- --- --- --- --- --- SW (0000000d)
CKM_SHA1_RSA_PKCS_PSS                     --- --- --- sig --- vfy --- --- --- --- --- --- SW (0000000e)

```

--------------------------------

### List Slot and Mechanism Information with p11slotinfo

Source: https://context7.com/mastercard/pkcs11-tools/llms.txt

Display library metadata, available slots, token flags, and supported cryptographic mechanisms. Use interactive mode to choose a slot or non-interactive mode to target a specific slot index. For NSS keystores, specify the database directory with the -m flag.

```bash
# Interactive: prompts to choose a slot
$ p11slotinfo -l /usr/lib/softhsm/libsofthsm2.so
```

```bash
# Non-interactive: target slot index 0 directly
$ p11slotinfo -l /usr/lib/softhsm/libsofthsm2.so -s 0
```

```bash
# NSS keystore (requires -m to point at the NSS db directory)
$ p11slotinfo -l /usr/lib/libsoftokn3.so -m sql:. -s 1
```

--------------------------------

### Unwrap Key with p11unwrap

Source: https://github.com/mastercard/pkcs11-tools/wiki/Home

Unwrap a previously wrapped key using `p11unwrap`. Provide the wrapped key file as input to retrieve the original key.

```bash
$ p11unwrap -f wrapped-key.wrap
```

--------------------------------

### Configure and Compile for MacOS with Homebrew

Source: https://github.com/mastercard/pkcs11-tools/wiki/Installation

Configure and compile the project on macOS using Homebrew to manage dependencies.

```bash
$ eval $(brew shellenv)
$ CFLAGS=-I$HOMEBREW_PREFIX/opt/openssl/include LDFLAGS=-L$HOMEBREW_PREFIX/opt/openssl/lib ./configure [...]
```

--------------------------------

### Configure and Compile pkcs11-tools for Windows 32-bit Cross-compilation

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/INSTALL.md

Configure and compile the toolkit for 32-bit Windows executables using mingw32-gcc on Linux. Specify host, prefix, and OpenSSL library/include paths.

```bash
$ ./configure --host=i686-w64-mingw32 --prefix=$PWD LIBCRYPTO_LIBS="-L$(pwd)/openssl-win32/lib -lcrypto" LIBCRYPTO_CFLAGS="-I$(pwd)/openssl-win32/include"
$ make install
```

--------------------------------

### Create Wrapped Keys

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/MANUAL.md

Generate a session key and wrap it immediately using the -W parameter followed by wrapping parameters. Use -r to prevent storing a copy of the session key on the token if your PKCS#11 library does not support it. JWK output is available with the -J parameter.

```bash
`p11keygen` also supports JWK output with the -J parameter if required. See `p11wrap` for details.
```

--------------------------------

### Import arbitrary data with p11importdata

Source: https://github.com/mastercard/pkcs11-tools/wiki/Manual

Use p11importdata to load an arbitrary file and import it into a PKCS#11 token. Ensure the file exists and the token is accessible.

```bash
$ p11importdata -f hello.txt -i dummy_data
*** PKCS#11 Info : CreateObject() returned CKR_OK ( 0x00000000 )
p11importdata: import of data succeeded.
$
```

--------------------------------

### Import Public Key to Source Token

Source: https://github.com/mastercard/pkcs11-tools/blob/master/docs/MANUAL.md

Import the public key from the destination token to the source token. This allows the source token to wrap keys for the destination token.

```bash
p11importpubk -f rsa-wrapping-dest-key.pubk -i rsa-dest-wrapping-key
```