vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Only Boolean attributes can be modified. 
 C_FindObjectsInit N/A N/A Initializes an object search operation. 
 C_FindObjects N/A N/A Continues an object search operation. 
 C_FindObjectsFinal N/A N/A Finishes an object search operation. 
 C_EncryptInit* m_EncryptInit EncryptInit Initializes an encryption operation. 
 C_Encrypt* m_Encrypt Encrypt Encrypts single-part data. 
 C_EncryptUpdate* m_EncryptUpdate EncryptUpdate Continues a multiple-part encryption operation. 
 C_EncryptFinal* m_EncryptFinal EncryptFinal Finishes a multiple-part encryption operation. 
 N/A m_EncryptSingle EncryptSingle IBM extension, non-standard variant of Encrypt. Processes data in one pass, with one call. Does not return any state to host other than encrypted data. 
 N/A m_ReencryptSingle ReencryptSingle IBM extension, non-standard variant of Encrypt. Decrypts data with the original key and encrypts the raw data with a different key in a single call within the cloud HSM. Does not return any state to host other than the reencrypted data. 
 C_DecryptInit* m_DecryptInit DecryptInit Initializes a decryption operation. 
 C_Decrypt* m_Decrypt Decrypt Decrypts single-part encrypted data. 
 C_DecryptUpdate* m_DecryptUpdate DecryptUpdate Continues a multiple-part decryption operation. 
 C_DecryptFinal* m_DecryptFinal DecryptFinal Finishes a multiple-part decryption operation. 
 N/A m_DecryptSingle DecryptSingle IBM extension, non-standard variant of Decrypt. Processes data in one pass, with one call.
C_DecryptDigestUpdate N/A N/A Continues simultaneous multiple-part decryption and digesting operations. 
 C_SignEncryptUpdate N/A N/A Continues simultaneous multiple-part signature and encryption operations. 
 C_DecryptVerifyUpdate N/A N/A Continues simultaneous multiple-part decryption and verification operations. 
 C_GenerateKey* m_GenerateKey GenerateKey Generates a secret key. 
 C_GenerateKeyPair* m_GenerateKeyPair GenerateKeyPair Generates a public-key and private-key pair. 
 C_WrapKey* m_WrapKey WrapKey Wraps (encrypts) a key. 
 C_UnwrapKey* m_UnwrapKey UnwrapKey Unwraps (decrypts) a key. 
 N/A N/A RewrapKeyBlob Transfers ownership of a BLOB that is controlled by the current master key to the new master key when the new master key is committed. This function is a special administration command that is supported only by GREP11. 
 C_DeriveKey* m_DeriveKey DeriveKey Derives a key from a base key. 
 C_SeedRandom N/A N/A Adds seed material to the random number generator. 
 C_GenerateRandom* m_GenerateRandom GenerateRandom Generates random data. The length of the random data cannot be zero and the pointer that points to the random data location cannot be NULL. The maximum length of the random data that can be requested is 1 million bytes. 
 C_GetFunctionStatus N/A N/A Legacy function that always returns CKR_FUNCTION_NOT_PARALLEL. 
 C_CancelFunction N/A N/A Legacy function that always returns CKR_FUNCTION_NOT_PARALLEL. 







 Supported mechanisms 

A mechanism is referred to as a process to implement a cryptographic operation. It can vary depending on the level of firmware in the crypto card. The following table shows the mechanisms that are currently supported and how they relate to common GREP11 function categories.



Table 2. Describes the supported GREP11 mechanisms

 Function group Supported mechanisms
tke cryptounit-exit-impr Exits imprint mode in the selected crypto units. (Deprecated. Use cryptounit-thrhld-set instead.) ibmcloud tke cryptounit-exit-impr 
 tke cryptounit-mk Displays master key registers for the selected crypto units. ibmcloud tke cryptounit-mk 
 tke cryptounit-mk-clrcur Clears the current master key register. ibmcloud tke cryptounit-mk-clrcur 
 tke cryptounit-mk-clrnew Clears the new master key register. ibmcloud tke cryptounit-mk-clrnew 
 tke cryptounit-mk-commit Commits the new master key register. ibmcloud tke cryptounit-mk-commit 
 tke cryptounit-mk-load Loads the new master key register. ibmcloud tke cryptounit-mk-load 
 tke cryptounit-mk-rotate Promotes the master key in the new master key register to the current master key register after rewrapping root keys and encryption keys in the key management keystore. ibmcloud tke cryptounit-mk-rotate 
 tke cryptounit-mk-setimm Does set immediate on the master key registers. ibmcloud tke cryptounit-mk-setimm 
 tke cryptounit-rm Removes crypto units from the set of crypto units to work with. ibmcloud tke cryptounit-rm 
 tke cryptounit-thrhld-set Sets the signature thresholds for the selected crypto units. ibmcloud tke cryptounit-thrhld-set 
 tke cryptounit-thrhlds Displays signature thresholds for the selected crypto units. ibmcloud tke cryptounit-thrhlds 
 tke cryptounit-zeroize Zeroizes the selected crypto units. ibmcloud tke cryptounit-zeroize 
 tke cryptounits Displays the crypto units for the current resource group. ibmcloud tke cryptounits
C_DecryptUpdate* m_DecryptUpdate DecryptUpdate Continues a multiple-part decryption operation. 
 C_DecryptFinal* m_DecryptFinal DecryptFinal Finishes a multiple-part decryption operation. 
 N/A m_DecryptSingle DecryptSingle IBM extension, non-standard variant of Decrypt. Processes data in one pass, with one call. Does not return any state to host other than decrypted data. 
 C_DigestInit* m_DigestInit DigestInit Initializes a message-digesting operation. 
 C_Digest* m_Digest Digest Digests single-part data. The length of the input data cannot be zero and the pointer that points to the input data location cannot be NULL. 
 C_DigestUpdate* m_DigestUpdate DigestUpdate Continues a multiple-part digesting operation. The length of the input data cannot be zero and the pointer that points to the input data location cannot be NULL. 
 C_DigestKey N/A N/A Digests a key. 
 C_DigestFinal* m_DigestFinal DigestFinal Finishes a multiple-part digesting operation. 
 N/A m_DigestSingle DigestSingle IBM extension, nonstandard extension, combination of DigestInit and Digest. Digests data in one pass, with one call, without constructing an intermediate digest state, and unnecessary roundtrips 
 C_SignInit* m_SignInit SignInit Initializes a signature operation. 
 C_Sign* m_Sign Sign Signs single-part data. 
 C_SignUpdate* m_SignUpdate SignUpdate Continues a multiple-part signature operation. 
 C_SignFinal* m_SignFinal SignFinal Finishes a multiple-part signature operation. 
 C_SignRecoverInit N/A N/A Initializes a signature operation, where the data is recovered from the signature. 
 C_SignRecover N/A N/A Signs single-part data, where the data is recovered from the signature. 
 N/A m_SignSingle SignSingle IBM extension, nonstandard extension, combination of SignInit and Sign.
MP-6 - Media Sanitization 



  Control requirements 

The organization:

MP-6 (a)
:   Sanitizes [IBM Assignment: assets holding customer data] prior to disposal, release out of organizational control, or release for reuse using [IBM Assignment: customer approved sanitization process corresponding to the customer's retention schedule] in accordance with applicable federal and organizational standards and policies; and

MP-6 (b)
:   Employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.





  NIST supplemental guidance 

This control applies to all information system media, both digital and non-digital, subject to disposal or reuse, whether or not the media is considered removable. Examples include media found in scanners, copiers, printers, notebook computers, workstations, network components, and mobile devices. The sanitization process removes information from the media such that the information cannot be retrieved or reconstructed. Sanitization techniques, including clearing, purging, cryptographic erase, and destruction, prevent the disclosure of information to unauthorized individuals when such media is reused or released for disposal. Organizations determine the appropriate sanitization methods recognizing that destruction is sometimes necessary when other methods cannot be applied to media requiring sanitization. Organizations use discretion on the employment of approved sanitization techniques and procedures for media containing information deemed to be in the public domain or publicly releasable, or deemed to have no adverse impact on organizations or individuals if released for reuse or disposal. Sanitization of non-digital media includes, for example, removing a classified appendix from an otherwise unclassified document, or redacting selected sections or words from a document by obscuring the redacted sections/words in a manner equivalent in effectiveness to removing them from the document. NSA standards and policies control the sanitization process for media containing classified information.
ibmcloud tke auto-mk-rotate 
 tke auto-recover Automatically copies the current master key value from the recovery HSM to other crypto units in the same resource group. ibmcloud tke auto-recover 
 tke Manages crypto units in the IBM Cloud. ibmcloud tke 
 tke cryptounit-add Adds crypto units to the set of crypto units to work with. ibmcloud tke cryptounit-add 
 tke cryptounit-admin-add Adds a crypto unit administrator to the selected crypto units. ibmcloud tke cryptounit-admin-add 
 tke cryptounit-admin-rm Removes a crypto unit administrator from the selected crypto units. ibmcloud tke cryptounit-admin-rm 
 tke cryptounit-admins Lists administrators installed in the selected crypto units. ibmcloud tke cryptounit-admins 
 tke cryptounit-compare Compares configuration settings of the selected crypto units. ibmcloud tke cryptounit-compare 
 tke cryptounit-cp-btc Enables bitcoin (BTC) related functions in the selected crypto units. ibmcloud tke cryptounit-cp-btc 
 tke cryptounit-cp-eddsa Enables Edwards-curve digital signature algorithms (EdDSA) functions in the selected crypto units. ibmcloud tke cryptounit-cp-eddsa 
 tke cryptounit-cp-sig-other Enables non-Elliptic-curve DSA, non-Edwards-curve DSA digital signature functions in the selected crypto units. ibmcloud tke cryptounit-cp-sig-other 
 tke cryptounit-exit-impr Exits imprint mode in the selected crypto units. (Deprecated. Use cryptounit-thrhld-set instead.) ibmcloud tke cryptounit-exit-impr 
 tke cryptounit-mk Displays master key registers for the selected crypto units. ibmcloud tke cryptounit-mk 
 tke cryptounit-mk-clrcur Clears the current master key register.
Commit new master key register tke cryptounit-mk-commit Not allowed. The current signature threshold value. 
 Set immediate (finalize master key register) tke cryptounit-mk-setimm Not allowed. One signature. 
 Set control point tke cryptounit-cp-btctke cryptounit-cp-eddsatke cryptounit-cp-sig-other Not allowed. The current signature threshold value. 
 Zeroize crypto unit tke cryptounit-zeroize No signature needed. One signature. 







 Understanding the master key 

After the crypto units exit the imprint mode, you can load the master key to the crypto units. A master key is used to encrypt data in key storage. With the master key, you own the root of trust that encrypts the entire key hierarchy, including root keys and standard keys in the key management keystore and Enterprise PKCS #11 (EP11) keys in the EP11 keystore. Each service instance has only one master key.

To load the master key, each crypto unit has two master key registers: a new master key register and a current master key register. The value in the current master key register encrypts the contents of the user's key storage. The new master key register is used to change the value in the current master key register for [master key rotation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-master-key-rotation-intro).

The following flow chart illustrates how the master key register state changes, and how the master key is loaded.

Zoom

![Loading master keys](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/master-key-register.svg)

Figure 3. Loading master key

In the chart, each crypto unit loads the master key with the following steps:



1. Load the new master key register with the master key.
[Introducing cloud HSM - Standard Plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-introduce-cloud-hsmintroduce-cloud-hsm)



* [What is cloud HSM?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-introduce-cloud-hsmwhat-is-cloud-hsm)
* [Performing cryptographic operations by accessing the cloud HSM](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-introduce-cloud-hsmcryptography-cloud-hsm)



[Introducing PKCS #11 - Standard Plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-intropkcs11-intro)



[PKCS #11 implementation components](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-intropkcs11-components)
* [Post-quantum cryptography support](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-introgrep11-support-post-quantum)



[Introducing EP11 over gRPC - Standard Plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grep11-introgrep11-intro)



* [Post-quantum cryptography support](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grep11-introgrep11-support-post-quantum)







 About key rotation - Standard Plan 

[Master key rotation - Standard Plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-master-key-rotation-intromaster-key-rotation-intro)
Digest CKM_SHA_1, CKM_SHA224, CKM_SHA256, CKM_SHA384, CKM_SHA512, CKM_SHA512_224, CKM_SHA512_256 
 Generate key or generate key pair CKM_RSA_PKCS_KEY_PAIR_GEN, CKM_RSA_X9_31_KEY_PAIR_GEN, CKM_DSA_KEY_PAIR_GEN, CKM_DSA_PARAMETER_GEN, CKM_EC_KEY_PAIR_GEN (CKM_ECDSA_KEY_PAIR_GEN), CKM_DH_PKCS_KEY_PAIR_GEN, CKM_DH_PKCS_PARAMETER_GEN, CKM_GENERIC_SECRET_KEY_GEN, CKM_AES_KEY_GEN, CKM_DES2_KEY_GEN, CKM_DES3_KEY_GEN, CKM_IBM_DILITHIUM 
 Wrap and unwrap CKM_RSA_PKCS, CKM_RSA_PKCS_OAEP, CKM_AES_ECB, CKM_AES_CBC, CKM_AES_CBC_PAD, CKM_DES3_ECB, CKM_DES3_CBC, CKM_DES3_CBC_PAD 
 Derive CKM_ECDH1_DERIVE, CKM_DH_PKCS_DERIVE, CKM_DES3_ECB_ENCRYPT_DATA, CKM_SHA1_KEY_DERIVATION, CKM_SHA224_KEY_DERIVATION, CKM_SHA256_KEY_DERIVATION, CKM_SHA384_KEY_DERIVATION, CKM_SHA512_KEY_DERIVATION 



1: This mechanism supports only single-part operations that are not able to utilize any of the Update GREP11 functions, such as EncryptUpdate, DecryptUpdate, and DigestUpdate.

2: This mechanism is only available for GREP11 SignSingle and VerifySingle operations.

3: This mechanism is not supported by the IBM 4768 crypto card and is not available for SignUpdate and VerifyUpdate operations.
crn: "crn:v1:bluemix:public:hs-crypto:us-south:a/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx:key:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
type: "private"
seed:"seed1"
kmsTimeout: 10
signingKey: "xxxxxxxxx"

workload: 
volumes:
test:
mount: "/mnt/data"
seed: "seed2"
filesystem: "ext4"
Show more



To avoid misuse of the KMS details by an attacker, it's strongly recommended for the deployer (who provides the env section) to encrypt and sign the contract. For more information about encryption, see [Contract encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_encrypt). For the signature, add a public signing key (signingKey field) to your env section and sign the entire contract by adding a envWorkloadSignature section to the contract. The purpose of the signature is to ensure that the workload and env sections are always used together and are not tampered with by a third party. For more information, see [Contract signature](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_sign).



* kms

In the kms field, always put the KMS configuration that you want to use as the first entry. The entries that follow are older KMS configurations (used to decrypt the wrapped seed before you migrate to the current configuration). A maximum of five entries are supported.
For more information, see [keysvrmgr Command](https://www.ibm.com/docs/en/aix/7.3?topic=k-keysvrmgr-command).

The hdcryptmgr command helps to manage the cryptographic management of logical volumes (LV) and physical volumes (PV). For more information, see [hdcryptmgr Command](https://www.ibm.com/docs/en/aix/7.3?topic=h-hdcryptmgr-command).





 Using Hyper Protect Crypto Services (HPCS) or Key Protect for Linux 

You can use Power Systems Virtual Server to integrate with HPCS or Key Protect to protect Linux Unified Key Setup (LUKS) encryption keys from being compromised. Either key management service can act as the single point of control to enable or disable access to data across the enterprise. This is done by successively wrapping encryption keys, with the ultimate control being a master key that resides in a hardware security module (HSM).

For more information, see [Protect LUKS encryption keys with IBM Cloud Hyper Protect Crypto Services and Key Protect](https://developer.ibm.com/tutorials/protect-luks-encryption-keys-with-ibm-cloud-hyper-protect-crypto-services/).





 Additional support for configuring Hyper Protect Crypto Services or Key Protect 

For any additional information and assistance on HPCS or Key Protect for AIX or Linux, [contact IBM](mailto:zaas.client.acceleration@ibm.com).
Optional: [Rotate the root key](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managing&interface=ui) periodically per your company's security compliance guidelines. For more information, see the [Managing encryption topic in the VPC documentation](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managing).

Do not delete your KMS instance. You can't change the KMS instance that is used to encrypt the worker pool. If you disable or delete the root key, your worker nodes enter a critical state until you restore the root key and [reboot](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_worker_reboot) the worker nodes.



The encryption for the disks of the worker nodes in your worker pool are now managed by the root key in your KMS provider. If you created a cluster, the worker pool is the default worker pool.
Encrypt and decrypt. CKM_RSA_PKCS^1^, CKM_RSA_PKCS_OAEP^1^, CKM_AES_ECB, CKM_AES_CBC, CKM_AES_CBC_PAD, CKM_DES3_ECB, CKM_DES3_CBC, CKM_DES3_CBC_PAD 
 Sign and verify. CKM_RSA_PKCS^1^, CKM_RSA_PKCS_PSS^1^, CKM_RSA_X9_31^1^, CKM_SHA1_RSA_PKCS, CKM_SHA256_RSA_PKCS, CKM_SHA224_RSA_PKCS, CKM_SHA384_RSA_PKCS, CKM_SHA512_RSA_PKCS, CKM_SHA1_RSA_PKCS_PSS, CKM_SHA224_RSA_PKCS_PSS, CKM_SHA256_RSA_PKCS_PSS, CKM_SHA384_RSA_PKCS_PSS, CKM_SHA512_RSA_PKCS_PSS, CKM_SHA1_RSA_X9_31, CKM_DSA^1^, CKM_DSA_SHA1, CKM_ECDSA^1^, CKM_ECDSA_SHA1, CKM_ECDSA_SHA224, CKM_ECDSA_SHA256, CKM_ECDSA_SHA384, CKM_ECDSA_SHA512, CKM_SHA1_HMAC, CKM_SHA256_HMAC, CKM_SHA384_HMAC, CKM_SHA512_HMAC, CKM_SHA512_224_HMAC, CKM_SHA512_256_HMAC, CKM_IBM_ED25519_SHA512, CKM_IBM_DILITHIUM^2^ 
 Digest.
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-internal-keystoresdelete-internal-keystores-next)



[Disconnecting from external keystores](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disconnect-external-keystoresdisconnect-external-keystores)



* [Disconnecting from external keystores with the IBM Cloud console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disconnect-external-keystoresdisconnect-external-keystores-ui)
* [Disconnecting from external keystores with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disconnect-external-keystoresdisconnect-external-keystores-api)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disconnect-external-keystoresdisconnect-external-keystores-next)









 Managing master keys 

[Rotating master keys by using smart cards and the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-master-key-smart-cardsrotate-master-key-smart-cards)



* [Before you begin](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-master-key-smart-cardsrotate-master-key-smart-cards-prerequisites)
* [Rotating master keys using smart cards and the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-master-key-smart-cardsrotate-master-key-smart-cards-steps)
DecryptSingleResponse, err := cryptoClient.DecryptSingle(context.Background(), DecryptSingleRequest)
Show more
* JavaScript code snippet

client.DecryptSingle({
Mech: {
Mechanism: ep11.CKM_AES_CBC_PAD,
ParameterB: iv
},
Key: bobDerived.NewKey,
Ciphered: ciphertext
}, (err, response) => {
callback(err, response);
});









 Signing and verifying data 

GREP11 provides a set of functions to sign data and verify signatures or message authentication codes (MACs). You might need to call a series of subfunctions to perform a signing operation. For example, the multi-part data signature operation consists of the SignInit, SignUpdate, and SignFinal suboperations.



 SignInit 

The SignInit function initializes a signature operation. You need to call this function first to perform a signature operation.

Enterprise PKCS #11 over gRPC

Enterprise PKCS #11

PKCS #11





 Description Binds to EP11 m_SignInit , which is an implementation of PKCS #11 C_SignInit. 
 Parameters message SignInitRequest { Mechanism Mech = 2; bytes PrivKey = 3; } message SignInitResponse { bytes State = 1; } 
 Return values Wraps EP11 error into message Grep11Error. 



Code snippets



* Golang code snippet

SignInitRequest := &pb.SignInitRequest {
Mech: &pb.Mechanism{Mechanism: ep11.CKM_SHA1_RSA_PKCS},
PrivKey: GenerateKeyPairResponse.PrivKeyBytes,
}

SignInitResponse, err := cryptoClient.SignInit(context.Background(), SignInitRequest)
* JavaScript code snippet

client.SignInit({
Mech: {
Shrink IBM Cloud Endurance NFS storage For more information about shrinking capacity in an IBM Cloud Endurance NFS share, see [Expanding block storage capacity](https://cloud.ibm.com/docs/BlockStorage?topic=BlockStorage-expandingcapacityexpandingcapacity). 
 vSAN policy best practice advice For more information, see [vSAN policy design](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-design_virtualinfrastructuredesign_virtualinfrastructure-storage-policy). 
 Enabling vSAN health check For more information, see [Enable the vSAN online health workflow](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vum-updating-vsanvum-updating-vsan-enable-vsan-workflow) and [vSAN health check information (2114803)](https://kb.vmware.com/s/article/2114803). 
 Enable encryption For more information about using the KMIP for VMware service to enable encryption, see [KMIP for VMware overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip_standalone_considerationskmip_standalone_considerations). For more information about enabling VM encryption, see [Virtual machine encryption](https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-E6C5CE29-CD1D-4555-859C-A0492E7CB45D.html).
[Dual-purpose cryptographic functions](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959748) C_DecryptDigestUpdate No Continues simultaneous multiple-part decryption and digesting operations. 
 [Dual-purpose cryptographic functions](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959748) C_SignEncryptUpdate No Continues simultaneous multiple-part signature and encryption operations. 
 [Dual-purpose cryptographic functions](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959748) C_DecryptVerifyUpdate No Continues simultaneous multiple-part decryption and verification operations. 
 [Key management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959749) C_GenerateKey Yes Generates a secret key. 
 [Key management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959749) C_GenerateKeyPair Yes Generates a public or private key pair. 
 [Key management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959749) C_WrapKey Yes Wraps (encrypts) a key.