• Explicitely reject compromised emSign intermediary certificates
• Add missing environment variable to error message
• Add v5.0 tag to test matrix
• Do not report CKA_DERIVE as true for EC keys (ECDSA, EdDSA and Brainpool), as NetHSM only supports signing with them
• Set CKA_DECRYPT and CKA_SIGN for RSA keys according to the key mechanisms reported by the NetHSM
• Set CKA_DECRYPT and CKA_SIGN for AES keys according to the key mechanisms reported by the NetHSM

Full Changelog

• Add support for labels on the NetHSM (requires NetHSM v5.0 or later):
  • Add support for CKA_LABEL to C_SetAttributeValue
  • Map CKA_LABEL to the NetHSM label instead of the NetHSM key ID when enumerating, generating, importing or changing keys and certiciates

• Return correct signature length for Curve25519 keys when calling C_Sign with pSignature set to a null pointer.

• This release is fully compatible with NetHSM v5.0.
• This release is generally compatible with NetHSM v1.0, v2.0, v2.1, v2.2, v3.0 and v4.0 but not all features are available on these versions (as indicated in the changelog entries).

• For applications using CKA_LABEL attributes, the NetHSM must be updated to v5.0 before updating the PKCS11 module.
  Also, the label must be set to the key ID for all keys used by the application.
• If the application using the PKCS11 module does not use CKA_LABEL attributes, no special steps are required.

Full Changelog

• Add support for labels on the NetHSM (requires NetHSM v5.0 or later):
  • Add support for CKA_LABEL to C_SetAttributeValue
  • Map CKA_LABEL to the NetHSM label instead of the NetHSM key ID when enumerating, generating, importing or changing keys and certiciates

• Return correct signature length for Curve25519 keys when calling C_Sign with pSignature set to a null pointer.

• This release is fully compatible with NetHSM v5.0.
• This release is generally compatible with NetHSM v1.0, v2.0, v2.1, v2.2, v3.0 and v4.0 but not all features are available on these versions (as indicated in the changelog entries).

• For applications using CKA_LABEL attributes, the NetHSM must be updated to v5.0 before updating the PKCS11 module.
  Also, the label must be set to the key ID for all keys used by the application.
• If the application using the PKCS11 module does not use CKA_LABEL attributes, no special steps are required.

Full Changelog