Initial sshsm project structure

Issue-ID: AAF-94
Change-Id: I5e82fff418e7567b161acf9b98013a9b85ffc5b4
Signed-off-by: NingSun <ning.sun@intel.com>

1 files changed, 2514 insertions, 0 deletions

diff --git a/SoftHSMv2/src/lib/P11Attributes.cpp b/SoftHSMv2/src/lib/P11Attributes.cpp
new file mode 100644
index 0000000..28d0f9b
--- /dev/null
+++ b/SoftHSMv2/src/lib/P11Attributes.cpp
@@ -0,0 +1,2514 @@
+/*
+ * Copyright (c) 2011 .SE (The Internet Infrastructure Foundation)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
+ * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+ * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*****************************************************************************
+ P11Attributes.h
+
+ This file contains classes for controlling attributes
+ *****************************************************************************/
+
+#include "config.h"
+#include "P11Attributes.h"
+#include "ByteString.h"
+#include "CryptoFactory.h"
+#include "DESKey.h"
+#include "AESKey.h"
+#include <stdio.h>
+#include <stdlib.h>
+
+// Constructor
+P11Attribute::P11Attribute(OSObject* inobject)
+{
+	osobject = inobject;
+	type = CKA_VENDOR_DEFINED;
+	size = (CK_ULONG)-1;
+	checks = 0;
+}
+
+// Destructor
+P11Attribute::~P11Attribute()
+{
+}
+
+CK_RV P11Attribute::updateAttr(Token *token, bool isPrivate, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	ByteString value;
+	if (isPrivate)
+	{
+		if (!token->encrypt(ByteString((unsigned char*)pValue, ulValueLen),value))
+			return CKR_GENERAL_ERROR;
+	}
+	else
+		value = ByteString((unsigned char*)pValue, ulValueLen);
+	if (value.size() < ulValueLen)
+		return CKR_GENERAL_ERROR;
+	osobject->setAttribute(type, value);
+	return CKR_OK;
+}
+
+bool P11Attribute::isModifiable()
+{
+	// Get the CKA_MODIFIABLE attribute, when the attribute is
+	// not present return the default value which is CK_TRUE.
+	if (!osobject->attributeExists(CKA_MODIFIABLE)) return true;
+
+	return osobject->getBooleanValue(CKA_MODIFIABLE, true);
+}
+
+bool P11Attribute::isSensitive()
+{
+	// Get the CKA_SENSITIVE attribute, when the attribute is not present
+	// assume the object is not sensitive.
+	if (!osobject->attributeExists(CKA_SENSITIVE)) return false;
+
+	return osobject->getBooleanValue(CKA_SENSITIVE, false);
+}
+
+bool P11Attribute::isExtractable()
+{
+	// Get the CKA_EXTRACTABLE attribute, when the attribute is
+	// not present assume the object allows extraction.
+	if (!osobject->attributeExists(CKA_EXTRACTABLE)) return true;
+
+	return osobject->getBooleanValue(CKA_EXTRACTABLE, true);
+}
+
+bool P11Attribute::isTrusted()
+{
+	// Get the CKA_TRUSTED attribute, when the attribute is
+	// not present assume the object is not trusted.
+	if (!osobject->attributeExists(CKA_TRUSTED)) return false;
+
+	return osobject->getBooleanValue(CKA_TRUSTED, false);
+}
+
+// Initialize the attribute
+bool P11Attribute::init()
+{
+	if (osobject == NULL) return false;
+
+	// Create a default value if the attribute does not exist
+	if (osobject->attributeExists(type) == false)
+	{
+		return setDefault();
+	}
+
+	return true;
+}
+
+// Return the attribute type
+CK_ATTRIBUTE_TYPE P11Attribute::getType()
+{
+	return type;
+}
+
+// Return the attribute checks
+CK_ATTRIBUTE_TYPE P11Attribute::getChecks()
+{
+	return checks;
+}
+
+// Retrieve a template map
+static CK_RV retrieveAttributeMap(CK_ATTRIBUTE_PTR pTemplate, const std::map<CK_ATTRIBUTE_TYPE,OSAttribute>& map)
+{
+	size_t nullcnt = 0;
+
+	for (size_t i = 0; i < map.size(); ++i)
+	{
+		if (pTemplate[i].pValue == NULL_PTR)
+			++nullcnt;
+	}
+
+	// Caller wants type & size
+	if (nullcnt == map.size())
+	{
+		std::map<CK_ATTRIBUTE_TYPE,OSAttribute>::const_iterator a = map.begin();
+		for (size_t i = 0; i < map.size(); ++i, ++a)
+		{
+			pTemplate[i].type = a->first;
+			const OSAttribute& attr = a->second;
+			if (attr.isBooleanAttribute())
+			{
+				pTemplate[i].ulValueLen = sizeof(CK_BBOOL);
+			}
+			else if (attr.isUnsignedLongAttribute())
+			{
+				pTemplate[i].ulValueLen = sizeof(CK_ULONG);
+			}
+			else if (attr.isByteStringAttribute())
+			{
+				pTemplate[i].ulValueLen = attr.getByteStringValue().size();
+			}
+			else
+			{
+				// Impossible
+				ERROR_MSG("Internal error: bad attribute in attribute map");
+
+				return CKR_GENERAL_ERROR;
+			}
+		}
+
+		return CKR_OK;
+	}
+
+	// Callers wants to get values
+	for (size_t i = 0; i < map.size(); ++i)
+	{
+		std::map<CK_ATTRIBUTE_TYPE,OSAttribute>::const_iterator a = map.find(pTemplate[i].type);
+		if (a == map.end())
+		{
+			pTemplate[i].ulValueLen = CK_UNAVAILABLE_INFORMATION;
+			return CKR_ATTRIBUTE_TYPE_INVALID;
+		}
+		const OSAttribute& attr = a->second;
+		if (attr.isBooleanAttribute())
+		{
+			if (pTemplate[i].ulValueLen < sizeof(CK_BBOOL))
+			{
+				pTemplate[i].ulValueLen = CK_UNAVAILABLE_INFORMATION;
+				return CKR_BUFFER_TOO_SMALL;
+			}
+			pTemplate[i].ulValueLen = sizeof(CK_BBOOL);
+			*(CK_BBOOL*)pTemplate[i].pValue = attr.getBooleanValue() ? CK_TRUE : CK_FALSE;
+		}
+		else if (attr.isUnsignedLongAttribute())
+		{
+			if (pTemplate[i].ulValueLen < sizeof(CK_ULONG))
+			{
+				pTemplate[i].ulValueLen= CK_UNAVAILABLE_INFORMATION;
+				return CKR_BUFFER_TOO_SMALL;
+			}
+			pTemplate[i].ulValueLen = sizeof(CK_ULONG);
+			*(CK_ULONG_PTR)pTemplate[i].pValue= attr.getUnsignedLongValue();
+		}
+		else if (attr.isByteStringAttribute())
+		{
+			ByteString value = attr.getByteStringValue();
+			if (pTemplate[i].ulValueLen < value.size())
+			{
+				pTemplate[i].ulValueLen= CK_UNAVAILABLE_INFORMATION;
+				return CKR_BUFFER_TOO_SMALL;
+			}
+			pTemplate[i].ulValueLen = value.size();
+			memcpy(pTemplate[i].pValue, value.const_byte_str(), value.size());
+		}
+		else
+		{
+			// Impossible
+			ERROR_MSG("Internal error: bad attribute in attribute map");
+
+			return CKR_GENERAL_ERROR;
+		}
+	}
+
+	return CKR_OK;
+}
+
+// Retrieve the value if allowed
+CK_RV P11Attribute::retrieve(Token *token, bool isPrivate, CK_VOID_PTR pValue, CK_ULONG_PTR pulValueLen)
+{
+
+	if (osobject == NULL) {
+		ERROR_MSG("Internal error: osobject field contains NULL_PTR");
+		return CKR_GENERAL_ERROR;
+	}
+
+	if (pulValueLen == NULL) {
+		ERROR_MSG("Internal error: pulValueLen contains NULL_PTR");
+		return CKR_GENERAL_ERROR;
+	}
+
+	// [PKCS#11 v2.40, C_GetAttributeValue]
+	// 1. If the specified attribute (i.e., the attribute specified by the
+	//    type field) for the object cannot be revealed because the object
+	//    is sensitive or unextractable, then the ulValueLen field in that
+	//    triple is modified to hold the value CK_UNAVAILABLE_INFORMATION.
+	//
+	// [PKCS#11 v2.40, 4.2 Common attributes, table 10]
+	//  7  Cannot be revealed if object has its CKA_SENSITIVE attribute
+	//     set to CK_TRUE or its CKA_EXTRACTABLE attribute set to CK_FALSE.
+	if ((checks & ck7) == ck7 && (isSensitive() || !isExtractable())) {
+		*pulValueLen = CK_UNAVAILABLE_INFORMATION;
+		return CKR_ATTRIBUTE_SENSITIVE;
+	}
+
+	// Retrieve the lower level attribute.
+	if (!osobject->attributeExists(type)) {
+		// Should be impossible.
+		ERROR_MSG("Internal error: attribute not present");
+		return CKR_GENERAL_ERROR;
+	}
+	OSAttribute attr = osobject->getAttribute(type);
+
+	// Get the actual attribute size.
+	CK_ULONG attrSize = size;
+	if (size == (CK_ULONG)-1)
+	{
+		// We don't have a fixed size attribute so we need to consult
+		// the lower level attribute for the exact size.
+
+		// Lower level attribute has to be variable sized.
+		if (attr.isByteStringAttribute())
+		{
+			if (isPrivate && attr.getByteStringValue().size() != 0)
+			{
+				ByteString value;
+				if (!token->decrypt(attr.getByteStringValue(),value))
+				{
+					ERROR_MSG("Internal error: failed to decrypt private attribute value");
+					return CKR_GENERAL_ERROR;
+				}
+				attrSize = value.size();
+			}
+			else
+				attrSize = attr.getByteStringValue().size();
+		}
+		else if (attr.isMechanismTypeSetAttribute())
+		{
+			attrSize = attr.getMechanismTypeSetValue().size() * sizeof(CK_MECHANISM_TYPE);
+		}
+		else if (attr.isAttributeMapAttribute())
+		{
+			attrSize = attr.getAttributeMapValue().size() * sizeof(CK_ATTRIBUTE);
+		}
+		else
+		{
+			// Should be impossible.
+			ERROR_MSG("Internal error: attribute has fixed size");
+			return CKR_GENERAL_ERROR;
+		}
+	}
+
+	// [PKCS#11 v2.40, C_GetAttributeValue]
+	// 3. Otherwise, if the pValue field has the value NULL_PTR, then the
+	//    ulValueLen field is modified to hold the exact length of the
+	//    specified attribute for the object.
+	if (pValue == NULL_PTR) {
+		// Return the size of the attribute.
+		*pulValueLen = attrSize;
+		return CKR_OK;
+	}
+
+	// [PKCS#11 v2.40, C_GetAttributeValue]
+	// 4. Otherwise, if the length specified in ulValueLen is large enough
+	//    to hold the value of the specified attribute for the object, then
+	//    that attribute is copied into the buffer located at pValue, and
+	//    the ulValueLen field is modified to hold the exact length of the
+	//    attribute.
+	if (*pulValueLen >= attrSize)
+	{
+		// Only copy when there is actually something to copy
+		CK_RV rv = CKR_OK;
+
+		if (attr.isUnsignedLongAttribute()) {
+			*(CK_ULONG_PTR)pValue = attr.getUnsignedLongValue();
+		}
+		else if (attr.isBooleanAttribute())
+		{
+			*(CK_BBOOL*)pValue = attr.getBooleanValue() ? CK_TRUE : CK_FALSE;
+		}
+		else if (attr.isByteStringAttribute())
+		{
+			if (isPrivate && attr.getByteStringValue().size() != 0)
+			{
+				ByteString value;
+				if (!token->decrypt(attr.getByteStringValue(),value))
+				{
+					ERROR_MSG("Internal error: failed to decrypt private attribute value");
+					return CKR_GENERAL_ERROR;
+				}
+				const unsigned char* attrPtr = value.const_byte_str();
+				memcpy(pValue,attrPtr,attrSize);
+			}
+			else if (attr.getByteStringValue().size() != 0)
+			{
+				const unsigned char* attrPtr = attr.getByteStringValue().const_byte_str();
+				memcpy(pValue,attrPtr,attrSize);
+			}
+		}
+		else if (attr.isMechanismTypeSetAttribute())
+		{
+			CK_MECHANISM_TYPE_PTR pTemplate = (CK_MECHANISM_TYPE_PTR) pValue;
+			size_t i = 0;
+
+			std::set<CK_MECHANISM_TYPE> set = attr.getMechanismTypeSetValue();
+			for (std::set<CK_MECHANISM_TYPE>::const_iterator it = set.begin(); it != set.end(); ++it)
+				pTemplate[++i] = *it;
+		}
+		else
+		{
+			// attr is already retrieved and verified to be an Attribute Map
+			rv = retrieveAttributeMap((CK_ATTRIBUTE_PTR)pValue, attr.getAttributeMapValue());
+		}
+		*pulValueLen = attrSize;
+		return rv;
+	}
+
+	// [PKCS#11 v2.40, C_GetAttributeValue]
+	// 5. Otherwise, the ulValueLen field is modified to hold the value CK_UNAVAILABLE_INFORMATION.
+	*pulValueLen = CK_UNAVAILABLE_INFORMATION;
+	return CKR_BUFFER_TOO_SMALL;
+}
+
+// Update the value if allowed
+CK_RV P11Attribute::update(Token* token, bool isPrivate, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int op)
+{
+	if (osobject == NULL) {
+		ERROR_MSG("Internal error: osobject field contains NULL_PTR");
+		return CKR_GENERAL_ERROR;
+	}
+
+	// [PKCS#11 v2.40, 4.1.1 Creating objects]
+	//    2. If the supplied template specifies an invalid value for a valid attribute, then the
+	//    attempt should fail with the error code CKR_ATTRIBUTE_VALUE_INVALID.
+	//    The valid values for Cryptoki attributes are described in the Cryptoki specification.
+
+	// Check for null pointers in values.
+	if (pValue == NULL_PTR && ulValueLen != 0) {
+		ERROR_MSG("The attribute is a NULL_PTR but has a non-zero length")
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// For fixed sized attributes check that the size matches.
+	if (size != ((CK_ULONG)-1) && size != ulValueLen) {
+		ERROR_MSG("The attribute size is different from the expected size")
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// [PKCS#11 v2.40, 4.1.1 Creating objects] OBJECT_OP_CREATE | OBJECT_OP_SET | OBJECT_OP_COPY
+	//    3. If the supplied template specifies a value for a read-only attribute, then the attempt
+	//    should fail with the error code CKR_ATTRIBUTE_READ_ONLY.
+	//    Whether or not a given Cryptoki attribute is read-only is explicitly stated in the Cryptoki
+	//    specification; however, a particular library and token may be even more restrictive than
+	//    Cryptoki specifies. In other words, an attribute which Cryptoki says is not read-only may
+	//    nonetheless be read-only under certain circumstances (i.e., in conjunction with some
+	//    combinations of other attributes) for a particular library and token. Whether or not a
+	//    given non-Cryptoki attribute is read-only is obviously outside the scope of Cryptoki.
+
+	// Attributes cannot be changed if CKA_MODIFIABLE is set to false
+	if (!isModifiable() && op != OBJECT_OP_GENERATE && op != OBJECT_OP_CREATE) {
+		ERROR_MSG("An object is with CKA_MODIFIABLE set to false is not modifiable");
+		return CKR_ATTRIBUTE_READ_ONLY;
+	}
+
+	// Attributes cannot be modified if CKA_TRUSTED is true on a certificate object.
+	if (isTrusted() && op != OBJECT_OP_GENERATE && op != OBJECT_OP_CREATE) {
+		if (osobject->getUnsignedLongValue(CKA_CLASS, CKO_VENDOR_DEFINED) == CKO_CERTIFICATE)
+		{
+			ERROR_MSG("A trusted certificate cannot be modified");
+			return CKR_ATTRIBUTE_READ_ONLY;
+		}
+	}
+
+	//  ck2  MUST not be specified when object is created with C_CreateObject.
+	if ((checks & ck2) == ck2)
+	{
+		if (OBJECT_OP_CREATE==op)
+		{
+			ERROR_MSG("Prohibited attribute was passed to object creation function");
+			return CKR_ATTRIBUTE_READ_ONLY;
+		}
+	}
+
+	//  ck4  MUST not be specified when object is generated with C_GenerateKey or C_GenerateKeyPair.
+	if ((checks & ck4) == ck4)
+	{
+		if (OBJECT_OP_GENERATE==op)
+		{
+			ERROR_MSG("Prohibited attribute was passed to key generation function");
+			return CKR_ATTRIBUTE_READ_ONLY;
+		}
+	}
+
+	//  ck6  MUST not be specified when object is unwrapped with C_UnwrapKey.
+	if ((checks & ck6) == ck6)
+	{
+		if (OBJECT_OP_UNWRAP==op)
+		{
+			ERROR_MSG("Prohibited attribute was passed to key unwrapping function");
+			return CKR_ATTRIBUTE_READ_ONLY;
+		}
+	}
+
+	//  ck8  May be modified after object is created with a C_SetAttributeValue call
+	//       or in the process of copying an object with a C_CopyObject call.
+	//       However, it is possible that a particular token may not permit modification of
+	//       the attribute during the course of a C_CopyObject call.
+	if ((checks & ck8) == ck8)
+	{
+		if (OBJECT_OP_SET==op || OBJECT_OP_COPY==op)
+		{
+			return updateAttr(token, isPrivate, pValue, ulValueLen, op);
+		}
+	}
+
+	// ck17  Can be changed in the process of copying the object using C_CopyObject.
+	if ((checks & ck17) == ck17)
+	{
+		if (OBJECT_OP_COPY==op)
+		{
+			return updateAttr(token, isPrivate, pValue, ulValueLen, op);
+		}
+	}
+
+	// For attributes that have not been explicitly excluded from modification
+	// during create/derive/generate/unwrap, we allow them to be modified.
+	if (OBJECT_OP_CREATE==op || OBJECT_OP_DERIVE==op || OBJECT_OP_GENERATE==op || OBJECT_OP_UNWRAP==op)
+	{
+		return updateAttr(token, isPrivate, pValue, ulValueLen, op);
+	}
+
+	return CKR_ATTRIBUTE_READ_ONLY;
+}
+
+/*****************************************
+ * CKA_CLASS
+ *****************************************/
+
+// Set default value
+bool P11AttrClass::setDefault()
+{
+	OSAttribute attrClass((unsigned long)CKO_VENDOR_DEFINED);
+	return osobject->setAttribute(type, attrClass);
+}
+
+// Update the value if allowed
+CK_RV P11AttrClass::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_ULONG))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	if (osobject->getUnsignedLongValue(CKA_CLASS, CKO_VENDOR_DEFINED) != *(CK_ULONG*)pValue)
+	{
+		return CKR_TEMPLATE_INCONSISTENT;
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_KEY_TYPE
+ *****************************************/
+
+// Set default value
+bool P11AttrKeyType::setDefault()
+{
+	OSAttribute attr((unsigned long)CKK_VENDOR_DEFINED);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrKeyType::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_ULONG))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	if (osobject->getUnsignedLongValue(CKA_KEY_TYPE, CKK_VENDOR_DEFINED) != *(CK_ULONG*)pValue)
+	{
+		return CKR_TEMPLATE_INCONSISTENT;
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_CERTIFICATE_TYPE
+ * footnote 1
+ *  1  MUST be specified when object is created with C_CreateObject.
+ *****************************************/
+
+// Set default value
+bool P11AttrCertificateType::setDefault()
+{
+	OSAttribute attr((unsigned long)CKC_VENDOR_DEFINED);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrCertificateType::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_ULONG))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	if (osobject->getUnsignedLongValue(CKA_CERTIFICATE_TYPE, CKC_VENDOR_DEFINED) != *(CK_ULONG*)pValue)
+	{
+		return CKR_TEMPLATE_INCONSISTENT;
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_TOKEN
+ *****************************************/
+
+// Set default value
+bool P11AttrToken::setDefault()
+{
+	OSAttribute attr(false);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrToken::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	OSAttribute attrTrue(true);
+	OSAttribute attrFalse(false);
+
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_BBOOL))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	if (*(CK_BBOOL*)pValue == CK_FALSE)
+	{
+		osobject->setAttribute(type, attrFalse);
+	}
+	else
+	{
+		osobject->setAttribute(type, attrTrue);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_PRIVATE
+ *****************************************/
+
+// Set default value
+bool P11AttrPrivate::setDefault()
+{
+	OSAttribute attr(true);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrPrivate::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	OSAttribute attrTrue(true);
+	OSAttribute attrFalse(false);
+
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_BBOOL))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	if (*(CK_BBOOL*)pValue == CK_FALSE)
+	{
+		osobject->setAttribute(type, attrFalse);
+	}
+	else
+	{
+		osobject->setAttribute(type, attrTrue);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_MODIFIABLE
+ *****************************************/
+
+// Set default value
+bool P11AttrModifiable::setDefault()
+{
+	OSAttribute attr(true);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrModifiable::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	OSAttribute attrTrue(true);
+	OSAttribute attrFalse(false);
+
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_BBOOL))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	if (*(CK_BBOOL*)pValue == CK_FALSE)
+	{
+		osobject->setAttribute(type, attrFalse);
+	}
+	else
+	{
+		osobject->setAttribute(type, attrTrue);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_LABEL
+ *****************************************/
+
+// Set default value
+bool P11AttrLabel::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_COPYABLE
+ *****************************************/
+
+// Set default value
+bool P11AttrCopyable::setDefault()
+{
+	OSAttribute attr(true);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrCopyable::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	OSAttribute attrTrue(true);
+	OSAttribute attrFalse(false);
+
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_BBOOL))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	if (*(CK_BBOOL*)pValue == CK_FALSE)
+	{
+		osobject->setAttribute(type, attrFalse);
+	}
+	else
+	{
+		if (osobject->getBooleanValue(CKA_COPYABLE, true) == false)
+		{
+			return CKR_ATTRIBUTE_READ_ONLY;
+		}
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_DESTROYABLE
+ *****************************************/
+
+// Set default value
+bool P11AttrDestroyable::setDefault()
+{
+	OSAttribute attr(true);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrDestroyable::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	OSAttribute attrTrue(true);
+	OSAttribute attrFalse(false);
+
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_BBOOL))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	if (*(CK_BBOOL*)pValue == CK_FALSE)
+	{
+		osobject->setAttribute(type, attrFalse);
+	}
+	else
+	{
+		osobject->setAttribute(type, attrTrue);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_APPLICATION
+ *****************************************/
+
+// Set default value
+bool P11AttrApplication::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_OBJECT_ID
+ *****************************************/
+
+// Set default value
+bool P11AttrObjectID::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_CHECK_VALUE
+ *****************************************/
+
+// Set default value
+bool P11AttrCheckValue::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrCheckValue::updateAttr(Token *token, bool isPrivate, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	ByteString plaintext((unsigned char*)pValue, ulValueLen);
+	ByteString value;
+
+	// Encrypt
+
+	if (isPrivate)
+	{
+		if (!token->encrypt(plaintext, value))
+			return CKR_GENERAL_ERROR;
+	}
+	else
+		value = plaintext;
+
+	// Attribute specific checks
+
+	if (value.size() < ulValueLen)
+		return CKR_GENERAL_ERROR;
+
+	// Store data
+	if (ulValueLen == 0)
+	{
+		osobject->setAttribute(type, value);
+	}
+	else
+	{
+		ByteString checkValue;
+		ByteString keybits;
+		if (isPrivate)
+		{
+			if (!token->decrypt(osobject->getByteStringValue(CKA_VALUE), keybits))
+				return CKR_GENERAL_ERROR;
+		}
+		else
+		{
+			keybits = osobject->getByteStringValue(CKA_VALUE);
+		}
+
+		SymmetricKey key;
+		AESKey aes;
+		DESKey des;
+		switch (osobject->getUnsignedLongValue(CKA_KEY_TYPE, CKK_VENDOR_DEFINED))
+		{
+			case CKK_GENERIC_SECRET:
+			case CKK_MD5_HMAC:
+			case CKK_SHA_1_HMAC:
+			case CKK_SHA224_HMAC:
+			case CKK_SHA256_HMAC:
+			case CKK_SHA384_HMAC:
+			case CKK_SHA512_HMAC:
+				key.setKeyBits(keybits);
+				key.setBitLen(keybits.size() * 8);
+				checkValue = key.getKeyCheckValue();
+				break;
+			case CKK_AES:
+				aes.setKeyBits(keybits);
+				aes.setBitLen(keybits.size() * 8);
+				checkValue = aes.getKeyCheckValue();
+				break;
+			case CKK_DES:
+			case CKK_DES2:
+			case CKK_DES3:
+				des.setKeyBits(keybits);
+				des.setBitLen(keybits.size() * 7);
+				checkValue = des.getKeyCheckValue();
+				break;
+			case CKK_GOST28147:
+				// TODO: Encryption support for CKK_GOST28147
+				// We do not calculate the KCV
+				checkValue = plaintext;
+				break;
+			default:
+				return CKR_GENERAL_ERROR;
+		}
+
+		if (plaintext != checkValue)
+			return CKR_ATTRIBUTE_VALUE_INVALID;
+
+		osobject->setAttribute(type, value);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_PUBLIC_KEY_INFO
+ *****************************************/
+
+// Set default value
+bool P11AttrPublicKeyInfo::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_ID
+ *****************************************/
+
+// Set default value
+bool P11AttrID::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_VALUE
+ *****************************************/
+
+// Set default value
+bool P11AttrValue::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrValue::updateAttr(Token *token, bool isPrivate, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int op)
+{
+	ByteString plaintext((unsigned char*)pValue, ulValueLen);
+	ByteString value;
+
+	// Encrypt
+
+	if (isPrivate)
+	{
+		if (!token->encrypt(plaintext, value))
+			return CKR_GENERAL_ERROR;
+	}
+	else
+		value = plaintext;
+
+	// Attribute specific checks
+
+	if (value.size() < ulValueLen)
+		return CKR_GENERAL_ERROR;
+
+	// Store data
+
+	osobject->setAttribute(type, value);
+
+	// Set the size during C_CreateObject and C_UnwrapKey.
+
+	if (op == OBJECT_OP_CREATE || op == OBJECT_OP_UNWRAP)
+	{
+		// Set the CKA_VALUE_LEN
+		if (osobject->attributeExists(CKA_VALUE_LEN))
+		{
+			OSAttribute bytes((unsigned long)plaintext.size());
+			osobject->setAttribute(CKA_VALUE_LEN, bytes);
+		}
+
+		// Set the CKA_VALUE_BITS
+		if (osobject->attributeExists(CKA_VALUE_BITS))
+		{
+			OSAttribute bits((unsigned long)plaintext.bits());
+			osobject->setAttribute(CKA_VALUE_BITS, bits);
+		}
+	}
+
+	// Calculate the CKA_CHECK_VALUE for certificates
+	if (osobject->getUnsignedLongValue(CKA_CLASS, CKO_VENDOR_DEFINED) == CKO_CERTIFICATE)
+	{
+		HashAlgorithm* hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::SHA1);
+		if (hash == NULL) return CKR_GENERAL_ERROR;
+
+		ByteString digest;
+		if (hash->hashInit() == false ||
+		    hash->hashUpdate(plaintext) == false ||
+		    hash->hashFinal(digest) == false)
+		{
+			CryptoFactory::i()->recycleHashAlgorithm(hash);
+			return CKR_GENERAL_ERROR;
+		}
+		CryptoFactory::i()->recycleHashAlgorithm(hash);
+
+		// First three bytes of the SHA-1 hash
+		digest.resize(3);
+
+		if (isPrivate)
+		{
+			ByteString encrypted;
+			if (!token->encrypt(digest, encrypted))
+				return CKR_GENERAL_ERROR;
+			osobject->setAttribute(CKA_CHECK_VALUE, encrypted);
+		}
+		else
+			osobject->setAttribute(CKA_CHECK_VALUE, digest);
+	}
+
+	// Calculate the CKA_CHECK_VALUE for secret keys
+	if (op == OBJECT_OP_CREATE &&
+	    osobject->getUnsignedLongValue(CKA_CLASS, CKO_VENDOR_DEFINED) == CKO_SECRET_KEY)
+	{
+		SymmetricKey key;
+		AESKey aes;
+		DESKey des;
+		ByteString checkValue;
+		switch (osobject->getUnsignedLongValue(CKA_KEY_TYPE, CKK_VENDOR_DEFINED))
+		{
+			case CKK_GENERIC_SECRET:
+			case CKK_MD5_HMAC:
+			case CKK_SHA_1_HMAC:
+			case CKK_SHA224_HMAC:
+			case CKK_SHA256_HMAC:
+			case CKK_SHA384_HMAC:
+			case CKK_SHA512_HMAC:
+				key.setKeyBits(plaintext);
+				key.setBitLen(plaintext.size() * 8);
+				checkValue = key.getKeyCheckValue();
+				break;
+			case CKK_AES:
+				aes.setKeyBits(plaintext);
+				aes.setBitLen(plaintext.size() * 8);
+				checkValue = aes.getKeyCheckValue();
+				break;
+			case CKK_DES:
+			case CKK_DES2:
+			case CKK_DES3:
+				des.setKeyBits(plaintext);
+				des.setBitLen(plaintext.size() * 7);
+				checkValue = des.getKeyCheckValue();
+				break;
+			case CKK_GOST28147:
+				// TODO: Encryption support for CKK_GOST28147
+				// We do not calculate the KCV
+				break;
+			default:
+				return CKR_GENERAL_ERROR;
+		}
+
+		if (isPrivate)
+		{
+			ByteString encrypted;
+			if (!token->encrypt(checkValue, encrypted))
+				return CKR_GENERAL_ERROR;
+			osobject->setAttribute(CKA_CHECK_VALUE, encrypted);
+		}
+		else
+			osobject->setAttribute(CKA_CHECK_VALUE, checkValue);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_SUBJECT
+ *****************************************/
+
+// Set default value
+bool P11AttrSubject::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_ISSUER
+ *****************************************/
+
+// Set default value
+bool P11AttrIssuer::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_TRUSTED
+ *****************************************/
+
+// Set default value
+bool P11AttrTrusted::setDefault()
+{
+	OSAttribute attr(false);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrTrusted::updateAttr(Token *token, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	OSAttribute attrTrue(true);
+	OSAttribute attrFalse(false);
+
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_BBOOL))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	if (*(CK_BBOOL*)pValue == CK_FALSE)
+	{
+		osobject->setAttribute(type, attrFalse);
+	}
+	else
+	{
+		if (!token->isSOLoggedIn())
+		{
+			ERROR_MSG("CKA_TRUSTED can only be set to true by the SO");
+			return CKR_ATTRIBUTE_READ_ONLY;
+		}
+		osobject->setAttribute(type, attrTrue);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_CERTIFICATE_CATEGORY
+ *****************************************/
+
+// Set default value
+bool P11AttrCertificateCategory::setDefault()
+{
+	OSAttribute attr((unsigned long)0);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrCertificateCategory::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_ULONG))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+	osobject->setAttribute(type, *(CK_ULONG*)pValue);
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_START_DATE
+ *****************************************/
+
+// Set default value
+bool P11AttrStartDate::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrStartDate::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_DATE) && ulValueLen !=0)
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+	osobject->setAttribute(type, ByteString((unsigned char*)pValue, ulValueLen));
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_END_DATE
+ *****************************************/
+
+// Set default value
+bool P11AttrEndDate::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrEndDate::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_DATE) && ulValueLen !=0)
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+	osobject->setAttribute(type, ByteString((unsigned char*)pValue, ulValueLen));
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_SERIAL_NUMBER
+ *****************************************/
+
+// Set default value
+bool P11AttrSerialNumber::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_URL
+ *****************************************/
+
+// Set default value
+bool P11AttrURL::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_HASH_OF_SUBJECT_PUBLIC_KEY
+ *****************************************/
+
+// Set default value
+bool P11AttrHashOfSubjectPublicKey::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_HASH_OF_ISSUER_PUBLIC_KEY
+ *****************************************/
+
+// Set default value
+bool P11AttrHashOfIssuerPublicKey::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_JAVA_MIDP_SECURITY_DOMAIN
+ *****************************************/
+
+// Set default value
+bool P11AttrJavaMidpSecurityDomain::setDefault()
+{
+	OSAttribute attr((unsigned long)0);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrJavaMidpSecurityDomain::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_ULONG))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+	osobject->setAttribute(type, *(CK_ULONG*)pValue);
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_NAME_HASH_ALGORITHM
+ *****************************************/
+
+// Set default value
+bool P11AttrNameHashAlgorithm::setDefault()
+{
+	OSAttribute attr((unsigned long)CKM_SHA_1);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrNameHashAlgorithm::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_ULONG))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+	osobject->setAttribute(type, *(CK_ULONG*)pValue);
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_DERIVE
+ *****************************************/
+
+// Set default value
+bool P11AttrDerive::setDefault()
+{
+	OSAttribute attr(false);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrDerive::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	OSAttribute attrTrue(true);
+	OSAttribute attrFalse(false);
+
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_BBOOL))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	if (*(CK_BBOOL*)pValue == CK_FALSE)
+	{
+		osobject->setAttribute(type, attrFalse);
+	}
+	else
+	{
+		osobject->setAttribute(type, attrTrue);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_ENCRYPT
+ *****************************************/
+
+// Set default value
+bool P11AttrEncrypt::setDefault()
+{
+	OSAttribute attr(true);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrEncrypt::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	OSAttribute attrTrue(true);
+	OSAttribute attrFalse(false);
+
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_BBOOL))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	if (*(CK_BBOOL*)pValue == CK_FALSE)
+	{
+		osobject->setAttribute(type, attrFalse);
+	}
+	else
+	{
+		osobject->setAttribute(type, attrTrue);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_VERIFY
+ *****************************************/
+
+// Set default value
+bool P11AttrVerify::setDefault()
+{
+	OSAttribute attr(true);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrVerify::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	OSAttribute attrTrue(true);
+	OSAttribute attrFalse(false);
+
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_BBOOL))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	if (*(CK_BBOOL*)pValue == CK_FALSE)
+	{
+		osobject->setAttribute(type, attrFalse);
+	}
+	else
+	{
+		osobject->setAttribute(type, attrTrue);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_VERIFY_RECOVER
+ *****************************************/
+
+// Set default value
+bool P11AttrVerifyRecover::setDefault()
+{
+	OSAttribute attr(true);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrVerifyRecover::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	OSAttribute attrTrue(true);
+	OSAttribute attrFalse(false);
+
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_BBOOL))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	if (*(CK_BBOOL*)pValue == CK_FALSE)
+	{
+		osobject->setAttribute(type, attrFalse);
+	}
+	else
+	{
+		osobject->setAttribute(type, attrTrue);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_WRAP
+ *****************************************/
+
+// Set default value
+bool P11AttrWrap::setDefault()
+{
+	OSAttribute attr(true);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrWrap::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	OSAttribute attrTrue(true);
+	OSAttribute attrFalse(false);
+
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_BBOOL))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	if (*(CK_BBOOL*)pValue == CK_FALSE)
+	{
+		osobject->setAttribute(type, attrFalse);
+	}
+	else
+	{
+		osobject->setAttribute(type, attrTrue);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_DECRYPT
+ *****************************************/
+
+// Set default value
+bool P11AttrDecrypt::setDefault()
+{
+	OSAttribute attr(true);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrDecrypt::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	OSAttribute attrTrue(true);
+	OSAttribute attrFalse(false);
+
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_BBOOL))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	if (*(CK_BBOOL*)pValue == CK_FALSE)
+	{
+		osobject->setAttribute(type, attrFalse);
+	}
+	else
+	{
+		osobject->setAttribute(type, attrTrue);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_SIGN
+ *****************************************/
+
+// Set default value
+bool P11AttrSign::setDefault()
+{
+	OSAttribute attr(true);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrSign::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	OSAttribute attrTrue(true);
+	OSAttribute attrFalse(false);
+
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_BBOOL))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	if (*(CK_BBOOL*)pValue == CK_FALSE)
+	{
+		osobject->setAttribute(type, attrFalse);
+	}
+	else
+	{
+		osobject->setAttribute(type, attrTrue);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_SIGN_RECOVER
+ *****************************************/
+
+// Set default value
+bool P11AttrSignRecover::setDefault()
+{
+	OSAttribute attr(true);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrSignRecover::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	OSAttribute attrTrue(true);
+	OSAttribute attrFalse(false);
+
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_BBOOL))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	if (*(CK_BBOOL*)pValue == CK_FALSE)
+	{
+		osobject->setAttribute(type, attrFalse);
+	}
+	else
+	{
+		osobject->setAttribute(type, attrTrue);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_UNWRAP
+ *****************************************/
+
+// Set default value
+bool P11AttrUnwrap::setDefault()
+{
+	OSAttribute attr(true);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrUnwrap::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	OSAttribute attrTrue(true);
+	OSAttribute attrFalse(false);
+
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_BBOOL))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	if (*(CK_BBOOL*)pValue == CK_FALSE)
+	{
+		osobject->setAttribute(type, attrFalse);
+	}
+	else
+	{
+		osobject->setAttribute(type, attrTrue);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_LOCAL
+ *****************************************/
+
+// Set default value
+bool P11AttrLocal::setDefault()
+{
+	OSAttribute attr(false);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrLocal::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR /*pValue*/, CK_ULONG /*ulValueLen*/, int /*op*/)
+{
+	return CKR_ATTRIBUTE_READ_ONLY;
+}
+
+/*****************************************
+ * CKA_KEY_GEN_MECHANISM
+ *****************************************/
+
+// Set default value
+bool P11AttrKeyGenMechanism::setDefault()
+{
+	OSAttribute attr((unsigned long)CK_UNAVAILABLE_INFORMATION);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrKeyGenMechanism::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR /*pValue*/, CK_ULONG /*ulValueLen*/, int /*op*/)
+{
+	return CKR_ATTRIBUTE_READ_ONLY;
+}
+
+/*****************************************
+ * CKA_ALWAYS_SENSITIVE
+ *****************************************/
+
+// Set default value
+bool P11AttrAlwaysSensitive::setDefault()
+{
+	OSAttribute attr(false);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrAlwaysSensitive::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR /*pValue*/, CK_ULONG /*ulValueLen*/, int /*op*/)
+{
+	return CKR_ATTRIBUTE_READ_ONLY;
+}
+
+/*****************************************
+ * CKA_NEVER_EXTRACTABLE
+ *****************************************/
+
+// Set default value
+bool P11AttrNeverExtractable::setDefault()
+{
+	OSAttribute attr(true);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrNeverExtractable::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR /*pValue*/, CK_ULONG /*ulValueLen*/, int /*op*/)
+{
+	return CKR_ATTRIBUTE_READ_ONLY;
+}
+
+/*****************************************
+ * CKA_SENSITIVE
+ *****************************************/
+
+// Set default value
+bool P11AttrSensitive::setDefault()
+{
+	// We default to false because we want to handle the secret keys in a correct way
+	OSAttribute attr(false);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrSensitive::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int op)
+{
+	OSAttribute attrTrue(true);
+	OSAttribute attrFalse(false);
+
+	// Attribute specific checks
+
+	if (op == OBJECT_OP_SET || op == OBJECT_OP_COPY)
+	{
+		if (osobject->getBooleanValue(CKA_SENSITIVE, false))
+		{
+			return CKR_ATTRIBUTE_READ_ONLY;
+		}
+	}
+
+	if (ulValueLen !=sizeof(CK_BBOOL))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	if (*(CK_BBOOL*)pValue == CK_FALSE)
+	{
+		osobject->setAttribute(type, attrFalse);
+		osobject->setAttribute(CKA_ALWAYS_SENSITIVE, attrFalse);
+	}
+	else
+	{
+		osobject->setAttribute(type, attrTrue);
+
+		// This is so that generated keys get the correct value
+		if (op == OBJECT_OP_GENERATE || op == OBJECT_OP_DERIVE)
+		{
+			osobject->setAttribute(CKA_ALWAYS_SENSITIVE, attrTrue);
+		}
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_EXTRACTABLE
+ *****************************************/
+
+// Set default value
+bool P11AttrExtractable::setDefault()
+{
+	OSAttribute attr(false);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrExtractable::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int op)
+{
+	OSAttribute attrTrue(true);
+	OSAttribute attrFalse(false);
+
+	// Attribute specific checks
+
+	if (op == OBJECT_OP_SET || op == OBJECT_OP_COPY)
+	{
+		if (osobject->getBooleanValue(CKA_EXTRACTABLE, false) == false)
+		{
+			return CKR_ATTRIBUTE_READ_ONLY;
+		}
+	}
+
+	if (ulValueLen !=sizeof(CK_BBOOL))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	if (*(CK_BBOOL*)pValue == CK_FALSE)
+	{
+		osobject->setAttribute(type, attrFalse);
+	}
+	else
+	{
+		osobject->setAttribute(type, attrTrue);
+		osobject->setAttribute(CKA_NEVER_EXTRACTABLE, attrFalse);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_WRAP_WITH_TRUSTED
+ *****************************************/
+
+// Set default value
+bool P11AttrWrapWithTrusted::setDefault()
+{
+	OSAttribute attr(false);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrWrapWithTrusted::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int op)
+{
+	OSAttribute attrTrue(true);
+	OSAttribute attrFalse(false);
+
+	// Attribute specific checks
+
+	if (op == OBJECT_OP_SET || op == OBJECT_OP_COPY)
+	{
+		if (osobject->getBooleanValue(CKA_WRAP_WITH_TRUSTED, false))
+		{
+			return CKR_ATTRIBUTE_READ_ONLY;
+		}
+	}
+
+	if (ulValueLen !=sizeof(CK_BBOOL))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	if (*(CK_BBOOL*)pValue == CK_FALSE)
+	{
+		osobject->setAttribute(type, attrFalse);
+	}
+	else
+	{
+		osobject->setAttribute(type, attrTrue);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_ALWAYS_AUTHENTICATE
+ *****************************************/
+
+// Set default value
+bool P11AttrAlwaysAuthenticate::setDefault()
+{
+	OSAttribute attr(false);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrAlwaysAuthenticate::updateAttr(Token* /*token*/, bool isPrivate, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	OSAttribute attrTrue(true);
+	OSAttribute attrFalse(false);
+
+	// Attribute specific checks
+
+	if (ulValueLen !=sizeof(CK_BBOOL))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	if (*(CK_BBOOL*)pValue == CK_FALSE)
+	{
+		osobject->setAttribute(type, attrFalse);
+	}
+	else
+	{
+		if (!isPrivate)
+		{
+			return CKR_TEMPLATE_INCONSISTENT;
+		}
+
+		osobject->setAttribute(type, attrTrue);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_MODULUS
+ *****************************************/
+
+// Set default value
+bool P11AttrModulus::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrModulus::updateAttr(Token *token, bool isPrivate, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int op)
+{
+	ByteString plaintext((unsigned char*)pValue, ulValueLen);
+	ByteString value;
+
+	// Encrypt
+
+	if (isPrivate)
+	{
+		if (!token->encrypt(plaintext, value))
+			return CKR_GENERAL_ERROR;
+	}
+	else
+		value = plaintext;
+
+	// Attribute specific checks
+
+	if (value.size() < ulValueLen)
+		return CKR_GENERAL_ERROR;
+
+	// Store data
+
+	osobject->setAttribute(type, value);
+
+	// Set the CKA_MODULUS_BITS during C_CreateObject
+
+	if (op == OBJECT_OP_CREATE && osobject->attributeExists(CKA_MODULUS_BITS))
+	{
+		OSAttribute bits((unsigned long)plaintext.bits());
+		osobject->setAttribute(CKA_MODULUS_BITS, bits);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_PUBLIC_EXPONENT
+ *****************************************/
+
+// Set default value
+bool P11AttrPublicExponent::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_PRIVATE_EXPONENT
+ *****************************************/
+
+// Set default value
+bool P11AttrPrivateExponent::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_PRIME_1
+ *****************************************/
+
+// Set default value
+bool P11AttrPrime1::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_PRIME_2
+ *****************************************/
+
+// Set default value
+bool P11AttrPrime2::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_EXPONENT_1
+ *****************************************/
+
+// Set default value
+bool P11AttrExponent1::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_EXPONENT_2
+ *****************************************/
+
+// Set default value
+bool P11AttrExponent2::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_COEFFICIENT
+ *****************************************/
+
+// Set default value
+bool P11AttrCoefficient::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_MODULUS_BITS
+ *****************************************/
+
+// Set default value
+bool P11AttrModulusBits::setDefault()
+{
+	OSAttribute attr((unsigned long)0);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrModulusBits::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int op)
+{
+	// Attribute specific checks
+
+	if (op != OBJECT_OP_GENERATE)
+	{
+		return CKR_ATTRIBUTE_READ_ONLY;
+	}
+
+	if (ulValueLen !=sizeof(CK_ULONG))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	osobject->setAttribute(type, *(CK_ULONG*)pValue);
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_PRIME
+ *****************************************/
+
+// Set default value
+bool P11AttrPrime::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrPrime::updateAttr(Token *token, bool isPrivate, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int op)
+{
+	ByteString plaintext((unsigned char*)pValue, ulValueLen);
+	ByteString value;
+
+	// Encrypt
+
+	if (isPrivate)
+	{
+		if (!token->encrypt(plaintext, value))
+			return CKR_GENERAL_ERROR;
+	}
+	else
+		value = plaintext;
+
+	// Attribute specific checks
+
+	if (value.size() < ulValueLen)
+		return CKR_GENERAL_ERROR;
+
+	// Store data
+
+	osobject->setAttribute(type, value);
+
+	// Set the CKA_PRIME_BITS during C_CreateObject
+
+	if (op == OBJECT_OP_CREATE && osobject->attributeExists(CKA_PRIME_BITS))
+	{
+		OSAttribute bits((unsigned long)plaintext.bits());
+		osobject->setAttribute(CKA_PRIME_BITS, bits);
+	}
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_SUBPRIME
+ *****************************************/
+
+// Set default value
+bool P11AttrSubPrime::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_BASE
+ *****************************************/
+
+// Set default value
+bool P11AttrBase::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_PRIME_BITS
+ *****************************************/
+
+// Set default value
+bool P11AttrPrimeBits::setDefault()
+{
+	OSAttribute attr((unsigned long)0);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrPrimeBits::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int op)
+{
+	// Attribute specific checks
+
+	if (op != OBJECT_OP_GENERATE)
+	{
+		return CKR_ATTRIBUTE_READ_ONLY;
+	}
+
+	if (ulValueLen != sizeof(CK_ULONG))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	osobject->setAttribute(type, *(CK_ULONG*)pValue);
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_VALUE_BITS
+ *****************************************/
+
+// Set default value
+bool P11AttrValueBits::setDefault()
+{
+	OSAttribute attr((unsigned long)0);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrValueBits::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int op)
+{
+	// Attribute specific checks
+
+	if (op != OBJECT_OP_GENERATE)
+	{
+		return CKR_ATTRIBUTE_READ_ONLY;
+	}
+
+	if (ulValueLen != sizeof(CK_ULONG))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	osobject->setAttribute(type, *(CK_ULONG*)pValue);
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_EC_PARAMS
+ *****************************************/
+
+// Set default value
+bool P11AttrEcParams::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_EC_POINT
+ *****************************************/
+
+// Set default value
+bool P11AttrEcPoint::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_GOSTR3410_PARAMS
+ *****************************************/
+
+// Set default value
+bool P11AttrGostR3410Params::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_GOSTR3411_PARAMS
+ *****************************************/
+
+// Set default value
+bool P11AttrGostR3411Params::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_GOST28147_PARAMS
+ *****************************************/
+
+// Set default value
+bool P11AttrGost28147Params::setDefault()
+{
+	OSAttribute attr(ByteString(""));
+	return osobject->setAttribute(type, attr);
+}
+
+/*****************************************
+ * CKA_VALUE_LEN
+ *****************************************/
+
+// Set default value
+bool P11AttrValueLen::setDefault()
+{
+	OSAttribute attr((unsigned long)0);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value if allowed
+CK_RV P11AttrValueLen::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int op)
+{
+	// Attribute specific checks
+
+	if (op != OBJECT_OP_GENERATE && op != OBJECT_OP_DERIVE)
+	{
+		return CKR_ATTRIBUTE_READ_ONLY;
+	}
+
+	if (ulValueLen != sizeof(CK_ULONG))
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Store data
+
+	osobject->setAttribute(type, *(CK_ULONG*)pValue);
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_WRAP_TEMPLATE
+ *****************************************/
+
+// Set default value
+bool P11AttrWrapTemplate::setDefault()
+{
+	std::map<CK_ATTRIBUTE_TYPE,OSAttribute> empty;
+	OSAttribute attr(empty);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value
+CK_RV P11AttrWrapTemplate::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	// Attribute specific checks
+	if ((ulValueLen % sizeof(CK_ATTRIBUTE)) != 0)
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Fill the template vector with elements
+	CK_ATTRIBUTE_PTR attr = (CK_ATTRIBUTE_PTR) pValue;
+	std::map<CK_ATTRIBUTE_TYPE,OSAttribute> data;
+	for (size_t i = 0; i < ulValueLen / sizeof(CK_ATTRIBUTE); ++i, ++attr)
+	// Specialization for known attributes
+	switch (attr->type)
+	{
+	case CKA_TOKEN:
+	case CKA_PRIVATE:
+	case CKA_MODIFIABLE:
+	case CKA_COPYABLE:
+	case CKA_TRUSTED:
+	case CKA_ENCRYPT:
+	case CKA_DECRYPT:
+	case CKA_SIGN:
+	case CKA_SIGN_RECOVER:
+	case CKA_VERIFY:
+	case CKA_VERIFY_RECOVER:
+	case CKA_WRAP:
+	case CKA_UNWRAP:
+	case CKA_DERIVE:
+	case CKA_LOCAL:
+	case CKA_ALWAYS_SENSITIVE:
+	case CKA_SENSITIVE:
+	case CKA_NEVER_EXTRACTABLE:
+	case CKA_EXTRACTABLE:
+	case CKA_WRAP_WITH_TRUSTED:
+	case CKA_SECONDARY_AUTH:
+	case CKA_ALWAYS_AUTHENTICATE:
+		{
+			// CK_BBOOL
+			if (attr->ulValueLen != sizeof(CK_BBOOL))
+				return CKR_ATTRIBUTE_VALUE_INVALID;
+			bool elem = (*(CK_BBOOL*)attr->pValue != CK_FALSE);
+			data.insert(std::pair<CK_ATTRIBUTE_TYPE,OSAttribute> (attr->type, elem));
+		}
+		break;
+
+	case CKA_CLASS:
+	case CKA_KEY_TYPE:
+	case CKA_CERTIFICATE_TYPE:
+	case CKA_CERTIFICATE_CATEGORY:
+	case CKA_JAVA_MIDP_SECURITY_DOMAIN:
+	case CKA_NAME_HASH_ALGORITHM:
+	case CKA_KEY_GEN_MECHANISM:
+	case CKA_MODULUS_BITS:
+	case CKA_PRIME_BITS:
+	case CKA_SUBPRIME_BITS:
+	case CKA_VALUE_BITS:
+	case CKA_VALUE_LEN:
+	case CKA_AUTH_PIN_FLAGS:
+		{
+			// CK_ULONG
+			if (attr->ulValueLen != sizeof(CK_ULONG))
+				return CKR_ATTRIBUTE_VALUE_INVALID;
+			unsigned long elem = *(CK_ULONG*)attr->pValue;
+			data.insert(std::pair<CK_ATTRIBUTE_TYPE,OSAttribute> (attr->type, elem));
+		}
+		break;
+
+	case CKA_WRAP_TEMPLATE:
+	case CKA_UNWRAP_TEMPLATE:
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+
+	default:
+		{
+			// CK_BYTE
+			ByteString elem = ByteString((unsigned char*)attr->pValue, attr->ulValueLen);
+			data.insert(std::pair<CK_ATTRIBUTE_TYPE,OSAttribute> (attr->type, elem));
+		}
+	}
+
+	// Store data
+	osobject->setAttribute(type, data);
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_UNWRAP_TEMPLATE
+ *****************************************/
+
+// Set default value
+bool P11AttrUnwrapTemplate::setDefault()
+{
+	std::map<CK_ATTRIBUTE_TYPE,OSAttribute> empty;
+	OSAttribute attr(empty);
+	return osobject->setAttribute(type, attr);
+}
+
+// Update the value
+CK_RV P11AttrUnwrapTemplate::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	// Attribute specific checks
+	if ((ulValueLen % sizeof(CK_ATTRIBUTE)) != 0)
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	// Fill the template vector with elements
+	CK_ATTRIBUTE_PTR attr = (CK_ATTRIBUTE_PTR) pValue;
+	std::map<CK_ATTRIBUTE_TYPE,OSAttribute> data;
+	for (size_t i = 0; i < ulValueLen / sizeof(CK_ATTRIBUTE); ++i, ++attr)
+	// Specialization for known attributes
+	switch (attr->type)
+	{
+	case CKA_TOKEN:
+	case CKA_PRIVATE:
+	case CKA_MODIFIABLE:
+	case CKA_COPYABLE:
+	case CKA_TRUSTED:
+	case CKA_ENCRYPT:
+	case CKA_DECRYPT:
+	case CKA_SIGN:
+	case CKA_SIGN_RECOVER:
+	case CKA_VERIFY:
+	case CKA_VERIFY_RECOVER:
+	case CKA_WRAP:
+	case CKA_UNWRAP:
+	case CKA_DERIVE:
+	case CKA_LOCAL:
+	case CKA_ALWAYS_SENSITIVE:
+	case CKA_SENSITIVE:
+	case CKA_NEVER_EXTRACTABLE:
+	case CKA_EXTRACTABLE:
+	case CKA_WRAP_WITH_TRUSTED:
+	case CKA_SECONDARY_AUTH:
+	case CKA_ALWAYS_AUTHENTICATE:
+		{
+			// CK_BBOOL
+			if (attr->ulValueLen != sizeof(CK_BBOOL))
+				return CKR_ATTRIBUTE_VALUE_INVALID;
+			bool elem = (*(CK_BBOOL*)attr->pValue != CK_FALSE);
+			data.insert(std::pair<CK_ATTRIBUTE_TYPE,OSAttribute> (attr->type, elem));
+		}
+		break;
+
+	case CKA_CLASS:
+	case CKA_KEY_TYPE:
+	case CKA_CERTIFICATE_TYPE:
+	case CKA_CERTIFICATE_CATEGORY:
+	case CKA_JAVA_MIDP_SECURITY_DOMAIN:
+	case CKA_NAME_HASH_ALGORITHM:
+	case CKA_KEY_GEN_MECHANISM:
+	case CKA_MODULUS_BITS:
+	case CKA_PRIME_BITS:
+	case CKA_SUBPRIME_BITS:
+	case CKA_VALUE_BITS:
+	case CKA_VALUE_LEN:
+	case CKA_AUTH_PIN_FLAGS:
+		{
+			// CK_ULONG
+			if (attr->ulValueLen != sizeof(CK_ULONG))
+				return CKR_ATTRIBUTE_VALUE_INVALID;
+			unsigned long elem = *(CK_ULONG*)attr->pValue;
+			data.insert(std::pair<CK_ATTRIBUTE_TYPE,OSAttribute> (attr->type, elem));
+		}
+		break;
+
+	case CKA_WRAP_TEMPLATE:
+	case CKA_UNWRAP_TEMPLATE:
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+
+	default:
+		{
+			// CK_BYTE
+			ByteString elem = ByteString((unsigned char*)attr->pValue, attr->ulValueLen);
+			data.insert(std::pair<CK_ATTRIBUTE_TYPE,OSAttribute> (attr->type, elem));
+		}
+	}
+
+	// Store data
+	osobject->setAttribute(type, data);
+
+	return CKR_OK;
+}
+
+/*****************************************
+ * CKA_ALLOWED_MECHANISMS
+ *****************************************/
+
+// Set default value
+bool P11AttrAllowedMechanisms::setDefault()
+{
+	std::set<CK_MECHANISM_TYPE> emptyMap;
+	return osobject->setAttribute(type, OSAttribute(emptyMap));
+}
+
+// Update the value if allowed
+CK_RV P11AttrAllowedMechanisms::updateAttr(Token* /*token*/, bool /*isPrivate*/, CK_VOID_PTR pValue, CK_ULONG ulValueLen, int /*op*/)
+{
+	if (ulValueLen == 0 || (ulValueLen % sizeof(CK_MECHANISM_TYPE)) != 0)
+	{
+		return CKR_ATTRIBUTE_VALUE_INVALID;
+	}
+
+	CK_MECHANISM_TYPE_PTR mechType = (CK_MECHANISM_TYPE_PTR) pValue;
+
+	// Fill the set with values
+	std::set<CK_MECHANISM_TYPE> data;
+	for (size_t i = 0; i < ulValueLen / sizeof(CK_MECHANISM_TYPE); ++i, ++mechType)
+	{
+		data.insert(*mechType);
+	}
+
+	// Store data
+	osobject->setAttribute(type, OSAttribute(data));
+	return CKR_OK;
+}