opencryptoki return values and the soft token's mechanism table

opencryptoki is the PKCS#11 stack on IBM Z and on any Linux that wants IBM’s crypto cards, and it ships a software token that needs no hardware at all. It is also the one library here that would not run for me. The front library talks to a daemon over shared memory, and without that daemon the first call fails in a way the specification would call recoverable and the reader will call the end of the road.

No daemon, no library

I built the current source with only the software token enabled and loaded libopencryptoki.so with the same read-only probe as the other pages. C_Initialize returned CKR_FUNCTION_FAILED. The library expects the pkcsslotd daemon to be running, root-owned and installed system-wide, and reports its absence with the code the specification reserves for a failure that leaves the library usable. Nothing is usable. So on this stack that code from C_Initialize means “start the daemon”, and the token-specific reasons come later.

The workhorse code

Across the shared code and the software token, return CKR_FUNCTION_FAILED appears 473 times, against 683 for success. The next most common are CKR_ATTRIBUTE_VALUE_INVALID at 145 and CKR_HOST_MEMORY at 126. The OpenSSL backend alone has 232 mentions of the function-failed code, one for nearly every OpenSSL call that can return an error, so a crypto failure of any kind arrives as this one value with the detail in the trace log. That is the opposite choice from SoftHSMv2, which reports the same failures as the general error, and a test suite that passes on one will see different codes on the other.

The table the probe could not read

The software token’s mechanism list is a static table in soft_specific.c, 182 entries with key size ranges and flags, nineteen of them behind build-time conditions such as the DSA and MD2 switches. That is what the table below is read from, since the daemon could not be run here. Fourteen entries are IBM’s own, in the vendor range: SHA-3 digests and HMACs under CKM_IBM_ names, and post-quantum ML-KEM, ML-DSA and Dilithium. The 3.2 specification now has standard numbers for ML-KEM and ML-DSA, and this table still lists them at IBM’s, which is the usual sequence when a vendor ships before the standard.

Mechanisms the token's own table lists

Read from the static mechanism table in the library's source rather than from a running library, because this one will not initialise without its daemon. It carries the same three facts a live probe reports, the mechanism, its key size range and the operations it is good for, and 19 of its entries sit behind build-time conditions, so a given build may list fewer. The same rows sit beside every other library's on the mechanism table.

182 mechanisms, 14 of them vendor-defined. 0 set CKF_HW, which claims the operation is done in hardware.

Mechanism	Hex	Keys	Operations
`CKM_RSA_PKCS_KEY_PAIR_GEN`	`0x00000000`	512–16384	generate_key_pair
`CKM_RSA_PKCS`	`0x00000001`	512–16384	encrypt, decrypt, wrap, unwrap, sign, verify, sign_recover, verify_recover, encapsulate, decapsulate
`CKM_RSA_X_509`	`0x00000003`	512–16384	encrypt, decrypt, wrap, unwrap, sign, verify, sign_recover, verify_recover
`CKM_MD2_RSA_PKCS`	`0x00000004`	512–16384	sign, verify
`CKM_MD5_RSA_PKCS`	`0x00000005`	512–16384	sign, verify
`CKM_SHA1_RSA_PKCS`	`0x00000006`	512–16384	sign, verify
`CKM_RSA_PKCS_OAEP`	`0x00000009`	512–16384	encrypt, decrypt, wrap, unwrap, encapsulate, decapsulate
`CKM_RSA_PKCS_PSS`	`0x0000000D`	512–16384	sign, verify
`CKM_SHA1_RSA_PKCS_PSS`	`0x0000000E`	512–16384	sign, verify
`CKM_ML_KEM_KEY_PAIR_GEN`	`0x0000000F`	800–1568	generate_key_pair
`CKM_DSA_KEY_PAIR_GEN`	`0x00000010`	512–1024	generate_key_pair
`CKM_DSA`	`0x00000011`	512–1024	sign, verify
`CKM_ML_KEM`	`0x00000017`	800–1568	encapsulate, decapsulate
`CKM_ML_DSA_KEY_PAIR_GEN`	`0x0000001C`	1312–2592	generate_key_pair
`CKM_ML_DSA`	`0x0000001D`	1312–2592	sign, verify
`CKM_HASH_ML_DSA`	`0x0000001F`	1312–2592	sign, verify
`CKM_DH_PKCS_KEY_PAIR_GEN`	`0x00000020`	512–8192	generate_key_pair
`CKM_DH_PKCS_DERIVE`	`0x00000021`	512–8192	derive, encapsulate, decapsulate
`CKM_HASH_ML_DSA_SHA224`	`0x00000023`	1312–2592	sign, verify
`CKM_HASH_ML_DSA_SHA256`	`0x00000024`	1312–2592	sign, verify
`CKM_HASH_ML_DSA_SHA384`	`0x00000025`	1312–2592	sign, verify
`CKM_HASH_ML_DSA_SHA512`	`0x00000026`	1312–2592	sign, verify
`CKM_HASH_ML_DSA_SHA3_224`	`0x00000027`	1312–2592	sign, verify
`CKM_HASH_ML_DSA_SHA3_256`	`0x00000028`	1312–2592	sign, verify
`CKM_HASH_ML_DSA_SHA3_384`	`0x00000029`	1312–2592	sign, verify
`CKM_HASH_ML_DSA_SHA3_512`	`0x0000002A`	1312–2592	sign, verify
`CKM_HASH_ML_DSA_SHAKE128`	`0x0000002B`	1312–2592	sign, verify
`CKM_HASH_ML_DSA_SHAKE256`	`0x0000002C`	1312–2592	sign, verify
`CKM_SHA256_RSA_PKCS`	`0x00000040`	512–16384	sign, verify
`CKM_SHA384_RSA_PKCS`	`0x00000041`	512–16384	sign, verify
`CKM_SHA512_RSA_PKCS`	`0x00000042`	512–16384	sign, verify
`CKM_SHA256_RSA_PKCS_PSS`	`0x00000043`	512–16384	sign, verify
`CKM_SHA384_RSA_PKCS_PSS`	`0x00000044`	512–16384	sign, verify
`CKM_SHA512_RSA_PKCS_PSS`	`0x00000045`	512–16384	sign, verify
`CKM_SHA224_RSA_PKCS`	`0x00000046`	512–16384	sign, verify
`CKM_SHA224_RSA_PKCS_PSS`	`0x00000047`	512–16384	sign, verify
`CKM_SHA512_224`	`0x00000048`	-	digest
`CKM_SHA512_224_HMAC`	`0x00000049`	112–2048	sign, verify
`CKM_SHA512_224_HMAC_GENERAL`	`0x0000004A`	112–2048	sign, verify
`CKM_SHA512_224_KEY_DERIVATION`	`0x0000004B`	8–224	derive
`CKM_SHA512_256`	`0x0000004C`	-	digest
`CKM_SHA512_256_HMAC`	`0x0000004D`	128–2048	sign, verify
`CKM_SHA512_256_HMAC_GENERAL`	`0x0000004E`	128–2048	sign, verify
`CKM_SHA512_256_KEY_DERIVATION`	`0x0000004F`	8–256	derive
`CKM_SHA3_256_RSA_PKCS`	`0x00000060`	512–16384	sign, verify
`CKM_SHA3_384_RSA_PKCS`	`0x00000061`	512–16384	sign, verify
`CKM_SHA3_512_RSA_PKCS`	`0x00000062`	512–16384	sign, verify
`CKM_SHA3_256_RSA_PKCS_PSS`	`0x00000063`	512–16384	sign, verify
`CKM_SHA3_384_RSA_PKCS_PSS`	`0x00000064`	512–16384	sign, verify
`CKM_SHA3_512_RSA_PKCS_PSS`	`0x00000065`	512–16384	sign, verify
`CKM_SHA3_224_RSA_PKCS`	`0x00000066`	512–16384	sign, verify
`CKM_SHA3_224_RSA_PKCS_PSS`	`0x00000067`	512–16384	sign, verify
`CKM_DES_KEY_GEN`	`0x00000120`	8–8	generate
`CKM_DES_ECB`	`0x00000121`	8–8	encrypt, decrypt, wrap, unwrap
`CKM_DES_CBC`	`0x00000122`	8–8	encrypt, decrypt, wrap, unwrap
`CKM_DES_CBC_PAD`	`0x00000125`	8–8	encrypt, decrypt, wrap, unwrap
`CKM_DES3_KEY_GEN`	`0x00000131`	24–24	generate
`CKM_DES3_ECB`	`0x00000132`	24–24	encrypt, decrypt, wrap, unwrap
`CKM_DES3_CBC`	`0x00000133`	24–24	encrypt, decrypt, wrap, unwrap
`CKM_DES3_MAC`	`0x00000134`	16–24	sign, verify
`CKM_DES3_MAC_GENERAL`	`0x00000135`	16–24	sign, verify
`CKM_DES3_CBC_PAD`	`0x00000136`	24–24	encrypt, decrypt, wrap, unwrap
`CKM_DES3_CMAC_GENERAL`	`0x00000137`	16–24	sign, verify
`CKM_DES3_CMAC`	`0x00000138`	16–24	sign, verify
`CKM_DES_OFB64`	`0x00000150`	24–24	encrypt, decrypt, wrap, unwrap
`CKM_DES_CFB64`	`0x00000152`	24–24	encrypt, decrypt, wrap, unwrap
`CKM_DES_CFB8`	`0x00000153`	24–24	encrypt, decrypt, wrap, unwrap
`CKM_MD2`	`0x00000200`	-	digest
`CKM_MD2_HMAC`	`0x00000201`	8–2048	sign, verify
`CKM_MD2_HMAC_GENERAL`	`0x00000202`	8–2048	sign, verify
`CKM_MD5`	`0x00000210`	-	digest
`CKM_MD5_HMAC`	`0x00000211`	8–2048	sign, verify
`CKM_MD5_HMAC_GENERAL`	`0x00000212`	8–2048	sign, verify
`CKM_SHA_1`	`0x00000220`	-	digest
`CKM_SHA_1_HMAC`	`0x00000221`	80–2048	sign, verify
`CKM_SHA_1_HMAC_GENERAL`	`0x00000222`	80–2048	sign, verify
`CKM_SHA256`	`0x00000250`	-	digest
`CKM_SHA256_HMAC`	`0x00000251`	128–2048	sign, verify
`CKM_SHA256_HMAC_GENERAL`	`0x00000252`	128–2048	sign, verify
`CKM_SHA224`	`0x00000255`	-	digest
`CKM_SHA224_HMAC`	`0x00000256`	112–2048	sign, verify
`CKM_SHA224_HMAC_GENERAL`	`0x00000257`	112–2048	sign, verify
`CKM_SHA384`	`0x00000260`	-	digest
`CKM_SHA384_HMAC`	`0x00000261`	192–2048	sign, verify
`CKM_SHA384_HMAC_GENERAL`	`0x00000262`	192–2048	sign, verify
`CKM_SHA512`	`0x00000270`	-	digest
`CKM_SHA512_HMAC`	`0x00000271`	256–2048	sign, verify
`CKM_SHA512_HMAC_GENERAL`	`0x00000272`	256–2048	sign, verify
`CKM_SHA3_256`	`0x000002B0`	-	digest
`CKM_SHA3_256_HMAC`	`0x000002B1`	128–2048	sign, verify
`CKM_SHA3_256_HMAC_GENERAL`	`0x000002B2`	128–2048	sign, verify
`CKM_SHA3_256_KEY_GEN`	`0x000002B3`	80–2048	generate
`CKM_SHA3_224`	`0x000002B5`	-	digest
`CKM_SHA3_224_HMAC`	`0x000002B6`	112–2048	sign, verify
`CKM_SHA3_224_HMAC_GENERAL`	`0x000002B7`	112–2048	sign, verify
`CKM_SHA3_224_KEY_GEN`	`0x000002B8`	80–2048	generate
`CKM_SHA3_384`	`0x000002C0`	-	digest
`CKM_SHA3_384_HMAC`	`0x000002C1`	192–2048	sign, verify
`CKM_SHA3_384_HMAC_GENERAL`	`0x000002C2`	192–2048	sign, verify
`CKM_SHA3_384_KEY_GEN`	`0x000002C3`	80–2048	generate
`CKM_SHA3_512`	`0x000002D0`	-	digest
`CKM_SHA3_512_HMAC`	`0x000002D1`	256–2048	sign, verify
`CKM_SHA3_512_HMAC_GENERAL`	`0x000002D2`	256–2048	sign, verify
`CKM_SHA3_512_KEY_GEN`	`0x000002D3`	80–2048	generate
`CKM_GENERIC_SECRET_KEY_GEN`	`0x00000350`	80–2048	generate
`CKM_SSL3_PRE_MASTER_KEY_GEN`	`0x00000370`	48–48	generate
`CKM_SSL3_MASTER_KEY_DERIVE`	`0x00000371`	48–48	derive
`CKM_SSL3_KEY_AND_MAC_DERIVE`	`0x00000372`	48–48	derive
`CKM_SSL3_MD5_MAC`	`0x00000380`	384–384	sign, verify
`CKM_SSL3_SHA1_MAC`	`0x00000381`	384–384	sign, verify
`CKM_SHA1_KEY_DERIVATION`	`0x00000392`	8–160	derive
`CKM_SHA256_KEY_DERIVATION`	`0x00000393`	8–256	derive
`CKM_SHA384_KEY_DERIVATION`	`0x00000394`	8–384	derive
`CKM_SHA512_KEY_DERIVATION`	`0x00000395`	8–512	derive
`CKM_SHA224_KEY_DERIVATION`	`0x00000396`	8–224	derive
`CKM_SHA3_256_KEY_DERIVATION`	`0x00000397`	8–256	derive
`CKM_SHA3_224_KEY_DERIVATION`	`0x00000398`	8–224	derive
`CKM_SHA3_384_KEY_DERIVATION`	`0x00000399`	8–384	derive
`CKM_SHA3_512_KEY_DERIVATION`	`0x0000039A`	8–512	derive
`CKM_SHAKE_128_KEY_DERIVATION`	`0x0000039B`	8–2048	derive
`CKM_SHAKE_256_KEY_DERIVATION`	`0x0000039C`	8–2048	derive
`CKM_ECDSA_KEY_PAIR_GEN`	`0x00001040`	160–521	generate_key_pair, ec_oid, ec_f_p, ec_uncompress, ec_compress
`CKM_ECDSA`	`0x00001041`	160–521	sign, verify, ec_oid, ec_f_p, ec_uncompress, ec_compress
`CKM_ECDSA_SHA1`	`0x00001042`	160–521	sign, verify, ec_oid, ec_f_p, ec_uncompress, ec_compress
`CKM_ECDSA_SHA224`	`0x00001043`	160–521	sign, verify, ec_oid, ec_f_p, ec_uncompress, ec_compress
`CKM_ECDSA_SHA256`	`0x00001044`	160–521	sign, verify, ec_oid, ec_f_p, ec_uncompress, ec_compress
`CKM_ECDSA_SHA384`	`0x00001045`	160–521	sign, verify, ec_oid, ec_f_p, ec_uncompress, ec_compress
`CKM_ECDSA_SHA512`	`0x00001046`	160–521	sign, verify, ec_oid, ec_f_p, ec_uncompress, ec_compress
`CKM_ECDSA_SHA3_224`	`0x00001047`	160–521	sign, verify, ec_oid, ec_f_p, ec_uncompress, ec_compress
`CKM_ECDSA_SHA3_256`	`0x00001048`	160–521	sign, verify, ec_oid, ec_f_p, ec_uncompress, ec_compress
`CKM_ECDSA_SHA3_384`	`0x00001049`	160–521	sign, verify, ec_oid, ec_f_p, ec_uncompress, ec_compress
`CKM_ECDSA_SHA3_512`	`0x0000104A`	160–521	sign, verify, ec_oid, ec_f_p, ec_uncompress, ec_compress
`CKM_ECDH1_DERIVE`	`0x00001050`	160–521	derive, ec_oid, ec_f_p, ec_uncompress, ec_compress, encapsulate, decapsulate
`CKM_ECDH1_COFACTOR_DERIVE`	`0x00001051`	160–521	derive, ec_oid, ec_f_p, ec_uncompress, ec_compress, encapsulate, decapsulate
`CKM_ECDH_AES_KEY_WRAP`	`0x00001053`	160–521	wrap, unwrap, ec_oid, ec_f_p, ec_uncompress, ec_compress
`CKM_RSA_AES_KEY_WRAP`	`0x00001054`	512–16384	wrap, unwrap
`CKM_EC_EDWARDS_KEY_PAIR_GEN`	`0x00001055`	255–448	generate_key_pair, ec_oid, ec_f_p, ec_compress
`CKM_EC_MONTGOMERY_KEY_PAIR_GEN`	`0x00001056`	255–448	generate_key_pair, ec_oid, ec_f_p, ec_compress
`CKM_EDDSA`	`0x00001057`	255–448	sign, verify, ec_oid, ec_f_p, ec_compress
`CKM_AES_XTS`	`0x00001071`	32–64	encrypt, decrypt, wrap, unwrap
`CKM_AES_XTS_KEY_GEN`	`0x00001072`	32–64	generate
`CKM_AES_KEY_GEN`	`0x00001080`	16–32	generate
`CKM_AES_ECB`	`0x00001081`	16–32	encrypt, decrypt, wrap, unwrap
`CKM_AES_CBC`	`0x00001082`	16–32	encrypt, decrypt, wrap, unwrap
`CKM_AES_MAC`	`0x00001083`	16–32	sign, verify
`CKM_AES_MAC_GENERAL`	`0x00001084`	16–32	sign, verify
`CKM_AES_CBC_PAD`	`0x00001085`	16–32	encrypt, decrypt, wrap, unwrap
`CKM_AES_CTR`	`0x00001086`	16–32	encrypt, decrypt, wrap, unwrap
`CKM_AES_GCM`	`0x00001087`	16–32	encrypt, decrypt, wrap, unwrap
`CKM_AES_CMAC`	`0x0000108A`	16–32	sign, verify
`CKM_AES_CMAC_GENERAL`	`0x0000108B`	16–32	sign, verify
`CKM_AES_OFB`	`0x00002104`	16–32	encrypt, decrypt, wrap, unwrap
`CKM_AES_CFB8`	`0x00002106`	16–32	encrypt, decrypt, wrap, unwrap
`CKM_AES_CFB128`	`0x00002107`	16–32	encrypt, decrypt, wrap, unwrap
`CKM_AES_KEY_WRAP`	`0x00002109`	32–64	encrypt, decrypt, wrap, unwrap
`CKM_AES_KEY_WRAP_PAD`	`0x0000210A`	32–64	encrypt, decrypt, wrap, unwrap
`CKM_AES_KEY_WRAP_KWP`	`0x0000210B`	32–64	encrypt, decrypt, wrap, unwrap
`CKM_AES_KEY_WRAP_PKCS7`	`0x0000210C`	32–64	encrypt, decrypt, wrap, unwrap
`CKM_SHA_1_KEY_GEN`	`0x00004003`	80–2048	generate
`CKM_SHA224_KEY_GEN`	`0x00004004`	80–2048	generate
`CKM_SHA256_KEY_GEN`	`0x00004005`	80–2048	generate
`CKM_SHA384_KEY_GEN`	`0x00004006`	80–2048	generate
`CKM_SHA512_KEY_GEN`	`0x00004007`	80–2048	generate
`CKM_SHA512_224_KEY_GEN`	`0x00004008`	80–2048	generate
`CKM_SHA512_256_KEY_GEN`	`0x00004009`	80–2048	generate
`CKM_ECDH_X_AES_KEY_WRAP`	`0x00004038`	255–448	wrap, unwrap, ec_oid, ec_f_p, ec_compress
`CKM_ECDH_COF_AES_KEY_WRAP`	`0x00004039`	160–521	wrap, unwrap, ec_oid, ec_f_p, ec_uncompress, ec_compress
`CKM_PUB_KEY_FROM_PRIV_KEY`	`0x0000403A`	-	derive
`CKM_IBM_SHA3_224`	`0x80010001`	-	digest
`CKM_IBM_SHA3_256`	`0x80010002`	-	digest
`CKM_IBM_SHA3_384`	`0x80010003`	-	digest
`CKM_IBM_SHA3_512`	`0x80010004`	-	digest
`CKM_IBM_DILITHIUM`	`0x80010023`	256–256	generate_key_pair, sign, verify
`CKM_IBM_SHA3_224_HMAC`	`0x80010025`	112–2048	sign, verify
`CKM_IBM_SHA3_256_HMAC`	`0x80010026`	128–2048	sign, verify
`CKM_IBM_SHA3_384_HMAC`	`0x80010027`	192–2048	sign, verify
`CKM_IBM_SHA3_512_HMAC`	`0x80010028`	256–2048	sign, verify
`CKM_IBM_ML_DSA_KEY_PAIR_GEN`	`0x80010035`	1312–2592	generate_key_pair
`CKM_IBM_ML_DSA`	`0x80010036`	1312–2592	sign, verify
`CKM_IBM_ML_KEM_KEY_PAIR_GEN`	`0x80010037`	800–1568	generate_key_pair
`CKM_IBM_ML_KEM`	`0x80010038`	800–1568	derive
`CKM_IBM_ML_KEM_WITH_ECDH`	`0x8001FF01`	800–1568	derive

source · opencryptoki soft token, from soft_stdll/soft_specific.c · 3.27.0 development · 430a47d · 2026-09-10

Return values with a note for this library

CKR_FUNCTION_FAILED · A recoverable failure. The library is still usable and the token unchanged, so this one is worth investigating rather than restarting.
CKR_CRYPTOKI_NOT_INITIALIZED · The library has no state in this process. In a process where two components share one module, the interesting case is the one that undid it.

How this page was made

Read from the source at the commit linked above. The return site counts are text searches over usr/lib/common and usr/lib/soft_stdll. The mechanism table is parsed from the soft token's static list and the vendor mechanism numbers from the project's public header, both at the same commit. The library was built here with only the software token and probed once, which produced the C_Initialize finding and nothing else.

Scope. A development commit on the main branch, one day before reading, after the 3.26 release. Distribution packages are older and list fewer mechanisms. The table shows every entry in the source including the conditional ones, so a particular build exposes at most this list.

Sources

opencryptoki repository at 430a47d, opencryptoki on GitHub. Read 2026-09-10. Used for return site counts, the soft token mechanism table and the vendor mechanism values.

Names and numbers only. No vendor documentation text is reproduced here.

IBM opencryptoki