/*

 * COPYRIGHT (c) International Business Machines Corp. 2001-2017

 *

 * This program is provided under the terms of the Common Public License,

 * version 1.0 (CPL-1.0). Any use, reproduction or distribution for this

 * software constitutes recipient's acceptance of CPL-1.0 terms which can be

 * found in the file LICENSE file or at

 * https://opensource.org/licenses/cpl1.0.php

 */

// File:  mech_des.c

//

// Mechanisms for DES

//

#include <string.h>             // for memcmp() et al

#include <stdlib.h>

#include "pkcs11types.h"

#include "defs.h"

#include "host_defs.h"

#include "h_extern.h"

#include "tok_spec_struct.h"

#include "trace.h"

#include <openssl/crypto.h>

//

//

CK_RV pk_des_ecb_encrypt(STDLL_TokData_t *tokdata,

                         SESSION *sess,

                         CK_BBOOL length_only,

                         ENCR_DECR_CONTEXT *ctx,

                         CK_BYTE *in_data,

                         CK_ULONG in_data_len,

                         CK_BYTE *out_data, CK_ULONG *out_data_len)

{

    OBJECT *key = NULL;

    CK_RV rc;

    if (!sess || !ctx || !out_data_len) {

        TRACE_ERROR("%s received bad argument(s)\n", __func__);

        return CKR_FUNCTION_FAILED;

    }

    // CKM_DES_ECB requires the input data to be an integral

    // multiple of the block size

    //

    if (in_data_len % DES_BLOCK_SIZE != 0) {

        TRACE_ERROR("%s\n", ock_err(ERR_DATA_LEN_RANGE));

        return CKR_DATA_LEN_RANGE;

    }

    rc = object_mgr_find_in_map1(tokdata, ctx->key, &key, READ_LOCK);

    if (rc != CKR_OK) {

        TRACE_ERROR("Failed to find specified object.\n");

        return rc;

    }

    if (length_only == TRUE) {

        *out_data_len = in_data_len;

        rc = CKR_OK;

        goto done;

    }

    if (*out_data_len < in_data_len) {

        *out_data_len = in_data_len;

        TRACE_ERROR("%s\n", ock_err(ERR_BUFFER_TOO_SMALL));

        rc = CKR_BUFFER_TOO_SMALL;

        goto done;

    }

    rc = ckm_des_ecb_encrypt(tokdata, in_data, in_data_len,

                             out_data, out_data_len, key);

done:

    object_put(tokdata, key, TRUE);

    key = NULL;

    return rc;

}

//

//

CK_RV des_ecb_decrypt(STDLL_TokData_t *tokdata,

                      SESSION *sess,

                      CK_BBOOL length_only,

                      ENCR_DECR_CONTEXT *ctx,

                      CK_BYTE *in_data,

                      CK_ULONG in_data_len,

                      CK_BYTE *out_data, CK_ULONG *out_data_len)

{

    OBJECT *key = NULL;

    CK_RV rc;

    if (!sess || !ctx || !out_data_len) {

        TRACE_ERROR("%s received bad argument(s)\n", __func__);

        return CKR_FUNCTION_FAILED;

    }

    // CKM_DES_ECB requires the input data to be an integral

    // multiple of the block size

    //

    if (in_data_len % DES_BLOCK_SIZE != 0) {

        TRACE_ERROR("%s\n", ock_err(ERR_ENCRYPTED_DATA_LEN_RANGE));

        return CKR_ENCRYPTED_DATA_LEN_RANGE;

    }

    rc = object_mgr_find_in_map1(tokdata, ctx->key, &key, READ_LOCK);

    if (rc != CKR_OK) {

        TRACE_ERROR("Failed to find specified object.\n");

        return rc;

    }

    if (length_only == TRUE) {

        *out_data_len = in_data_len;

        rc = CKR_OK;

        goto done;

    }

    if (*out_data_len < in_data_len) {

        *out_data_len = in_data_len;

        TRACE_ERROR("%s\n", ock_err(ERR_BUFFER_TOO_SMALL));

        rc = CKR_BUFFER_TOO_SMALL;

        goto done;

    }

    rc = ckm_des_ecb_decrypt(tokdata, in_data, in_data_len,

                             out_data, out_data_len, key);

done:

    object_put(tokdata, key, TRUE);

    key = NULL;

    return rc;

}

//

//

CK_RV pk_des_cbc_encrypt(STDLL_TokData_t *tokdata,

                         SESSION *sess,

                         CK_BBOOL length_only,

                         ENCR_DECR_CONTEXT *ctx,

                         CK_BYTE *in_data,

                         CK_ULONG in_data_len,

                         CK_BYTE *out_data, CK_ULONG *out_data_len)

{

    OBJECT *key = NULL;

    CK_RV rc;

    if (!sess || !ctx || !out_data_len) {

        TRACE_ERROR("%s received bad argument(s)\n", __func__);

        return CKR_FUNCTION_FAILED;

    }

    // CKM_DES_CBC requires the input data to be an integral

    // multiple of the block size

    //

    if (in_data_len % DES_BLOCK_SIZE != 0) {

        TRACE_ERROR("%s\n", ock_err(ERR_DATA_LEN_RANGE));

        return CKR_DATA_LEN_RANGE;

    }

    rc = object_mgr_find_in_map1(tokdata, ctx->key, &key, READ_LOCK);

    if (rc != CKR_OK) {

        TRACE_ERROR("Failed to find specified object.\n");

        return rc;

    }

    if (length_only == TRUE) {

        *out_data_len = in_data_len;

        rc = CKR_OK;

        goto done;

    }

    if (*out_data_len < in_data_len) {

        *out_data_len = in_data_len;

        TRACE_ERROR("%s\n", ock_err(ERR_BUFFER_TOO_SMALL));

        rc = CKR_BUFFER_TOO_SMALL;

        goto done;

    }

    rc = ckm_des_cbc_encrypt(tokdata, in_data, in_data_len, out_data,

                             out_data_len, ctx->mech.pParameter, key);

done:

    object_put(tokdata, key, TRUE);

    key = NULL;

    return rc;

}

//

//

CK_RV des_cbc_decrypt(STDLL_TokData_t *tokdata,

                      SESSION *sess,

                      CK_BBOOL length_only,

                      ENCR_DECR_CONTEXT *ctx,

                      CK_BYTE *in_data,

                      CK_ULONG in_data_len,

                      CK_BYTE *out_data, CK_ULONG *out_data_len)

{

    OBJECT *key = NULL;

    CK_RV rc;

    if (!sess || !ctx || !out_data_len) {

        TRACE_ERROR("%s received bad argument(s)\n", __func__);

        return CKR_FUNCTION_FAILED;

    }

    // CKM_DES_CBC requires the input data to be an integral

    // multiple of the block size

    //

    if (in_data_len % DES_BLOCK_SIZE != 0) {

        TRACE_ERROR("%s\n", ock_err(ERR_ENCRYPTED_DATA_LEN_RANGE));

        return CKR_ENCRYPTED_DATA_LEN_RANGE;

    }

    rc = object_mgr_find_in_map1(tokdata, ctx->key, &key, READ_LOCK);

    if (rc != CKR_OK) {

        TRACE_ERROR("Failed to find specified object.\n");

        return rc;

    }

    if (length_only == TRUE) {

        *out_data_len = in_data_len;

        rc = CKR_OK;

        goto done;

    }

    if (*out_data_len < in_data_len) {

        *out_data_len = in_data_len;

        TRACE_ERROR("%s\n", ock_err(ERR_BUFFER_TOO_SMALL));

        rc = CKR_BUFFER_TOO_SMALL;

        goto done;

    }

    rc = ckm_des_cbc_decrypt(tokdata, in_data, in_data_len, out_data,

                             out_data_len, ctx->mech.pParameter, key);

done:

    object_put(tokdata, key, TRUE);

    key = NULL;

    return rc;

}

//

//

CK_RV des_cbc_pad_encrypt(STDLL_TokData_t *tokdata,

                          SESSION *sess,

                          CK_BBOOL length_only,

                          ENCR_DECR_CONTEXT *ctx,

                          CK_BYTE *in_data,

                          CK_ULONG in_data_len,

                          CK_BYTE *out_data, CK_ULONG *out_data_len)

{

    OBJECT *key = NULL;

    CK_BYTE *clear = NULL;

    CK_ULONG padded_len;

    CK_RV rc;

    if (!sess || !ctx || !out_data_len) {

        TRACE_ERROR("%s received bad argument(s)\n", __func__);

        return CKR_FUNCTION_FAILED;

    }

    // DES-CBC-PAD has no input length requirements

    //

    rc = object_mgr_find_in_map1(tokdata, ctx->key, &key, READ_LOCK);

    if (rc != CKR_OK) {

        TRACE_ERROR("Failed to find specified object.\n");

        return rc;

    }

    // compute the output length, accounting for padding

    //

    padded_len = DES_BLOCK_SIZE * (in_data_len / DES_BLOCK_SIZE + 1);

    if (length_only == TRUE) {

        *out_data_len = padded_len;

        rc = CKR_OK;

        goto done;

    }

    if (*out_data_len < padded_len) {

        *out_data_len = padded_len;

        TRACE_ERROR("%s\n", ock_err(ERR_BUFFER_TOO_SMALL));

        rc = CKR_BUFFER_TOO_SMALL;

        goto done;

    }

    clear = (CK_BYTE *) malloc(padded_len);

    if (!clear) {

        TRACE_ERROR("%s\n", ock_err(ERR_HOST_MEMORY));

        rc = CKR_HOST_MEMORY;

        goto done;

    }

    if (in_data != NULL && in_data_len > 0)

        memcpy(clear, in_data, in_data_len);

    add_pkcs_padding(clear + in_data_len,

                     DES_BLOCK_SIZE, in_data_len, padded_len);

    rc = ckm_des_cbc_encrypt(tokdata, clear, padded_len, out_data, out_data_len,

                             ctx->mech.pParameter, key);

    free(clear);

done:

    object_put(tokdata, key, TRUE);

    key = NULL;

    return rc;

}

//

//

CK_RV des_cbc_pad_decrypt(STDLL_TokData_t *tokdata,

                          SESSION *sess,

                          CK_BBOOL length_only,

                          ENCR_DECR_CONTEXT *ctx,

                          CK_BYTE *in_data,

                          CK_ULONG in_data_len,

                          CK_BYTE *out_data, CK_ULONG *out_data_len)

{

    OBJECT *key = NULL;

    CK_BYTE *clear = NULL;

    CK_ULONG padded_len;

    CK_RV rc;

    if (!sess || !ctx || !out_data_len) {

        TRACE_ERROR("%s received bad argument(s)\n", __func__);

        return CKR_FUNCTION_FAILED;

    }

    //

    // no need to validate the input length since we'll pad as necessary

    //

    rc = object_mgr_find_in_map1(tokdata, ctx->key, &key, READ_LOCK);

    if (rc != CKR_OK) {

        TRACE_ERROR("Failed to find specified object.\n");

        return rc;

    }

    // we're decrypting so even with CBC-PAD, we should have an integral

    // number of block to decrypt

    //

    if (in_data_len % DES_BLOCK_SIZE != 0) {

        TRACE_ERROR("%s\n", ock_err(ERR_ENCRYPTED_DATA_LEN_RANGE));

        rc = CKR_ENCRYPTED_DATA_LEN_RANGE;

        goto done;

    }

    // the amount of cleartext after stripping the padding will actually be less

    // than the input bytes...

    //

    padded_len = in_data_len;

    if (length_only == TRUE) {

        *out_data_len = padded_len;

        rc = CKR_OK;

        goto done;

    }

    clear = (CK_BYTE *) malloc(padded_len);

    if (!clear) {

        TRACE_ERROR("%s\n", ock_err(ERR_HOST_MEMORY));

        rc = CKR_HOST_MEMORY;

        goto done;

    }

    rc = ckm_des_cbc_decrypt(tokdata, in_data, in_data_len, clear, &padded_len,

                             ctx->mech.pParameter, key);

    if (rc == CKR_OK) {

        strip_pkcs_padding(clear, padded_len, out_data_len);

        memcpy(out_data, clear, *out_data_len);

    }

    free(clear);

done:

    object_put(tokdata, key, TRUE);

    key = NULL;

    return rc;

}

//

//

CK_RV des_ecb_encrypt_update(STDLL_TokData_t *tokdata,

                             SESSION *sess,

                             CK_BBOOL length_only,

                             ENCR_DECR_CONTEXT *ctx,

                             CK_BYTE *in_data,

                             CK_ULONG in_data_len,

                             CK_BYTE *out_data, CK_ULONG *out_data_len)

{

    DES_CONTEXT *context = NULL;

    OBJECT *key = NULL;

    CK_BYTE *clear = NULL;

    CK_ULONG total, remain, out_len;

    CK_RV rc;

    if (!sess || !ctx || !out_data_len) {

        TRACE_ERROR("%s received bad argument(s)\n", __func__);

        return CKR_FUNCTION_FAILED;

    }

    context = (DES_CONTEXT *) ctx->context;

    total = (context->len + in_data_len);

    if (total < DES_BLOCK_SIZE) {

        if (length_only == FALSE && in_data_len) {

            memcpy(context->data + context->len, in_data, in_data_len);

            context->len += in_data_len;

        }

        *out_data_len = 0;

        return CKR_OK;

    } else {

        // we have at least 1 block

        //

        remain = (total % DES_BLOCK_SIZE);

        out_len = (total - remain);     // should always be at least 1 block

        if (length_only == TRUE) {

            *out_data_len = out_len;

            return CKR_OK;

        }

        rc = object_mgr_find_in_map_nocache(tokdata, ctx->key, &key, READ_LOCK);

        if (rc != CKR_OK) {

            TRACE_ERROR("Failed to find specified object.\n");

            return rc;

        }

        clear = (CK_BYTE *) malloc(out_len);

        if (!clear) {

            TRACE_ERROR("%s\n", ock_err(ERR_HOST_MEMORY));

            object_put(tokdata, key, TRUE);

            key = NULL;

            return CKR_HOST_MEMORY;

        }

        // copy any data left over from the previous encryption operation first

        //

        memcpy(clear, context->data, context->len);

        memcpy(clear + context->len, in_data, out_len - context->len);

        rc = ckm_des_ecb_encrypt(tokdata, clear, out_len, out_data,

                                 out_data_len, key);

        if (rc == CKR_OK) {

            *out_data_len = out_len;

            // update the context buffer.  we already used the buffer's current

            // contents so we completely overwrite it

            //

            if (remain != 0)

                memcpy(context->data, in_data + (in_data_len - remain), remain);

            context->len = remain;

        }

        free(clear);

        object_put(tokdata, key, TRUE);

        key = NULL;

        return rc;

    }

}

//

//

CK_RV des_ecb_decrypt_update(STDLL_TokData_t *tokdata,

                             SESSION *sess,

                             CK_BBOOL length_only,

                             ENCR_DECR_CONTEXT *ctx,

                             CK_BYTE *in_data,

                             CK_ULONG in_data_len,

                             CK_BYTE *out_data, CK_ULONG *out_data_len)

{

    DES_CONTEXT *context = NULL;

    OBJECT *key = NULL;

    CK_BYTE *cipher = NULL;

    CK_ULONG total, remain, out_len;

    CK_RV rc;

    if (!sess || !ctx || !out_data_len) {

        TRACE_ERROR("%s received bad argument(s)\n", __func__);

        return CKR_FUNCTION_FAILED;

    }

    context = (DES_CONTEXT *) ctx->context;

    total = (context->len + in_data_len);

    if (total < DES_BLOCK_SIZE) {

        if (length_only == FALSE && in_data_len) {

            memcpy(context->data + context->len, in_data, in_data_len);

            context->len += in_data_len;

        }

        *out_data_len = 0;

        return CKR_OK;

    } else {

        // we have at least 1 block

        //

        remain = (total % DES_BLOCK_SIZE);

        out_len = total - remain;

        if (length_only == TRUE) {

            *out_data_len = out_len;

            return CKR_OK;

        }

        rc = object_mgr_find_in_map_nocache(tokdata, ctx->key, &key, READ_LOCK);

        if (rc != CKR_OK) {

            TRACE_ERROR("Failed to find specified object.\n");

            return rc;

        }

        cipher = (CK_BYTE *) malloc(out_len);

        if (!cipher) {

            TRACE_ERROR("%s\n", ock_err(ERR_HOST_MEMORY));

            object_put(tokdata, key, TRUE);

            key = NULL;

            return CKR_HOST_MEMORY;

        }

        // copy any data left over from the previous decryption operation first

        //

        memcpy(cipher, context->data, context->len);

        memcpy(cipher + context->len, in_data, out_len - context->len);

        rc = ckm_des_ecb_decrypt(tokdata, cipher, out_len, out_data,

                                 out_data_len, key);

        if (rc == CKR_OK) {

            *out_data_len = out_len;

            // copy the remaining 'new' input data to the context buffer

            //

            if (remain != 0)

                memcpy(context->data, in_data + (in_data_len - remain), remain);

            context->len = remain;

        }

        free(cipher);

        object_put(tokdata, key, TRUE);

        key = NULL;

        return rc;

    }

}

//

//

CK_RV des_cbc_encrypt_update(STDLL_TokData_t *tokdata,

                             SESSION *sess,

                             CK_BBOOL length_only,

                             ENCR_DECR_CONTEXT *ctx,

                             CK_BYTE *in_data,

                             CK_ULONG in_data_len,

                             CK_BYTE *out_data, CK_ULONG *out_data_len)

{

    DES_CONTEXT *context = NULL;

    OBJECT *key = NULL;

    CK_BYTE *clear = NULL;

    CK_ULONG total, remain, out_len;

    CK_RV rc;

    if (!sess || !ctx || !out_data_len) {

        TRACE_ERROR("%s received bad argument(s)\n", __func__);

        return CKR_FUNCTION_FAILED;

    }

    context = (DES_CONTEXT *) ctx->context;

    total = (context->len + in_data_len);

    if (total < DES_BLOCK_SIZE) {

        if (length_only == FALSE && in_data_len) {

            memcpy(context->data + context->len, in_data, in_data_len);

            context->len += in_data_len;

        }

        *out_data_len = 0;

        return CKR_OK;

    } else {

        // we have at least 1 block

        //

        remain = (total % DES_BLOCK_SIZE);

        out_len = total - remain;

        if (length_only == TRUE) {

            *out_data_len = out_len;

            return CKR_OK;

        }

        rc = object_mgr_find_in_map_nocache(tokdata, ctx->key, &key, READ_LOCK);

        if (rc != CKR_OK) {

            TRACE_ERROR("Failed to find specified object.\n");

            return rc;

        }

        // these buffers need to be longword aligned

        //

        clear = (CK_BYTE *) malloc(out_len);

        if (!clear) {

            TRACE_ERROR("%s\n", ock_err(ERR_HOST_MEMORY));

            object_put(tokdata, key, TRUE);

            key = NULL;

            return CKR_HOST_MEMORY;

        }

        // copy any data left over from the previous encryption operation first

        //

        memcpy(clear, context->data, context->len);

        memcpy(clear + context->len, in_data, out_len - context->len);

        rc = ckm_des_cbc_encrypt(tokdata, clear, out_len, out_data,

                                 out_data_len, ctx->mech.pParameter, key);

        if (rc == CKR_OK) {

            *out_data_len = out_len;

            // the new init_v is the last encrypted data block

            //

            memcpy(ctx->mech.pParameter,

                   out_data + (*out_data_len - DES_BLOCK_SIZE), DES_BLOCK_SIZE);

            // copy the remaining 'new' input data to the context buffer

            //

            if (remain != 0)

                memcpy(context->data, in_data + (in_data_len - remain), remain);

            context->len = remain;

        }

        free(clear);

        object_put(tokdata, key, TRUE);

        key = NULL;

        return rc;

    }

}

//

//

CK_RV des_cbc_decrypt_update(STDLL_TokData_t *tokdata,

                             SESSION *sess,

                             CK_BBOOL length_only,

                             ENCR_DECR_CONTEXT *ctx,

                             CK_BYTE *in_data,

                             CK_ULONG in_data_len,

                             CK_BYTE *out_data, CK_ULONG *out_data_len)

{

    DES_CONTEXT *context = NULL;

    OBJECT *key = NULL;

    CK_BYTE *cipher = NULL;

    CK_ULONG total, remain, out_len;

    CK_RV rc;

    if (!sess || !ctx || !out_data_len) {

        TRACE_ERROR("%s received bad argument(s)\n", __func__);

        return CKR_FUNCTION_FAILED;

    }

    context = (DES_CONTEXT *) ctx->context;

    total = context->len + in_data_len;

    if (total < DES_BLOCK_SIZE) {

        if (length_only == FALSE && in_data_len) {

            memcpy(context->data + context->len, in_data, in_data_len);

            context->len += in_data_len;

        }

        *out_data_len = 0;

        return CKR_OK;

    } else {

        // we have at least 1 block

        //

        remain = total % DES_BLOCK_SIZE;

        out_len = total - remain;

        if (length_only == TRUE) {

            *out_data_len = out_len;

            return CKR_OK;

        }

        rc = object_mgr_find_in_map_nocache(tokdata, ctx->key, &key, READ_LOCK);

        if (rc != CKR_OK) {

            TRACE_ERROR("Failed to find specified object.\n");

            return rc;

        }

        // these buffers need to be longword aligned

        //

        cipher = (CK_BYTE *) malloc(out_len);

        if (!cipher) {

            TRACE_ERROR("%s\n", ock_err(ERR_HOST_MEMORY));

            object_put(tokdata, key, TRUE);

            key = NULL;

            return CKR_HOST_MEMORY;

        }

        // copy any data left over from the previous decryption operation first

        //

        memcpy(cipher, context->data, context->len);

        memcpy(cipher + context->len, in_data, out_len - context->len);

        rc = ckm_des_cbc_decrypt(tokdata, cipher, out_len, out_data,

                                 out_data_len, ctx->mech.pParameter, key);

        if (rc == CKR_OK) {

            *out_data_len = out_len;

            // the new init_v is the last decrypted data block

            //

            memcpy(ctx->mech.pParameter, cipher + (out_len - DES_BLOCK_SIZE),

                   DES_BLOCK_SIZE);

            // copy the remaining 'new' input data to the context buffer

            //

            if (remain != 0)

                memcpy(context->data, in_data + (in_data_len - remain), remain);

            context->len = remain;

        }

        free(cipher);

        object_put(tokdata, key, TRUE);

        key = NULL;

        return rc;

    }

}

//

//

CK_RV des_cbc_pad_encrypt_update(STDLL_TokData_t *tokdata,

                                 SESSION *sess,

                                 CK_BBOOL length_only,

                                 ENCR_DECR_CONTEXT *ctx,

                                 CK_BYTE *in_data,

                                 CK_ULONG in_data_len,

                                 CK_BYTE *out_data, CK_ULONG *out_data_len)

{

    DES_CONTEXT *context = NULL;

    OBJECT *key = NULL;

    CK_BYTE *clear = NULL;

    CK_ULONG total, remain, out_len;

    CK_RV rc;

    if (!sess || !ctx || !out_data_len) {

        TRACE_ERROR("%s received bad argument(s)\n", __func__);

        return CKR_FUNCTION_FAILED;

    }

    context = (DES_CONTEXT *) ctx->context;

    total = (context->len + in_data_len);

    // note, this is subtly different from the other encrypt update routines

    //

    if (total <= DES_BLOCK_SIZE) {

        if (length_only == FALSE && in_data_len) {

            memcpy(context->data + context->len, in_data, in_data_len);

            context->len += in_data_len;

        }

        *out_data_len = 0;

        return CKR_OK;

    } else {

        // we have at least 1 block + 1 byte

        //

        remain = total % DES_BLOCK_SIZE;

        out_len = total - remain;

        if (remain == 0) {

            remain = DES_BLOCK_SIZE;

            out_len -= DES_BLOCK_SIZE;

        }

        if (length_only == TRUE) {

            *out_data_len = out_len;

            return CKR_OK;

        }

        // at this point, we should have:

        //    1) remain != 0

        //    2) out_len != 0

        //

        rc = object_mgr_find_in_map_nocache(tokdata, ctx->key, &key, READ_LOCK);

        if (rc != CKR_OK) {

            TRACE_ERROR("Failed to find specified object.\n");

            return rc;

        }

        // these buffers need to be longword aligned

        //

        clear = (CK_BYTE *) malloc(out_len);

        if (!clear) {

            TRACE_ERROR("%s\n", ock_err(ERR_HOST_MEMORY));

            object_put(tokdata, key, TRUE);

            key = NULL;

            return CKR_HOST_MEMORY;

        }

        // copy any data left over from the previous encryption operation first

        //

        memcpy(clear, context->data, context->len);

        memcpy(clear + context->len, in_data, out_len - context->len);

        //

        // we don't do padding during the update

        //

        rc = ckm_des_cbc_encrypt(tokdata, clear, out_len, out_data,

                                 out_data_len, ctx->mech.pParameter, key);

        if (rc == CKR_OK) {

            // the new init_v is the last encrypted data block

            //

            memcpy(ctx->mech.pParameter,

                   out_data + (*out_data_len - DES_BLOCK_SIZE), DES_BLOCK_SIZE);

            // copy the remaining 'new' input data to the temporary space

            //

            memcpy(context->data, in_data + (in_data_len - remain), remain);

            context->len = remain;

        }

        free(clear);

        object_put(tokdata, key, TRUE);

        key = NULL;

        return rc;

    }

}

//

//

CK_RV des_cbc_pad_decrypt_update(STDLL_TokData_t *tokdata,

                                 SESSION *sess,

                                 CK_BBOOL length_only,

                                 ENCR_DECR_CONTEXT *ctx,

                                 CK_BYTE *in_data,

                                 CK_ULONG in_data_len,

                                 CK_BYTE *out_data, CK_ULONG *out_data_len)

{

    DES_CONTEXT *context = NULL;

    OBJECT *key = NULL;

    CK_BYTE *cipher = NULL;

    CK_ULONG total, remain, out_len;

    CK_RV rc;

    if (!sess || !ctx || !out_data_len) {

        TRACE_ERROR("%s received bad argument(s)\n", __func__);

        return CKR_FUNCTION_FAILED;

    }

    context = (DES_CONTEXT *) ctx->context;

    total = (context->len + in_data_len);

    // note, this is subtly different from the other decrypt update routines

    //

    if (total <= DES_BLOCK_SIZE) {

        if (length_only == FALSE && in_data_len) {

            memcpy(context->data + context->len, in_data, in_data_len);

            context->len += in_data_len;

        }

        *out_data_len = 0;

        return CKR_OK;

    } else {

        // we have at least 1 block + 1 byte

        //

        remain = total % DES_BLOCK_SIZE;

        out_len = total - remain;

        if (remain == 0) {

            remain = DES_BLOCK_SIZE;

            out_len -= DES_BLOCK_SIZE;

        }