本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。 # PKCS \#11 AWS CloudHSM 客户端 SDK 3 的库属性表 AWS CloudHSM 客户端 SDK 3 的 PKCS \#11 库表包含因密钥类型而异的属性列表。它表示在使用特定加密函数时，特定密钥类型是否支持给定属性。 AWS CloudHSM **图例：** + ✔ 表示 CloudHSM 对特定密钥类型支持此属性。 + ✖ 表示 CloudHSM 对特定密钥类型不支持此属性。 + R 表示特定密钥类型的属性值设置为只读的。 + S 表示无法通过 `GetAttributeValue` 读取该属性，因为它是敏感属性。 + 默认值列中的空单元格表示没有给该属性分配特定的默认值。 ## GenerateKeyPair

属性	密钥类型				默认值
	EC 私有	EC 公有	RSA 私有	RSA 公有
`CKA_CLASS`	✔	✔	✔	✔
`CKA_KEY_TYPE`	✔	✔	✔	✔
`CKA_LABEL`	✔	✔	✔	✔
`CKA_ID`	✔	✔	✔	✔
`CKA_LOCAL`	R	R	R	R	True
`CKA_TOKEN`	✔	✔	✔	✔	False
`CKA_PRIVATE`	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	True
`CKA_ENCRYPT`	✖	✔	✖	✔	False
`CKA_DECRYPT`	✔	✖	✔	✖	False
`CKA_DERIVE`	✔	✔	✔	✔	False
`CKA_MODIFIABLE`	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	True
`CKA_DESTROYABLE`	✔	✔	✔	✔	True
`CKA_SIGN`	✔	✖	✔	✖	False
`CKA_SIGN_RECOVER`	✖	✖	✔[3](#pkcs11-v3-f10)	✖
`CKA_VERIFY`	✖	✔	✖	✔	False
`CKA_VERIFY_RECOVER`	✖	✖	✖	✔[4](#pkcs11-v3-f11)
`CKA_WRAP`	✖	✔	✖	✔	False
`CKA_WRAP_TEMPLATE`	✖	✔	✖	✔
`CKA_TRUSTED`	✖	✔	✖	✔	False
`CKA_WRAP_WITH_TRUSTED`	✔	✖	✔	✖	False
`CKA_UNWRAP`	✔	✖	✔	✖	False
`CKA_UNWRAP_TEMPLATE`	✔	✖	✔	✖
`CKA_SENSITIVE`	✔	✖	✔	✖	True
`CKA_ALWAYS_SENSITIVE`	R	✖	R	✖
`CKA_EXTRACTABLE`	✔	✖	✔	✖	True
`CKA_NEVER_EXTRACTABLE`	R	✖	R	✖
`CKA_MODULUS`	✖	✖	✖	✖
`CKA_MODULUS_BITS`	✖	✖	✖	✔[2](#pkcs11-v3-f9)
`CKA_PRIME_1`	✖	✖	✖	✖
`CKA_PRIME_2`	✖	✖	✖	✖
`CKA_COEFFICIENT`	✖	✖	✖	✖
`CKA_EXPONENT_1`	✖	✖	✖	✖
`CKA_EXPONENT_2`	✖	✖	✖	✖
`CKA_PRIVATE_EXPONENT`	✖	✖	✖	✖
`CKA_PUBLIC_EXPONENT`	✖	✖	✖	✔[2](#pkcs11-v3-f9)
`CKA_EC_PARAMS`	✖	✔[2](#pkcs11-v3-f9)	✖	✖
`CKA_EC_POINT`	✖	✖	✖	✖
`CKA_VALUE`	✖	✖	✖	✖
`CKA_VALUE_LEN`	✖	✖	✖	✖
`CKA_CHECK_VALUE`	R	R	R	R

## GenerateKey

属性	密钥类型			默认值
	AES	DES3	普通机密
`CKA_CLASS`	✔	✔	✔
`CKA_KEY_TYPE`	✔	✔	✔
`CKA_LABEL`	✔	✔	✔
`CKA_ID`	✔	✔	✔
`CKA_LOCAL`	R	R	R	True
`CKA_TOKEN`	✔	✔	✔	False
`CKA_PRIVATE`	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	True
`CKA_ENCRYPT`	✔	✔	✖	False
`CKA_DECRYPT`	✔	✔	✖	False
`CKA_DERIVE`	✔	✔	✔	False
`CKA_MODIFIABLE`	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	True
`CKA_DESTROYABLE`	✔	✔	✔	True
`CKA_SIGN`	✔	✔	✔	True
`CKA_SIGN_RECOVER`	✖	✖	✖
`CKA_VERIFY`	✔	✔	✔	True
`CKA_VERIFY_RECOVER`	✖	✖	✖
`CKA_WRAP`	✔	✔	✖	False
`CKA_WRAP_TEMPLATE`	✔	✔	✖
`CKA_TRUSTED`	✔	✔	✖	False
`CKA_WRAP_WITH_TRUSTED`	✔	✔	✔	False
`CKA_UNWRAP`	✔	✔	✖	False
`CKA_UNWRAP_TEMPLATE`	✔	✔	✖
`CKA_SENSITIVE`	✔	✔	✔	True
`CKA_ALWAYS_SENSITIVE`	✖	✖	✖
`CKA_EXTRACTABLE`	✔	✔	✔	True
`CKA_NEVER_EXTRACTABLE`	R	R	R
`CKA_MODULUS`	✖	✖	✖
`CKA_MODULUS_BITS`	✖	✖	✖
`CKA_PRIME_1`	✖	✖	✖
`CKA_PRIME_2`	✖	✖	✖
`CKA_COEFFICIENT`	✖	✖	✖
`CKA_EXPONENT_1`	✖	✖	✖
`CKA_EXPONENT_2`	✖	✖	✖
`CKA_PRIVATE_EXPONENT`	✖	✖	✖
`CKA_PUBLIC_EXPONENT`	✖	✖	✖
`CKA_EC_PARAMS`	✖	✖	✖
`CKA_EC_POINT`	✖	✖	✖
`CKA_VALUE`	✖	✖	✖
`CKA_VALUE_LEN`	✔[2](#pkcs11-v3-f9)	✖	✔[2](#pkcs11-v3-f9)
`CKA_CHECK_VALUE`	R	R	R

## CreateObject

属性	密钥类型							默认值
	EC 私有	EC 公有	RSA 私有	RSA 公有	AES	DES3	普通机密
`CKA_CLASS`	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)
`CKA_KEY_TYPE`	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)
`CKA_LABEL`	✔	✔	✔	✔	✔	✔	✔
`CKA_ID`	✔	✔	✔	✔	✔	✔	✔
`CKA_LOCAL`	R	R	R	R	R	R	R	False
`CKA_TOKEN`	✔	✔	✔	✔	✔	✔	✔	False
`CKA_PRIVATE`	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	True
`CKA_ENCRYPT`	✖	✖	✖	✔	✔	✔	✖	False
`CKA_DECRYPT`	✖	✖	✔	✖	✔	✔	✖	False
`CKA_DERIVE`	✔	✔	✔	✔	✔	✔	✔	False
`CKA_MODIFIABLE`	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	True
`CKA_DESTROYABLE`	✔	✔	✔	✔	✔	✔	✔	True
`CKA_SIGN`	✔	✖	✔	✖	✔	✔	✔	False
`CKA_SIGN_RECOVER`	✖	✖	✔[3](#pkcs11-v3-f10)	✖	✖	✖	✖	False
`CKA_VERIFY`	✖	✔	✖	✔	✔	✔	✔	False
`CKA_VERIFY_RECOVER`	✖	✖	✖	✔[4](#pkcs11-v3-f11)	✖	✖	✖
`CKA_WRAP`	✖	✖	✖	✔	✔	✔	✖	False
`CKA_WRAP_TEMPLATE`	✖	✔	✖	✔	✔	✔	✖
`CKA_TRUSTED`	✖	✔	✖	✔	✔	✔	✖	False
`CKA_WRAP_WITH_TRUSTED`	✔	✖	✔	✖	✔	✔	✔	False
`CKA_UNWRAP`	✖	✖	✔	✖	✔	✔	✖	False
`CKA_UNWRAP_TEMPLATE`	✔	✖	✔	✖	✔	✔	✖
`CKA_SENSITIVE`	✔	✖	✔	✖	✔	✔	✔	True
`CKA_ALWAYS_SENSITIVE`	R	✖	R	✖	R	R	R
`CKA_EXTRACTABLE`	✔	✖	✔	✖	✔	✔	✔	True
`CKA_NEVER_EXTRACTABLE`	R	✖	R	✖	R	R	R
`CKA_MODULUS`	✖	✖	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✖	✖	✖
`CKA_MODULUS_BITS`	✖	✖	✖	✖	✖	✖	✖
`CKA_PRIME_1`	✖	✖	✔	✖	✖	✖	✖
`CKA_PRIME_2`	✖	✖	✔	✖	✖	✖	✖
`CKA_COEFFICIENT`	✖	✖	✔	✖	✖	✖	✖
`CKA_EXPONENT_1`	✖	✖	✔	✖	✖	✖	✖
`CKA_EXPONENT_2`	✖	✖	✔	✖	✖	✖	✖
`CKA_PRIVATE_EXPONENT`	✖	✖	✔[2](#pkcs11-v3-f9)	✖	✖	✖	✖
`CKA_PUBLIC_EXPONENT`	✖	✖	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✖	✖	✖
`CKA_EC_PARAMS`	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✖	✖	✖	✖	✖
`CKA_EC_POINT`	✖	✔[2](#pkcs11-v3-f9)	✖	✖	✖	✖	✖
`CKA_VALUE`	✔[2](#pkcs11-v3-f9)	✖	✖	✖	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)
`CKA_VALUE_LEN`	✖	✖	✖	✖	✖	✖	✖
`CKA_CHECK_VALUE`	R	R	R	R	R	R	R

## UnwrapKey

属性	密钥类型					默认值
	EC 私有	RSA 私有	AES	DES3	普通机密
`CKA_CLASS`	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)
`CKA_KEY_TYPE`	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)
`CKA_LABEL`	✔	✔	✔	✔	✔
`CKA_ID`	✔	✔	✔	✔	✔
`CKA_LOCAL`	R	R	R	R	R	False
`CKA_TOKEN`	✔	✔	✔	✔	✔	False
`CKA_PRIVATE`	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	True
`CKA_ENCRYPT`	✖	✖	✔	✔	✖	False
`CKA_DECRYPT`	✖	✔	✔	✔	✖	False
`CKA_DERIVE`	✔	✔	✔	✔	✔	False
`CKA_MODIFIABLE`	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	True
`CKA_DESTROYABLE`	✔	✔	✔	✔	✔	True
`CKA_SIGN`	✔	✔	✔	✔	✔	False
`CKA_SIGN_RECOVER`	✖	✔[3](#pkcs11-v3-f10)	✖	✖	✖	False
`CKA_VERIFY`	✖	✖	✔	✔	✔	False
`CKA_VERIFY_RECOVER`	✖	✖	✖	✖	✖
`CKA_WRAP`	✖	✖	✔	✔	✖	False
`CKA_UNWRAP`	✖	✔	✔	✔	✖	False
`CKA_SENSITIVE`	✔	✔	✔	✔	✔	True
`CKA_EXTRACTABLE`	✔	✔	✔	✔	✔	True
`CKA_NEVER_EXTRACTABLE`	R	R	R	R	R
`CKA_ALWAYS_SENSITIVE`	R	R	R	R	R
`CKA_MODULUS`	✖	✖	✖	✖	✖
`CKA_MODULUS_BITS`	✖	✖	✖	✖	✖
`CKA_PRIME_1`	✖	✖	✖	✖	✖
`CKA_PRIME_2`	✖	✖	✖	✖	✖
`CKA_COEFFICIENT`	✖	✖	✖	✖	✖
`CKA_EXPONENT_1`	✖	✖	✖	✖	✖
`CKA_EXPONENT_2`	✖	✖	✖	✖	✖
`CKA_PRIVATE_EXPONENT`	✖	✖	✖	✖	✖
`CKA_PUBLIC_EXPONENT`	✖	✖	✖	✖	✖
`CKA_EC_PARAMS`	✖	✖	✖	✖	✖
`CKA_EC_POINT`	✖	✖	✖	✖	✖
`CKA_VALUE`	✖	✖	✖	✖	✖
`CKA_VALUE_LEN`	✖	✖	✖	✖	✖
`CKA_CHECK_VALUE`	R	R	R	R	R

## DeriveKey

属性	密钥类型			默认值
	AES	DES3	普通机密
`CKA_CLASS`	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)
`CKA_KEY_TYPE`	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)
`CKA_LABEL`	✔	✔	✔
`CKA_ID`	✔	✔	✔
`CKA_LOCAL`	R	R	R	True
`CKA_TOKEN`	✔	✔	✔	False
`CKA_PRIVATE`	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	True
`CKA_ENCRYPT`	✔	✔	✖	False
`CKA_DECRYPT`	✔	✔	✖	False
`CKA_DERIVE`	✔	✔	✔	False
`CKA_MODIFIABLE`	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	True
`CKA_DESTROYABLE`	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	True
`CKA_SIGN`	✔	✔	✔	False
`CKA_SIGN_RECOVER`	✖	✖	✖
`CKA_VERIFY`	✔	✔	✔	False
`CKA_VERIFY_RECOVER`	✖	✖	✖
`CKA_WRAP`	✔	✔	✖	False
`CKA_UNWRAP`	✔	✔	✖	False
`CKA_SENSITIVE`	✔	✔	✔	True
`CKA_EXTRACTABLE`	✔	✔	✔	True
`CKA_NEVER_EXTRACTABLE`	R	R	R
`CKA_ALWAYS_SENSITIVE`	R	R	R
`CKA_MODULUS`	✖	✖	✖
`CKA_MODULUS_BITS`	✖	✖	✖
`CKA_PRIME_1`	✖	✖	✖
`CKA_PRIME_2`	✖	✖	✖
`CKA_COEFFICIENT`	✖	✖	✖
`CKA_EXPONENT_1`	✖	✖	✖
`CKA_EXPONENT_2`	✖	✖	✖
`CKA_PRIVATE_EXPONENT`	✖	✖	✖
`CKA_PUBLIC_EXPONENT`	✖	✖	✖
`CKA_EC_PARAMS`	✖	✖	✖
`CKA_EC_POINT`	✖	✖	✖
`CKA_VALUE`	✖	✖	✖
`CKA_VALUE_LEN`	✔[2](#pkcs11-v3-f9)	✖	✔[2](#pkcs11-v3-f9)
`CKA_CHECK_VALUE`	R	R	R

## GetAttributeValue

属性	密钥类型
	EC 私有	EC 公有	RSA 私有	RSA 公有	AES	DES3	普通机密
`CKA_CLASS`	✔	✔	✔	✔	✔	✔	✔
`CKA_KEY_TYPE`	✔	✔	✔	✔	✔	✔	✔
`CKA_LABEL`	✔	✔	✔	✔	✔	✔	✔
`CKA_ID`	✔	✔	✔	✔	✔	✔	✔
`CKA_LOCAL`	✔	✔	✔	✔	✔	✔	✔
`CKA_TOKEN`	✔	✔	✔	✔	✔	✔	✔
`CKA_PRIVATE`	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)	✔[1](#pkcs11-v3-f8)
`CKA_ENCRYPT`	✖	✖	✖	✔	✔	✔	✖
`CKA_DECRYPT`	✖	✖	✔	✖	✔	✔	✖
`CKA_DERIVE`	✔	✔	✔	✔	✔	✔	✔
`CKA_MODIFIABLE`	✔	✔	✔	✔	✔	✔	✔
`CKA_DESTROYABLE`	✔	✔	✔	✔	✔	✔	✔
`CKA_SIGN`	✔	✖	✔	✖	✔	✔	✔
`CKA_SIGN_RECOVER`	✖	✖	✔	✖	✖	✖	✖
`CKA_VERIFY`	✖	✔	✖	✔	✔	✔	✔
`CKA_VERIFY_RECOVER`	✖	✖	✖	✔	✖	✖	✖
`CKA_WRAP`	✖	✖	✖	✔	✔	✔	✖
`CKA_WRAP_TEMPLATE`	✖	✔	✖	✔	✔	✔	✖
`CKA_TRUSTED`	✖	✔	✖	✔	✔	✔	✔
`CKA_WRAP_WITH_TRUSTED`	✔	✖	✔	✖	✔	✔	✔
`CKA_UNWRAP`	✖	✖	✔	✖	✔	✔	✖
`CKA_UNWRAP_TEMPLATE`	✔	✖	✔	✖	✔	✔	✖
`CKA_SENSITIVE`	✔	✖	✔	✖	✔	✔	✔
`CKA_EXTRACTABLE`	✔	✖	✔	✖	✔	✔	✔
`CKA_NEVER_EXTRACTABLE`	✔	✖	✔	✖	✔	✔	✔
`CKA_ALWAYS_SENSITIVE`	R	R;	R	R	R	R	R
`CKA_MODULUS`	✖	✖	✔	✔	✖	✖	✖
`CKA_MODULUS_BITS`	✖	✖	✖	✔	✖	✖	✖
`CKA_PRIME_1`	✖	✖	S	✖	✖	✖	✖
`CKA_PRIME_2`	✖	✖	S	✖	✖	✖	✖
`CKA_COEFFICIENT`	✖	✖	S	✖	✖	✖	✖
`CKA_EXPONENT_1`	✖	✖	S	✖	✖	✖	✖
`CKA_EXPONENT_2`	✖	✖	S	✖	✖	✖	✖
`CKA_PRIVATE_EXPONENT`	✖	✖	S	✖	✖	✖	✖
`CKA_PUBLIC_EXPONENT`	✖	✖	✔	✔	✖	✖	✖
`CKA_EC_PARAMS`	✔	✔	✖	✖	✖	✖	✖
`CKA_EC_POINT`	✖	✔	✖	✖	✖	✖	✖
`CKA_VALUE`	S	✖	✖	✖	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)	✔[2](#pkcs11-v3-f9)
`CKA_VALUE_LEN`	✖	✖	✖	✖	✔	✖	✔
`CKA_CHECK_VALUE`	✔	✔	✔	✔	✔	✔	✖

**属性注释** + [1] 此属性由固件部分支持且必须明确地仅设置为默认值。 + [2] 必需属性。 + [3] **仅客户端软件开发工具包 3**。`CKA_SIGN_RECOVER` 属性派生自 `CKA_SIGN` 属性。如果要设置它，只能将其设置为与为 `CKA_SIGN` 设置的值相同。如果不设置，它获得默认值 `CKA_SIGN`。由于 CloudHSM 仅支持基于 RSA 的可恢复签名机制，此属性目前仅适用于 RSA 公有密钥。 + [4] **仅客户端软件开发工具包 3**。`CKA_VERIFY_RECOVER` 属性派生自 `CKA_VERIFY` 属性。如果要设置它，只能将其设置为与为 `CKA_VERIFY` 设置的值相同。如果不设置，它获得默认值 `CKA_VERIFY`。由于 CloudHSM 仅支持基于 RSA 的可恢复签名机制，此属性目前仅适用于 RSA 公有密钥。