From 9e8b28abcce9a335738ca0a944bc0ad381425809 Mon Sep 17 00:00:00 2001
From: Alexandru Placinta <placintaalexandru1@gmail.com>
Date: Tue, 22 Sep 2026 11:49:22 +0200
Subject: [PATCH] Allow vendor specific calls to derive key

Signed-off-by: Alexandru Placinta <placintaalexandru1@gmail.com>
---
 cryptoki/Cargo.toml                    |  1 +
 cryptoki/src/session/key_management.rs | 45 ++++++++++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/cryptoki/Cargo.toml b/cryptoki/Cargo.toml
index d3c5689f..d3ab4f52 100644
--- a/cryptoki/Cargo.toml
+++ b/cryptoki/Cargo.toml
@@ -28,3 +28,4 @@ wycheproof = { version = "0.7.0", features = ["aead"] }
 [features]
 generate-bindings = ["cryptoki-sys/generate-bindings"]
 serde = ["secrecy/serde"]
+vendor-specifics = []
diff --git a/cryptoki/src/session/key_management.rs b/cryptoki/src/session/key_management.rs
index 0d5dfd13..66d36727 100644
--- a/cryptoki/src/session/key_management.rs
+++ b/cryptoki/src/session/key_management.rs
@@ -5,6 +5,8 @@
 use crate::context::Function;
 use crate::error::{Result, Rv};
 use crate::mechanism::Mechanism;
+#[cfg(feature = "vendor-specifics")]
+use crate::mechanism::{vendor_defined::VendorDefinedMechanism, MechanismType};
 use crate::object::{Attribute, ObjectHandle};
 use crate::session::Session;
 use cryptoki_sys::{CK_ATTRIBUTE, CK_MECHANISM, CK_MECHANISM_PTR};
@@ -93,6 +95,49 @@ impl Session {
         Ok(ObjectHandle::new(handle))
     }
 
+    /// Vendore specific call that uses `mechanism` as the output parameter.
+    ///
+    /// A use case can be found [here](https://thalesdocs.com/gphsm/luna/7/docs/network/Content/sdk/extensions/BIP32.htm)
+    /// where public and private key handles are stored in the `hPublicKey` and
+    /// `hPrivateKey`, corresponding to `pParameter` from `CK_MECHANISM`.
+    #[cfg(feature = "vendor-specifics")]
+    pub fn derive_key_vendor<'a, T>(
+        &self,
+        mechanism: usize,
+        params: &mut T,
+        base_key: ObjectHandle,
+        template: impl Into<Option<&'a [Attribute]>>,
+    ) -> Result<()> {
+        let mut mechanism = VendorDefinedMechanism::new(
+            MechanismType::new_vendor_defined(mechanism.try_into()?)?,
+            Some(params),
+        );
+        let mut template = template.into().map(|template: &[Attribute]| {
+            template
+                .iter()
+                .map(|attr| attr.into())
+                .collect::<Vec<CK_ATTRIBUTE>>()
+        });
+        let (template_ptr, template_len) = template
+            .as_mut()
+            .map(|template| (template.as_mut_ptr(), template.len()))
+            .unwrap_or((std::ptr::null_mut(), 0));
+
+        unsafe {
+            Rv::from(get_pkcs11!(self.client(), C_DeriveKey)(
+                self.handle(),
+                &mut mechanism.inner as CK_MECHANISM_PTR,
+                base_key.handle(),
+                template_ptr,
+                template_len.try_into()?,
+                std::ptr::null_mut(),
+            ))
+            .into_result(Function::DeriveKey)?;
+        }
+
+        Ok(())
+    }
+
     /// Wrap key
     pub fn wrap_key(
         &self,