Revised keystore API, part one. Not usable yet.

Changes to implement a revised keystore API.  This code probably won't
even compile properly yet, and almost certainly will not run, but most
of the expected changes are complete at this point.  Main points:

* Key names are now UUIDs, and are generated by the HSM, not the client.

* Keystore API no longer assumes that key database is resident in
  memory (original API was written on the assumption that the keystore
  flash would be mapped into the HSM CPU's address space, but
  apparently the board and flash drivers don't really support that).

A few other changes have probably crept in, but the bulk of this
changeset is just following through implications of the above, some of
which percolate all the way back to the public RPC API.

1 files changed, 162 insertions, 127 deletions

diff --git a/rpc_pkey.c b/rpc_pkey.c
index d6efbe7..6de3a9b 100644
--- a/rpc_pkey.c
+++ b/rpc_pkey.c
@@ -39,35 +39,12 @@
 #include "hal.h"
 #include "hal_internal.h"
 
-typedef struct {
-  hal_client_handle_t client_handle;
-  hal_session_handle_t session_handle;
-  hal_pkey_handle_t pkey_handle;
-  hal_key_type_t type;
-  hal_curve_name_t curve;
-  hal_key_flags_t flags;
-  uint8_t name[HAL_RPC_PKEY_NAME_MAX];
-  size_t name_len;
-  int ks_hint;
-  /*
-   * This might be where we'd stash a (hal_core_t *) pointing to a
-   * core which has already been loaded with the key, if we were
-   * trying to be clever about using multiple signing cores.  Moot
-   * point (ie, no way we could possibly test such a thing) as long as
-   * the FPGA is too small to hold more than one modexp core and ECDSA
-   * is entirely software, so skip it for now, but the implied
-   * semantics are interesting: a pkey handle starts to resemble an
-   * initialized signing core, and once all the cores are in use, one
-   * can't load another key without closing an existing pkey handle.
-   */
-} pkey_slot_t;
-
 #ifndef HAL_STATIC_PKEY_STATE_BLOCKS
 #define HAL_STATIC_PKEY_STATE_BLOCKS 0
 #endif
 
 #if HAL_STATIC_PKEY_STATE_BLOCKS > 0
-static pkey_slot_t pkey_handle[HAL_STATIC_PKEY_STATE_BLOCKS];
+static hal_pkey_slot_t pkey_handle[HAL_STATIC_PKEY_STATE_BLOCKS];
 #endif
 
 /*
@@ -82,23 +59,23 @@ static pkey_slot_t pkey_handle[HAL_STATIC_PKEY_STATE_BLOCKS];
  * handlers to route calls to the appropriate destination.
  */
 
-static inline pkey_slot_t *alloc_slot(const hal_key_flags_t flags)
+static inline hal_pkey_slot_t *alloc_slot(const hal_key_flags_t flags)
 {
 #if HAL_STATIC_PKEY_STATE_BLOCKS > 0
   static uint16_t next_glop = 0;
   uint32_t glop = ++next_glop << 16;
   next_glop %= 0x7FFF;
 
-  assert((glop & HAL_PKEY_HANDLE_PROXIMATE_FLAG) == 0);
+  assert((glop & HAL_PKEY_HANDLE_TOKEN_FLAG) == 0);
 
-  if ((flags & HAL_KEY_FLAG_PROXIMATE) != 0)
-    glop |= HAL_PKEY_HANDLE_PROXIMATE_FLAG;
+  if ((flags & HAL_KEY_FLAG_TOKEN) != 0)
+    glop |= HAL_PKEY_HANDLE_TOKEN_FLAG;
 
   for (int i = 0; i < sizeof(pkey_handle)/sizeof(*pkey_handle); i++) {
     if (pkey_handle[i].type != HAL_KEY_TYPE_NONE)
       continue;
+    memset(&pkey_handle[i], 0, sizeof(pkey_handle[i]));
     pkey_handle[i].pkey_handle.handle = i | glop;
-    pkey_handle[i].ks_hint = -1;
     return &pkey_handle[i];
   }
 #endif
@@ -111,7 +88,7 @@ static inline pkey_slot_t *alloc_slot(const hal_key_flags_t flags)
  * the right glop.  Returns slot pointer on success, NULL otherwise.
  */
 
-static inline pkey_slot_t *find_handle(const hal_pkey_handle_t handle)
+static inline hal_pkey_slot_t *find_handle(const hal_pkey_handle_t handle)
 {
 #if HAL_STATIC_PKEY_STATE_BLOCKS > 0
   const int i = (int) (handle.handle & 0xFFFF);
@@ -129,12 +106,10 @@ static inline pkey_slot_t *find_handle(const hal_pkey_handle_t handle)
  * Need to check detailed PKCS #11 rules, but, from memory, we may be supposed to allow
  * access to non-token objects even when not logged in.  Maybe.  Rules are complex.
  *
- * I think the libhal translation of this resolves around what we've
- * been calling the PROXIMATE flags (which probably ought to be
- * renamed to *_NONTOKEN_*, slightly less confusing name).  For token
- * objects, we insist on being logged in properly; for non-token
- * objects, we do whatever silly thing PKCS #11 wants us to do,
- * probably defaulting to requiring login if PKCS #11 gives us a choice.
+ * I think the libhal translation of this resolves around HAL_KEY_FLAG_TOKEN.
+ * For token objects, we insist on being logged in properly; for non-token
+ * objects, we do whatever silly thing PKCS #11 wants us to do, probably
+ * defaulting to requiring login if PKCS #11 gives us a choice.
  */
 
 /*
@@ -223,6 +198,27 @@ static hal_error_t pkcs1_5_pad(const uint8_t * const data, const size_t data_len
 }
 
 /*
+ * Given key flags, open appropriate keystore driver.
+ */
+
+static inline hal_error_t ks_open_from_flags(hal_ks_t **ks, const hal_key_flags_t flags)
+{
+  if ((flags & HAL_KEY_FLAG_TOKEN) == 0)
+    return hal_ks_open(hal_ks_volatile_driver, ks);
+
+#if 0
+
+    return hal_ks_open(hal_ks_token_driver, ks);
+
+#else
+#warning This needs to open hal_ks_token_driver here, once we get around to writing that driver
+
+    return HAL_ERROR_KS_DRIVER_NOT_FOUND;
+
+#endif
+}
+
+/*
  * Receive key from application, store it with supplied name, return a key handle.
  */
 
@@ -231,30 +227,39 @@ static hal_error_t pkey_local_load(const hal_client_handle_t client,
                                    hal_pkey_handle_t *pkey,
                                    const hal_key_type_t type,
                                    const hal_curve_name_t curve,
-                                   const uint8_t * const name, const size_t name_len,
+                                   hal_uuid_t *name,
                                    const uint8_t * const der, const size_t der_len,
                                    const hal_key_flags_t flags)
 {
-  pkey_slot_t *slot;
-  hal_error_t err;
+  assert(pkey != NULL && name != NULL);
 
-  assert(sizeof(slot->name) >= name_len && pkey != NULL);
+  hal_pkey_slot_t *slot;
+  hal_ks_t *ks = NULL;
+  hal_error_t err;
 
   if ((slot = alloc_slot(flags)) == NULL)
     return HAL_ERROR_NO_KEY_SLOTS_AVAILABLE;
 
-  if ((err = hal_ks_store(type, curve, flags, name, name_len, der, der_len, &slot->ks_hint)) != HAL_OK)
+  if ((err = hal_uuid_gen(&slot->name)) != HAL_OK)
     return err;
 
-  memcpy(slot->name, name, name_len);
   slot->client_handle = client;
   slot->session_handle = session;
   slot->type = type;
   slot->curve = curve;
   slot->flags = flags;
-  slot->name_len = name_len;
+
+  if ((err = ks_open_from_flags(&ks, flags)) == HAL_OK &&
+      (err = hal_ks_store(ks, slot, der, der_len)) == HAL_OK)
+    err = hal_ks_close(ks);
+  else if (ks != NULL)
+    (void) hal_ks_close(ks);
+
+  if (err != HAL_OK)
+    return err;
 
   *pkey = slot->pkey_handle;
+  *name = slot->name;
   return HAL_OK;
 }
 
@@ -266,25 +271,31 @@ static hal_error_t pkey_local_find(const hal_client_handle_t client,
                                    const hal_session_handle_t session,
                                    hal_pkey_handle_t *pkey,
                                    const hal_key_type_t type,
-                                   const uint8_t * const name, const size_t name_len,
+                                   const hal_uuid_t * const name,
                                    const hal_key_flags_t flags)
 {
-  pkey_slot_t *slot;
-  hal_error_t err;
+  assert(pkey != NULL && name != NULL);
 
-  assert(sizeof(slot->name) >= name_len && pkey != NULL);
+  hal_pkey_slot_t *slot;
+  hal_ks_t *ks = NULL;
+  hal_error_t err;
 
   if ((slot = alloc_slot(flags)) == NULL)
     return HAL_ERROR_NO_KEY_SLOTS_AVAILABLE;
 
-  if ((err = hal_ks_fetch(type, name, name_len, &slot->curve, &slot->flags, NULL, NULL, 0, &slot->ks_hint)) != HAL_OK)
-    return err;
-
-  memcpy(slot->name, name, name_len);
+  slot->name = *name;
   slot->client_handle = client;
   slot->session_handle = session;
   slot->type = type;
-  slot->name_len = name_len;
+
+  if ((err = ks_open_from_flags(&ks, flags)) == HAL_OK &&
+      (err = hal_ks_fetch(ks, slot, NULL, NULL, 0)) == HAL_OK)
+    err = hal_ks_close(ks);
+  else if (ks != NULL)
+    (void) hal_ks_close(ks);
+
+  if (err != HAL_OK)
+    return err;
 
   *pkey = slot->pkey_handle;
   return HAL_OK;
@@ -297,21 +308,30 @@ static hal_error_t pkey_local_find(const hal_client_handle_t client,
 static hal_error_t pkey_local_generate_rsa(const hal_client_handle_t client,
                                            const hal_session_handle_t session,
                                            hal_pkey_handle_t *pkey,
-                                           const uint8_t * const name, const size_t name_len,
+                                           hal_uuid_t *name,
                                            const unsigned key_length,
                                            const uint8_t * const public_exponent, const size_t public_exponent_len,
                                            const hal_key_flags_t flags)
 {
-  pkey_slot_t *slot;
-  hal_error_t err;
+  assert(pkey != NULL && name != NULL && (key_length & 7) == 0);
 
-  assert(sizeof(slot->name) >= name_len && pkey != NULL && (key_length & 7) == 0);
+  uint8_t keybuf[hal_rsa_key_t_size];
+  hal_rsa_key_t *key = NULL;
+  hal_pkey_slot_t *slot;
+  hal_ks_t *ks = NULL;
+  hal_error_t err;
 
   if ((slot = alloc_slot(flags)) == NULL)
     return HAL_ERROR_NO_KEY_SLOTS_AVAILABLE;
 
-  uint8_t keybuf[hal_rsa_key_t_size];
-  hal_rsa_key_t *key = NULL;
+  if ((err = hal_uuid_gen(&slot->name)) != HAL_OK)
+    return err;
+
+  slot->client_handle = client;
+  slot->session_handle = session;
+  slot->type = HAL_KEY_TYPE_RSA_PRIVATE;
+  slot->curve = HAL_CURVE_NONE;
+  slot->flags = flags;
 
   if ((err = hal_rsa_key_gen(NULL, &key, keybuf, sizeof(keybuf), key_length / 8,
                              public_exponent, public_exponent_len)) != HAL_OK)
@@ -320,9 +340,12 @@ static hal_error_t pkey_local_generate_rsa(const hal_client_handle_t client,
   uint8_t der[hal_rsa_private_key_to_der_len(key)];
   size_t der_len;
 
-  if ((err = hal_rsa_private_key_to_der(key, der, &der_len, sizeof(der))) == HAL_OK)
-    err = hal_ks_store(HAL_KEY_TYPE_RSA_PRIVATE, HAL_CURVE_NONE, flags,
-                       name, name_len, der, der_len, &slot->ks_hint);
+  if ((err = hal_rsa_private_key_to_der(key, der, &der_len, sizeof(der))) == HAL_OK &&
+      (err = ks_open_from_flags(&ks, flags)) == HAL_OK &&
+      (err = hal_ks_store(ks, slot, der, der_len)) == HAL_OK)
+    err = hal_ks_close(ks);
+  else if (ks != NULL)
+    (void) hal_ks_close(ks);
 
   memset(keybuf, 0, sizeof(keybuf));
   memset(der, 0, sizeof(der));
@@ -330,15 +353,8 @@ static hal_error_t pkey_local_generate_rsa(const hal_client_handle_t client,
   if (err != HAL_OK)
     return err;
 
-  memcpy(slot->name, name, name_len);
-  slot->client_handle = client;
-  slot->session_handle = session;
-  slot->type = HAL_KEY_TYPE_RSA_PRIVATE;
-  slot->curve = HAL_CURVE_NONE;
-  slot->flags = flags;
-  slot->name_len = name_len;
-
   *pkey = slot->pkey_handle;
+  *name = slot->name;
   return HAL_OK;
 }
 
@@ -350,20 +366,29 @@ static hal_error_t pkey_local_generate_rsa(const hal_client_handle_t client,
 static hal_error_t pkey_local_generate_ec(const hal_client_handle_t client,
                                           const hal_session_handle_t session,
                                           hal_pkey_handle_t *pkey,
-                                          const uint8_t * const name, const size_t name_len,
+                                          hal_uuid_t *name,
                                           const hal_curve_name_t curve,
                                           const hal_key_flags_t flags)
 {
-  pkey_slot_t *slot;
-  hal_error_t err;
+  assert(pkey != NULL && name != NULL);
 
-  assert(sizeof(slot->name) >= name_len && pkey != NULL);
+  uint8_t keybuf[hal_ecdsa_key_t_size];
+  hal_ecdsa_key_t *key = NULL;
+  hal_pkey_slot_t *slot;
+  hal_ks_t *ks = NULL;
+  hal_error_t err;
 
   if ((slot = alloc_slot(flags)) == NULL)
     return HAL_ERROR_NO_KEY_SLOTS_AVAILABLE;
 
-  uint8_t keybuf[hal_ecdsa_key_t_size];
-  hal_ecdsa_key_t *key = NULL;
+  if ((err = hal_uuid_gen(&slot->name)) != HAL_OK)
+    return err;
+
+  slot->client_handle = client;
+  slot->session_handle = session;
+  slot->type = HAL_KEY_TYPE_EC_PRIVATE;
+  slot->curve = curve;
+  slot->flags = flags;
 
   if ((err = hal_ecdsa_key_gen(NULL, &key, keybuf, sizeof(keybuf), curve)) != HAL_OK)
     return err;
@@ -371,9 +396,12 @@ static hal_error_t pkey_local_generate_ec(const hal_client_handle_t client,
   uint8_t der[hal_ecdsa_private_key_to_der_len(key)];
   size_t der_len;
 
-  if ((err = hal_ecdsa_private_key_to_der(key, der, &der_len, sizeof(der))) == HAL_OK)
-    err = hal_ks_store(HAL_KEY_TYPE_EC_PRIVATE, curve, flags,
-                       name, name_len, der, der_len, &slot->ks_hint);
+  if ((err = hal_ecdsa_private_key_to_der(key, der, &der_len, sizeof(der))) == HAL_OK &&
+      (err = ks_open_from_flags(&ks, flags)) == HAL_OK &&
+      (err = hal_ks_store(ks, slot, der, der_len)) == HAL_OK)
+    err = hal_ks_close(ks);
+  else if (ks != NULL)
+    (void) hal_ks_close(ks);
 
   memset(keybuf, 0, sizeof(keybuf));
   memset(der, 0, sizeof(der));
@@ -381,15 +409,8 @@ static hal_error_t pkey_local_generate_ec(const hal_client_handle_t client,
   if (err != HAL_OK)
     return err;
 
-  memcpy(slot->name, name, name_len);
-  slot->client_handle = client;
-  slot->session_handle = session;
-  slot->type = HAL_KEY_TYPE_EC_PRIVATE;
-  slot->curve = curve;
-  slot->flags = flags;
-  slot->name_len = name_len;
-
   *pkey = slot->pkey_handle;
+  *name = slot->name;
   return HAL_OK;
 }
 
@@ -399,7 +420,7 @@ static hal_error_t pkey_local_generate_ec(const hal_client_handle_t client,
 
 static hal_error_t pkey_local_close(const hal_pkey_handle_t pkey)
 {
-  pkey_slot_t *slot;
+  hal_pkey_slot_t *slot;
 
   if ((slot = find_handle(pkey)) == NULL)
     return HAL_ERROR_KEY_NOT_FOUND;
@@ -415,12 +436,19 @@ static hal_error_t pkey_local_close(const hal_pkey_handle_t pkey)
 
 static hal_error_t pkey_local_delete(const hal_pkey_handle_t pkey)
 {
-  pkey_slot_t *slot = find_handle(pkey);
+  hal_pkey_slot_t *slot = find_handle(pkey);
 
   if (slot == NULL)
     return HAL_ERROR_KEY_NOT_FOUND;
 
-  hal_error_t err = hal_ks_delete(slot->type, slot->name, slot->name_len, &slot->ks_hint);
+  hal_ks_t *ks = NULL;
+  hal_error_t err;
+
+  if ((err = ks_open_from_flags(&ks, slot->flags)) == HAL_OK &&
+      (err = hal_ks_delete(ks, slot)) == HAL_OK)
+    err = hal_ks_close(ks);
+  else if (ks != NULL)
+    (void) hal_ks_close(ks);
 
   if (err == HAL_OK || err == HAL_ERROR_KEY_NOT_FOUND)
     memset(slot, 0, sizeof(*slot));
@@ -429,30 +457,6 @@ static hal_error_t pkey_local_delete(const hal_pkey_handle_t pkey)
 }
 
 /*
- * Rename a key in the key store, given its key handle and a new name.
- */
-
-static hal_error_t pkey_local_rename(const hal_pkey_handle_t pkey,
-                                     const uint8_t * const name, const size_t name_len)
-{
-  pkey_slot_t *slot = find_handle(pkey);
-
-  if (slot == NULL)
-    return HAL_ERROR_KEY_NOT_FOUND;
-
-  hal_error_t err = hal_ks_rename(slot->type, slot->name, slot->name_len, name, name_len, &slot->ks_hint);
-
-  if (err == HAL_OK) {
-    assert(name_len <= sizeof(slot->name));
-    memcpy(slot->name, name, name_len);
-    memset(slot->name + name_len, 0, sizeof(slot->name) - name_len);
-    slot->name_len = name_len;
-  }
-
-  return err;
-}
-
-/*
  * Get type of key associated with handle.
  */
 
@@ -462,7 +466,7 @@ static hal_error_t pkey_local_get_key_type(const hal_pkey_handle_t pkey,
   if (type == NULL)
     return HAL_ERROR_BAD_ARGUMENTS;
 
-  pkey_slot_t *slot = find_handle(pkey);
+  hal_pkey_slot_t *slot = find_handle(pkey);
 
   if (slot == NULL)
     return HAL_ERROR_KEY_NOT_FOUND;
@@ -482,7 +486,7 @@ static hal_error_t pkey_local_get_key_flags(const hal_pkey_handle_t pkey,
   if (flags == NULL)
     return HAL_ERROR_BAD_ARGUMENTS;
 
-  pkey_slot_t *slot = find_handle(pkey);
+  hal_pkey_slot_t *slot = find_handle(pkey);
 
   if (slot == NULL)
     return HAL_ERROR_KEY_NOT_FOUND;
@@ -498,7 +502,7 @@ static hal_error_t pkey_local_get_key_flags(const hal_pkey_handle_t pkey,
 
 static size_t pkey_local_get_public_key_len(const hal_pkey_handle_t pkey)
 {
-  pkey_slot_t *slot = find_handle(pkey);
+  hal_pkey_slot_t *slot = find_handle(pkey);
 
   if (slot == NULL)
     return 0;
@@ -510,9 +514,16 @@ static size_t pkey_local_get_public_key_len(const hal_pkey_handle_t pkey)
   hal_ecdsa_key_t *ecdsa_key = NULL;
   uint8_t der[HAL_KS_WRAPPED_KEYSIZE];
   size_t der_len;
+  hal_ks_t *ks = NULL;
+  hal_error_t err;
 
-  if (hal_ks_fetch(slot->type, slot->name, slot->name_len, NULL, NULL,
-                   der, &der_len, sizeof(der), &slot->ks_hint) == HAL_OK) {
+  if ((err = ks_open_from_flags(&ks, slot->flags)) == HAL_OK &&
+      (err = hal_ks_fetch(ks, slot, der, &der_len, sizeof(der))) == HAL_OK)
+    err = hal_ks_close(ks);
+  else if (ks != NULL)
+    (void) hal_ks_close(ks);
+
+  if (err == HAL_OK) {
     switch (slot->type) {
 
     case HAL_KEY_TYPE_RSA_PUBLIC:
@@ -548,7 +559,7 @@ static size_t pkey_local_get_public_key_len(const hal_pkey_handle_t pkey)
 static hal_error_t pkey_local_get_public_key(const hal_pkey_handle_t pkey,
                                              uint8_t *der, size_t *der_len, const size_t der_max)
 {
-  pkey_slot_t *slot = find_handle(pkey);
+  hal_pkey_slot_t *slot = find_handle(pkey);
 
   if (slot == NULL)
     return HAL_ERROR_KEY_NOT_FOUND;
@@ -558,10 +569,16 @@ static hal_error_t pkey_local_get_public_key(const hal_pkey_handle_t pkey,
   hal_ecdsa_key_t *ecdsa_key = NULL;
   uint8_t buf[HAL_KS_WRAPPED_KEYSIZE];
   size_t buf_len;
+  hal_ks_t *ks = NULL;
   hal_error_t err;
 
-  if ((err = hal_ks_fetch(slot->type, slot->name, slot->name_len, NULL, NULL,
-                          buf, &buf_len, sizeof(buf), &slot->ks_hint)) == HAL_OK) {
+  if ((err = ks_open_from_flags(&ks, slot->flags)) == HAL_OK &&
+      (err = hal_ks_fetch(ks, slot, buf, &buf_len, sizeof(buf))) == HAL_OK)
+    err = hal_ks_close(ks);
+  else if (ks != NULL)
+    (void) hal_ks_close(ks);
+
+  if (err == HAL_OK) {
     switch (slot->type) {
 
     case HAL_KEY_TYPE_RSA_PUBLIC:
@@ -678,7 +695,7 @@ static hal_error_t pkey_local_sign(const hal_session_handle_t session,
                                    const uint8_t * const input,  const size_t input_len,
                                    uint8_t * signature, size_t *signature_len, const size_t signature_max)
 {
-  pkey_slot_t *slot = find_handle(pkey);
+  hal_pkey_slot_t *slot = find_handle(pkey);
 
   if (slot == NULL)
     return HAL_ERROR_KEY_NOT_FOUND;
@@ -703,9 +720,14 @@ static hal_error_t pkey_local_sign(const hal_session_handle_t session,
   uint8_t keybuf[hal_rsa_key_t_size > hal_ecdsa_key_t_size ? hal_rsa_key_t_size : hal_ecdsa_key_t_size];
   uint8_t der[HAL_KS_WRAPPED_KEYSIZE];
   size_t der_len;
+  hal_ks_t *ks = NULL;
   hal_error_t err;
 
-  err = hal_ks_fetch(slot->type, slot->name, slot->name_len, NULL, NULL, der, &der_len, sizeof(der), &slot->ks_hint);
+  if ((err = ks_open_from_flags(&ks, slot->flags)) == HAL_OK &&
+      (err = hal_ks_fetch(ks, slot, der, &der_len, sizeof(der))) == HAL_OK)
+    err = hal_ks_close(ks);
+  else if (ks != NULL)
+    (void) hal_ks_close(ks);
 
   if (err == HAL_OK)
     err = signer(keybuf, sizeof(keybuf), der, der_len, hash, input, input_len, signature, signature_len, signature_max);
@@ -820,7 +842,7 @@ static hal_error_t pkey_local_verify(const hal_session_handle_t session,
                                      const uint8_t * const input, const size_t input_len,
                                      const uint8_t * const signature, const size_t signature_len)
 {
-  pkey_slot_t *slot = find_handle(pkey);
+  hal_pkey_slot_t *slot = find_handle(pkey);
 
   if (slot == NULL)
     return HAL_ERROR_KEY_NOT_FOUND;
@@ -847,9 +869,14 @@ static hal_error_t pkey_local_verify(const hal_session_handle_t session,
   uint8_t keybuf[hal_rsa_key_t_size > hal_ecdsa_key_t_size ? hal_rsa_key_t_size : hal_ecdsa_key_t_size];
   uint8_t der[HAL_KS_WRAPPED_KEYSIZE];
   size_t der_len;
+  hal_ks_t *ks = NULL;
   hal_error_t err;
 
-  err = hal_ks_fetch(slot->type, slot->name, slot->name_len, NULL, NULL, der, &der_len, sizeof(der), &slot->ks_hint);
+  if ((err = ks_open_from_flags(&ks, slot->flags)) == HAL_OK &&
+      (err = hal_ks_fetch(ks, slot, der, &der_len, sizeof(der))) == HAL_OK)
+    err = hal_ks_close(ks);
+  else if (ks != NULL)
+    (void) hal_ks_close(ks);
 
   if (err == HAL_OK)
     err = verifier(keybuf, sizeof(keybuf), slot->type, der, der_len, hash, input, input_len, signature, signature_len);
@@ -870,7 +897,16 @@ static hal_error_t pkey_local_list(hal_pkey_info_t *result,
                                    const unsigned result_max,
                                    hal_key_flags_t flags)
 {
-  return hal_ks_list(result, result_len, result_max);
+  hal_ks_t *ks = NULL;
+  hal_error_t err;
+
+  if ((err = ks_open_from_flags(&ks, flags)) == HAL_OK &&
+      (err = hal_ks_list(ks, result, result_len, result_max)) == HAL_OK)
+    err = hal_ks_close(ks);
+  else if (ks != NULL)
+    (void) hal_ks_close(ks);
+
+  return err;
 }
 
 const hal_rpc_pkey_dispatch_t hal_rpc_local_pkey_dispatch = {
@@ -880,7 +916,6 @@ const hal_rpc_pkey_dispatch_t hal_rpc_local_pkey_dispatch = {
   pkey_local_generate_ec,
   pkey_local_close,
   pkey_local_delete,
-  pkey_local_rename,
   pkey_local_get_key_type,
   pkey_local_get_key_flags,
   pkey_local_get_public_key_len,