diff --git a/build_java.pl b/build_java.pl
index 8baaf829..206878d0 100644
--- a/build_java.pl
+++ b/build_java.pl
@@ -161,9 +161,9 @@ sub setup_vars {
     $jni_header_dir = "$dist_dir/private/jss/_jni";
 
     if( $ENV{DEBIAN_BUILD} ) {
-        $jarFiles = "/usr/share/java/slf4j-api.jar:/usr/share/java/commons-codec.jar";
+        $jarFiles = "/usr/share/java/slf4j-api.jar:/usr/share/java/commons-codec.jar:/usr/share/java/libjaxb-api-java.jar";
     } else {
-        $jarFiles = "/usr/share/java/slf4j/slf4j-api.jar:/usr/share/java/commons-codec.jar";
+        $jarFiles = "/usr/share/java/slf4j/slf4j-api.jar:/usr/share/java/commons-codec.jar:/usr/share/java/jaxb-api.jar";
     }
     $classpath = "-classpath $jarFiles:/usr/share/java/commons-lang.jar";
     if( $jce_jar ) {
@@ -176,6 +176,11 @@ sub setup_vars {
         $javac_deprecation_flag = "";
     }
 
+    if( $ENV{ADD_MODULES} ) {
+        $add_modules_flags = "--add-modules java.se.ee jdk.crypto.cryptoki/sun.security.pkcs11.wrapper jdk.crypto.cryptoki java.xml.bind";
+    } else {
+        $add_modules_flags = "";
+    }
     # retrieve present working directory
     $jss_dir = `pwd`;
     $jss_dir =~ chomp $jss_dir;
@@ -340,18 +345,26 @@ MyLabel
     #
     if( scalar(@source_list) > 0 ) {
         ensure_dir_exists($class_dir);
-        print_do("$javac $javac_opt_flag $javac_deprecation_flag -sourcepath . -d $class_dir " .
+        ensure_dir_exists($jni_header_dir);
+        print_do("$javac $javac_opt_flag $add_modules_flag $javac_deprecation_flag -sourcepath . -d $class_dir -h $jni_header_dir " .
             "$classpath " . join(" ",@source_list));
         print_do("sh -c 'cd $dist_dir/classes && $jar cvmf $dist_dir/MANIFEST.MF $dist_dir/xpclass.jar *'");
         print "Exit status was " . ($?>>8) . "\n";
     }
+# I need for the gcc command to find the jni
+# header files. Looking at tpescript.build
+# the following is missing:
+#    -I../../../../../dist/Linux4.18_x86_64_glibc_PTH_64_DBG.OBJ/private/jss/_jni
+# which I see one like this in the unpatched build for f28.
+# How do I achieve this?
+#
 
     #
     # create the JNI header files
     #
-    ensure_dir_exists($jni_header_dir);
-    print_do("$javah -classpath $class_dir -d $jni_header_dir " .
-        (join " ", @javah_classes) );
+#    ensure_dir_exists($jni_header_dir);
+#    print_do("$javah -classpath $class_dir -d $jni_header_dir " .
+#        (join " ", @javah_classes) );
 }
 
 sub print_do {
diff --git a/coreconf/Linux.mk b/coreconf/Linux.mk
index 66d81890..fb6d05a6 100644
--- a/coreconf/Linux.mk
+++ b/coreconf/Linux.mk
@@ -127,7 +127,7 @@ endif
 # Place -ansi and *_SOURCE before $(DSO_CFLAGS) so DSO_CFLAGS can override
 # -ansi on platforms like Android where the system headers are C99 and do
 # not build with -ansi.
-STANDARDS_CFLAGS	= -D_POSIX_SOURCE -D_BSD_SOURCE -D_XOPEN_SOURCE
+STANDARDS_CFLAGS	= -D_POSIX_SOURCE -D_DEFAULT_SOURCE -D_XOPEN_SOURCE
 OS_CFLAGS		= $(STANDARDS_CFLAGS) $(DSO_CFLAGS) $(OS_REL_CFLAGS) $(ARCHFLAG) -Wall -Werror-implicit-function-declaration -Wno-switch -pipe -DLINUX -Dlinux -DHAVE_STRERROR
 OS_LIBS			= $(OS_PTHREAD) -ldl -lc
 
diff --git a/coreconf/nsinstall/pathsub.c b/coreconf/nsinstall/pathsub.c
index 9afb7a2b..77137783 100644
--- a/coreconf/nsinstall/pathsub.c
+++ b/coreconf/nsinstall/pathsub.c
@@ -214,7 +214,7 @@ reversepath(char *inpath, char *name, int len, char *outpath)
 	    xchdir("..");
 	} else {
 	    cp -= 3;
-	    strncpy(cp, "../", 3);
+	    memcpy(cp, "../", 3);
 	    xchdir(buf);
 	}
     }
@@ -240,14 +240,12 @@ diagnosePath(const char * path)
 	if (rv < 0) {
 	    perror(myPath);
 	} else if (S_ISLNK(sb.st_mode)) {
-	    rv = readlink(myPath, buf, sizeof buf);
+	    rv = readlink(myPath, buf, sizeof(buf) - 1);
 	    if (rv < 0) {
 	    	perror("readlink");
-	    	buf[0] = 0;
-	    } else if ( rv < BUFSIZ ) {
-	    	buf[rv] = 0;
+		buf[0] = 0;
 	    } else {
-	    	buf[BUFSIZ-1] = 0;
+	    	buf[rv] = 0;
 	    }
 	    fprintf(stderr, "%s is a link to %s\n", myPath, buf);
 	} else if (S_ISDIR(sb.st_mode)) {
diff --git a/org/mozilla/jss/CryptoManager.java b/org/mozilla/jss/CryptoManager.java
index 5dd6cfbc..3c7edb35 100644
--- a/org/mozilla/jss/CryptoManager.java
+++ b/org/mozilla/jss/CryptoManager.java
@@ -1082,6 +1082,7 @@ public final class CryptoManager implements TokenSupplier
      *      with the given nickname.
      * @deprecated Use verifyCertificate() instead
      */
+    @Deprecated
     public boolean isCertValid(String nickname, boolean checkSig,
             CertificateUsage certificateUsage)
         throws ObjectNotFoundException, InvalidNicknameException
diff --git a/org/mozilla/jss/crypto/Algorithm.java b/org/mozilla/jss/crypto/Algorithm.java
index 32730c5b..07c9cdbd 100644
--- a/org/mozilla/jss/crypto/Algorithm.java
+++ b/org/mozilla/jss/crypto/Algorithm.java
@@ -84,6 +84,7 @@ public class Algorithm {
      * @return Parameter type.
      * @deprecated Call <tt>getParameterClasses()</tt> instead.
      */
+    @Deprecated
     public Class<?> getParameterClass() {
         if( parameterClasses.length == 0) {
             return null;
diff --git a/org/mozilla/jss/crypto/BadPaddingException.java b/org/mozilla/jss/crypto/BadPaddingException.java
index 90b0f1ce..b8d8a79b 100644
--- a/org/mozilla/jss/crypto/BadPaddingException.java
+++ b/org/mozilla/jss/crypto/BadPaddingException.java
@@ -6,6 +6,7 @@ package org.mozilla.jss.crypto;
 /**
  * @deprecated Use javax.crypto.BadPaddingException.
  */
+@Deprecated
 public class BadPaddingException extends javax.crypto.BadPaddingException {
     private static final long serialVersionUID = 1L;
     public BadPaddingException() {
diff --git a/org/mozilla/jss/crypto/EncryptionAlgorithm.java b/org/mozilla/jss/crypto/EncryptionAlgorithm.java
index 1b80dd55..cac3cfdb 100644
--- a/org/mozilla/jss/crypto/EncryptionAlgorithm.java
+++ b/org/mozilla/jss/crypto/EncryptionAlgorithm.java
@@ -226,6 +226,7 @@ public class EncryptionAlgorithm extends Algorithm {
      *  don't contain key length, which is necessary to distinguish between
      *  AES algorithms.
      */
+    @Deprecated
     public static EncryptionAlgorithm fromString(String name)
         throws NoSuchAlgorithmException
     {
@@ -276,6 +277,7 @@ public class EncryptionAlgorithm extends Algorithm {
      * @return <code>true</code> if this algorithm performs padding.
      * @deprecated Call <tt>getPaddingType()</tt> instead.
      */
+    @Deprecated
     public boolean isPadded() {
         return ! Padding.NONE.equals(padding);
     }
diff --git a/org/mozilla/jss/crypto/PrivateKey.java b/org/mozilla/jss/crypto/PrivateKey.java
index 7aff37ee..f9b21e41 100644
--- a/org/mozilla/jss/crypto/PrivateKey.java
+++ b/org/mozilla/jss/crypto/PrivateKey.java
@@ -37,6 +37,7 @@ public interface PrivateKey extends java.security.PrivateKey
      *      another way, such as a function that directly matches a cert and
      *      key.
      */
+    @Deprecated
     public byte[] getUniqueID() throws TokenException;
 
     /**
diff --git a/org/mozilla/jss/crypto/SymmetricKeyDeriver.java b/org/mozilla/jss/crypto/SymmetricKeyDeriver.java
index 4468a062..80a58350 100644
--- a/org/mozilla/jss/crypto/SymmetricKeyDeriver.java
+++ b/org/mozilla/jss/crypto/SymmetricKeyDeriver.java
@@ -37,6 +37,7 @@
 package org.mozilla.jss.crypto;
 
 import java.security.InvalidKeyException;
+import org.mozilla.jss.pkcs11.PKCS11Constants;
 
 public interface SymmetricKeyDeriver {
 
diff --git a/org/mozilla/jss/crypto/TokenCertificate.java b/org/mozilla/jss/crypto/TokenCertificate.java
index 59763381..e64a9ef0 100644
--- a/org/mozilla/jss/crypto/TokenCertificate.java
+++ b/org/mozilla/jss/crypto/TokenCertificate.java
@@ -22,6 +22,7 @@ public interface TokenCertificate extends X509Certificate {
      *      another way, such as a function that directly matches a cert and
      *      key.
      */
+    @Deprecated
     public abstract byte[] getUniqueID();
 
     /**
diff --git a/org/mozilla/jss/netscape/security/acl/AclEntryImpl.java b/org/mozilla/jss/netscape/security/acl/AclEntryImpl.java
index bf7eed49..762e0352 100644
--- a/org/mozilla/jss/netscape/security/acl/AclEntryImpl.java
+++ b/org/mozilla/jss/netscape/security/acl/AclEntryImpl.java
@@ -138,7 +138,10 @@ public class AclEntryImpl implements AclEntry {
 
     /**
      * Return a string representation of the contents of the ACL entry.
+     *
+     * @deprecated Group and Permission in java.security.acl have been deprecated and marked for removal
      */
+    @Deprecated
     public String toString() {
         StringBuffer s = new StringBuffer();
         if (negative)
@@ -152,7 +155,7 @@ public class AclEntryImpl implements AclEntry {
         s.append(user + "=");
         Enumeration<Permission> e = permissions();
         while (e.hasMoreElements()) {
-            Permission p = e.nextElement();
+            @Deprecated Permission p = e.nextElement();
             s.append(p);
             if (e.hasMoreElements())
                 s.append(",");
diff --git a/org/mozilla/jss/netscape/security/acl/AclImpl.java b/org/mozilla/jss/netscape/security/acl/AclImpl.java
index c5c82aa5..64c37aa6 100644
--- a/org/mozilla/jss/netscape/security/acl/AclImpl.java
+++ b/org/mozilla/jss/netscape/security/acl/AclImpl.java
@@ -32,7 +32,11 @@ import java.util.Vector;
  * An Access Control List (ACL) is encapsulated by this class.
  *
  * @author Satish Dharmaraj
+ *
+ * @deprecated Owner in java.security.acl has been deprecated and marked for removal
+ *
  */
+@Deprecated
 public class AclImpl extends OwnerImpl implements Acl {
     //
     // Maintain four tables. one each for positive and negative
@@ -165,7 +169,9 @@ public class AclImpl extends OwnerImpl implements Acl {
      *
      * @param user the principal for which the ACL entry is returned.
      * @return The resulting permission set that the principal is allowed.
+     * @deprecated Permission in java.security.acl has been deprecated and marked for removal
      */
+    @Deprecated
     public synchronized Enumeration<Permission> getPermissions(Principal user) {
 
         Enumeration<Permission> individualPositive;
@@ -313,6 +319,10 @@ public class AclImpl extends OwnerImpl implements Acl {
         return v.elements();
     }
 
+    /**
+     * @deprecated Permission in java.security.acl has been deprecated and marked for removal
+     */
+    @Deprecated
     private Enumeration<Permission> getGroupPositive(Principal user) {
         Enumeration<Permission> groupPositive = zeroSet.elements();
         Enumeration<Principal> e = allowedGroupsTable.keys();
@@ -326,6 +336,10 @@ public class AclImpl extends OwnerImpl implements Acl {
         return groupPositive;
     }
 
+    /**
+     * @deprecated Permission in java.security.acl has been deprecated and marked for removal
+     */
+    @Deprecated
     private Enumeration<Permission> getGroupNegative(Principal user) {
         Enumeration<Permission> groupNegative = zeroSet.elements();
         Enumeration<Principal> e = deniedGroupsTable.keys();
@@ -339,6 +353,10 @@ public class AclImpl extends OwnerImpl implements Acl {
         return groupNegative;
     }
 
+    /**
+     * @deprecated Permission in java.security.acl has been deprecated and marked for removal
+     */
+    @Deprecated
     private Enumeration<Permission> getIndividualPositive(Principal user) {
         Enumeration<Permission> individualPositive = zeroSet.elements();
         AclEntry ae = allowedUsersTable.get(user);
@@ -347,6 +365,10 @@ public class AclImpl extends OwnerImpl implements Acl {
         return individualPositive;
     }
 
+    /**
+     * @deprecated Permission in java.security.acl has been deprecated and marked for removal
+     */
+    @Deprecated
     private Enumeration<Permission> getIndividualNegative(Principal user) {
         Enumeration<Permission> individualNegative = zeroSet.elements();
         AclEntry ae = deniedUsersTable.get(user);
@@ -356,10 +378,21 @@ public class AclImpl extends OwnerImpl implements Acl {
     }
 }
 
+/**
+ *
+ * @deprecated Acl in java.security.acl has been deprecated and marked for removal
+ * @deprecated AclEntry in java.security.acl has been deprecated and marked for removal
+ */
+@Deprecated
 final class AclEnumerator implements Enumeration<AclEntry> {
-    Acl acl;
+    @Deprecated Acl acl;
     Enumeration<AclEntry> u1, u2, g1, g2;
 
+    /**
+     * @deprecated AclEntry in java.security.acl has been deprecated and marked for removal
+     * @deprecated Acl in java.security.acl has been deprecated and marked for removal
+     */
+    @Deprecated
     AclEnumerator(Acl acl, Hashtable<Principal, AclEntry> u1, Hashtable<Principal, AclEntry> g1,
             Hashtable<Principal, AclEntry> u2, Hashtable<Principal, AclEntry> g2) {
         this.acl = acl;
diff --git a/org/mozilla/jss/netscape/security/acl/GroupImpl.java b/org/mozilla/jss/netscape/security/acl/GroupImpl.java
index f602c3fd..4387d0a5 100644
--- a/org/mozilla/jss/netscape/security/acl/GroupImpl.java
+++ b/org/mozilla/jss/netscape/security/acl/GroupImpl.java
@@ -26,7 +26,9 @@ import java.util.Vector;
  * This class implements a group of principals.
  *
  * @author Satish Dharmaraj
+ * @deprecated Group in java.security.acl has been deprecated and marked for removal
  */
+@Deprecated
 public class GroupImpl implements Group {
     private Vector<Principal> groupMembers = new Vector<Principal>(50, 100);
     private String group;
@@ -107,7 +109,9 @@ public class GroupImpl implements Group {
      * @param member The principal whose membership must be checked for.
      * @return true if the principal is a member of this group,
      *         false otherwise
+     * @deprecated Group in java.security.acl has been deprecated and marked for removal
      */
+    @Deprecated
     public boolean isMember(Principal member) {
 
         //
@@ -136,6 +140,10 @@ public class GroupImpl implements Group {
     // a vector of already seen groups. Only new groups are considered,
     // thereby avoiding loops.
     //
+    /**
+     * @deprecated Group in java.security.acl has been deprecated and marked for removal
+     */
+    @Deprecated
     boolean isMemberRecurse(Principal member, Vector<Group> alreadySeen) {
         Enumeration<Principal> e = members();
         while (e.hasMoreElements()) {
@@ -155,12 +163,12 @@ public class GroupImpl implements Group {
                 // case rather than clutter the interface by forcing the
                 // implementation of this method.)
                 //
-                GroupImpl g = (GroupImpl) p;
+                @Deprecated GroupImpl g = (GroupImpl) p;
                 alreadySeen.addElement(this);
                 if (!alreadySeen.contains(g))
                     mem = g.isMemberRecurse(member, alreadySeen);
             } else if (p instanceof Group) {
-                Group g = (Group) p;
+                @Deprecated Group g = (Group) p;
                 if (!alreadySeen.contains(g))
                     mem = g.isMember(member);
             }
diff --git a/org/mozilla/jss/netscape/security/acl/OwnerImpl.java b/org/mozilla/jss/netscape/security/acl/OwnerImpl.java
index 11055837..6548951c 100644
--- a/org/mozilla/jss/netscape/security/acl/OwnerImpl.java
+++ b/org/mozilla/jss/netscape/security/acl/OwnerImpl.java
@@ -30,9 +30,11 @@ import java.util.Enumeration;
  * part of the constructor.
  *
  * @author Satish Dharmaraj
+ * @deprecated Owner in java.security.acl has been deprecated and marked for removal
  */
+@Deprecated
 public class OwnerImpl implements Owner {
-    private Group ownerGroup;
+    @Deprecated private Group ownerGroup;
 
     public OwnerImpl(Principal owner) {
         ownerGroup = new GroupImpl("AclOwners");
@@ -51,7 +53,9 @@ public class OwnerImpl implements Owner {
      * @return true if success, false if already an owner.
      * @exception NotOwnerException if the caller principal is not on
      *                the owners list of the Acl.
+     * @deprecated LastOwnerException in java.security.acl has been deprecated and marked for removal
      */
+    @Deprecated
     public synchronized boolean addOwner(Principal caller, Principal owner)
             throws NotOwnerException {
         if (!isOwner(caller))
@@ -75,7 +79,9 @@ public class OwnerImpl implements Owner {
      *                the owners list of the Acl.
      * @exception LastOwnerException if there is only one owner left in the group, then
      *                deleteOwner would leave the ACL owner-less. This exception is raised in such a case.
+     * @deprecated LastOwnerException in java.security.acl has been deprecated and marked for removal
      */
+    @Deprecated
     public synchronized boolean deleteOwner(Principal caller, Principal owner)
             throws NotOwnerException, LastOwnerException {
         if (!isOwner(caller))
@@ -89,8 +95,7 @@ public class OwnerImpl implements Owner {
         if (e.hasMoreElements())
             return ownerGroup.removeMember(owner);
         else
-            throw new LastOwnerException();
-
+           throw new LastOwnerException();
     }
 
     /**
diff --git a/org/mozilla/jss/netscape/security/provider/DSA.java b/org/mozilla/jss/netscape/security/provider/DSA.java
index e7f155ea..403f2ef9 100644
--- a/org/mozilla/jss/netscape/security/provider/DSA.java
+++ b/org/mozilla/jss/netscape/security/provider/DSA.java
@@ -437,6 +437,7 @@ public final class DSA extends Signature {
      *
      * @deprecated
      */
+    @Deprecated
     protected void engineSetParameter(String key, Object param) {
 
         if (key.equals("KSEED")) {
@@ -469,8 +470,6 @@ public final class DSA extends Signature {
      * </dl>
      *
      * @return the value of the requested parameter.
-     *
-     * @deprecated
      */
     protected Object engineGetParameter(String key) {
         if (key.equals("KSEED")) {
diff --git a/org/mozilla/jss/netscape/security/x509/AlgorithmId.java b/org/mozilla/jss/netscape/security/x509/AlgorithmId.java
index 5ea7f5e5..f97c63e9 100644
--- a/org/mozilla/jss/netscape/security/x509/AlgorithmId.java
+++ b/org/mozilla/jss/netscape/security/x509/AlgorithmId.java
@@ -190,6 +190,7 @@ public class AlgorithmId implements Serializable, DerEncoder {
      *
      * @deprecated use one of the other constructors.
      */
+    @Deprecated
     public AlgorithmId() {
     }
 
diff --git a/org/mozilla/jss/netscape/security/x509/CertAndKeyGen.java b/org/mozilla/jss/netscape/security/x509/CertAndKeyGen.java
index 626bb796..aca271ff 100644
--- a/org/mozilla/jss/netscape/security/x509/CertAndKeyGen.java
+++ b/org/mozilla/jss/netscape/security/x509/CertAndKeyGen.java
@@ -86,6 +86,7 @@ public final class CertAndKeyGen {
      *
      * @deprecated All random numbers come from PKCS #11 now.
      */
+    @Deprecated
     public void setRandom(SecureRandom generator) {
     }
 
@@ -166,6 +167,7 @@ public final class CertAndKeyGen {
      * @param myname X.500 name of the subject (who is also the issuer)
      * @param validity how long the certificate should be valid, in seconds
      */
+    @Deprecated
     public X509Cert getSelfCert(X500Name myname, long validity)
             throws InvalidKeyException, SignatureException, NoSuchAlgorithmException {
         X509Certificate cert;
diff --git a/org/mozilla/jss/netscape/security/x509/X509Cert.java b/org/mozilla/jss/netscape/security/x509/X509Cert.java
index c3f51492..60f1d3a6 100644
--- a/org/mozilla/jss/netscape/security/x509/X509Cert.java
+++ b/org/mozilla/jss/netscape/security/x509/X509Cert.java
@@ -46,6 +46,7 @@ import org.mozilla.jss.netscape.security.util.DerValue;
  * @deprecated Use the new X509Certificate class.
  *             This class is only restored for backwards compatibility.
  */
+@Deprecated
 public class X509Cert implements Certificate, Serializable {
 
     /**
diff --git a/org/mozilla/jss/pkcs11/KeyType.java b/org/mozilla/jss/pkcs11/KeyType.java
index 31fb4957..19ba3d0f 100644
--- a/org/mozilla/jss/pkcs11/KeyType.java
+++ b/org/mozilla/jss/pkcs11/KeyType.java
@@ -151,6 +151,7 @@ public final class KeyType {
      * @deprecated As of NSS 3.11, FORTEZZA is no longer supported.
      * This is just a placeholder for backward compatibility.
      */
+    @Deprecated
     static public final KeyType
     FORTEZZA = new KeyType(new Algorithm[0], "FORTEZZA");
 
diff --git a/org/mozilla/jss/pkcs11/PK11PubKey.java b/org/mozilla/jss/pkcs11/PK11PubKey.java
index 39e24120..9d82011d 100644
--- a/org/mozilla/jss/pkcs11/PK11PubKey.java
+++ b/org/mozilla/jss/pkcs11/PK11PubKey.java
@@ -45,6 +45,7 @@ public class PK11PubKey extends org.mozilla.jss.pkcs11.PK11Key
      *      fromSPKI() instead.
      * @see #fromSPKI(byte[])
      */
+    @Deprecated
     public static PK11PubKey fromRaw(PrivateKey.Type type, byte[] rawKey)
         throws InvalidKeyFormatException
     {
diff --git a/org/mozilla/jss/pkcs11/PKCS11Constants.java b/org/mozilla/jss/pkcs11/PKCS11Constants.java
new file mode 100644
index 00000000..4c3016f3
--- /dev/null
+++ b/org/mozilla/jss/pkcs11/PKCS11Constants.java
@@ -0,0 +1,974 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.jss.pkcs11;
+
+/* 
+ * Copied from package sun.security.pkcs11.wrapper;
+ */
+/*
+ * Copyright (c) 2003, 2011, Oracle and/or its affiliates. All rights reserved.
+ */
+
+/* Copyright  (c) 2002 Graz University of Technology. All rights reserved.
+ *
+ * Redistribution and use in  source and binary forms, with or without
+ * modification, are permitted  provided that the following conditions are met:
+ *
+ * 1. Redistributions of  source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in  binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * 3. The end-user documentation included with the redistribution, if any, must
+ *    include the following acknowledgment:
+ *
+ *    "This product includes software developed by IAIK of Graz University of
+ *     Technology."
+ *
+ *    Alternately, this acknowledgment may appear in the software itself, if
+ *    and wherever such third-party acknowledgments normally appear.
+ *
+ * 4. The names "Graz University of Technology" and "IAIK of Graz University of
+ *    Technology" must not be used to endorse or promote products derived from
+ *    this software without prior written permission.
+ *
+ * 5. Products derived from this software may not be called
+ *    "IAIK PKCS Wrapper", nor may "IAIK" appear in their name, without prior
+ *    written permission of Graz University of Technology.
+ *
+ *  THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESSED OR IMPLIED
+ *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ *  WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ *  PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE LICENSOR BE
+ *  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ *  OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ *  PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
+ *  OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ *  ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ *  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ *  OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ *  POSSIBILITY  OF SUCH DAMAGE.
+ */
+
+/**
+ * This interface holds constants of the PKCS#11 v2.11 standard.
+ * This is mainly the content of the 'pkcs11t.h' header file.
+ *
+ * Mapping of primitiv data types to Java types:
+ * <pre>
+ *   TRUE .......................................... true
+ *   FALSE ......................................... false
+ *   CK_BYTE ....................................... byte
+ *   CK_CHAR ....................................... char
+ *   CK_UTF8CHAR ................................... char
+ *   CK_BBOOL ...................................... boolean
+ *   CK_ULONG ...................................... long
+ *   CK_LONG ....................................... long
+ *   CK_FLAGS ...................................... long
+ *   CK_NOTIFICATION ............................... long
+ *   CK_SLOT_ID .................................... long
+ *   CK_SESSION_HANDLE ............................. long
+ *   CK_USER_TYPE .................................. long
+ *   CK_SESSION_HANDLE ............................. long
+ *   CK_STATE ...................................... long
+ *   CK_OBJECT_HANDLE .............................. long
+ *   CK_OBJECT_CLASS ............................... long
+ *   CK_HW_FEATURE_TYPE ............................ long
+ *   CK_KEY_TYPE ................................... long
+ *   CK_CERTIFICATE_TYPE ........................... long
+ *   CK_ATTRIBUTE_TYPE ............................. long
+ *   CK_VOID_PTR ................................... Object[]
+ *   CK_BYTE_PTR ................................... byte[]
+ *   CK_CHAR_PTR ................................... char[]
+ *   CK_UTF8CHAR_PTR ............................... char[]
+ *   CK_MECHANISM_TYPE ............................. long
+ *   CK_RV ......................................... long
+ *   CK_RSA_PKCS_OAEP_MGF_TYPE ..................... long
+ *   CK_RSA_PKCS_OAEP_SOURCE_TYPE .................. long
+ *   CK_RC2_PARAMS ................................. long
+ *   CK_MAC_GENERAL_PARAMS ......................... long
+ *   CK_EXTRACT_PARAMS ............................. long
+ *   CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE .... long
+ *   CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE .............. long
+ *   CK_EC_KDF_TYPE ................................ long
+ *   CK_X9_42_DH_KDF_TYPE .......................... long
+ * </pre>
+ *
+ * @author <a href="mailto:Karl.Scheibelhofer@iaik.at"> Karl Scheibelhofer </a>
+ * @invariants
+ */
+public interface PKCS11Constants {
+
+    public static final boolean TRUE = true;
+
+    public static final boolean FALSE = false;
+
+    public static final Object NULL_PTR = null;
+
+    /* some special values for certain CK_ULONG variables */
+
+    // Cryptoki defines CK_UNAVAILABLE_INFORMATION as (~0UL)
+    // This means it is 0xffffffff in ILP32/LLP64 but 0xffffffffffffffff in LP64.
+    // To avoid these differences on the Java side, the native code treats
+    // CK_UNAVAILABLE_INFORMATION specially and always returns (long)-1 for it.
+    // See ckULongSpecialToJLong() in pkcs11wrapper.h
+    public static final long CK_UNAVAILABLE_INFORMATION = -1;
+    public static final long CK_EFFECTIVELY_INFINITE = 0L;
+
+    /* The following value is always invalid if used as a session */
+    /* handle or object handle */
+    public static final long CK_INVALID_HANDLE = 0L;
+
+    /* CK_NOTIFICATION enumerates the types of notifications that
+     * Cryptoki provides to an application */
+    /* CK_NOTIFICATION has been changed from an enum to a CK_ULONG
+     * for v2.0 */
+    public static final long CKN_SURRENDER = 0L;
+
+    /* flags: bit flags that provide capabilities of the slot
+     *      Bit Flag              Mask        Meaning
+     */
+    public static final long CKF_TOKEN_PRESENT = 0x00000001L;
+    public static final long CKF_REMOVABLE_DEVICE = 0x00000002L;
+    public static final long CKF_HW_SLOT = 0x00000004L;
+
+    /* The flags parameter is defined as follows:
+     *      Bit Flag                    Mask        Meaning
+     */
+    /* has random # generator */
+    public static final long  CKF_RNG                     = 0x00000001L;
+
+    /* token is write-protected */
+    public static final long  CKF_WRITE_PROTECTED         = 0x00000002L;
+
+    /* user must login */
+    public static final long  CKF_LOGIN_REQUIRED          = 0x00000004L;
+
+    /* normal user's PIN is set */
+    public static final long  CKF_USER_PIN_INITIALIZED    = 0x00000008L;
+
+    /* CKF_RESTORE_KEY_NOT_NEEDED is new for v2.0.  If it is set,
+     * that means that *every* time the state of cryptographic
+     * operations of a session is successfully saved, all keys
+     * needed to continue those operations are stored in the state */
+    public static final long  CKF_RESTORE_KEY_NOT_NEEDED  = 0x00000020L;
+
+    /* CKF_CLOCK_ON_TOKEN is new for v2.0.  If it is set, that means
+     * that the token has some sort of clock.  The time on that
+     * clock is returned in the token info structure */
+    public static final long  CKF_CLOCK_ON_TOKEN          = 0x00000040L;
+
+    /* CKF_PROTECTED_AUTHENTICATION_PATH is new for v2.0.  If it is
+     * set, that means that there is some way for the user to login
+     * without sending a PIN through the Cryptoki library itself */
+    public static final long  CKF_PROTECTED_AUTHENTICATION_PATH = 0x00000100L;
+
+    /* CKF_DUAL_CRYPTO_OPERATIONS is new for v2.0.  If it is true,
+     * that means that a single session with the token can perform
+     * dual simultaneous cryptographic operations (digest and
+     * encrypt; decrypt and digest; sign and encrypt; and decrypt
+     * and sign) */
+    public static final long  CKF_DUAL_CRYPTO_OPERATIONS  = 0x00000200L;
+
+    /* CKF_TOKEN_INITIALIZED if new for v2.10. If it is true, the
+     * token has been initialized using C_InitializeToken or an
+     * equivalent mechanism outside the scope of PKCS #11.
+     * Calling C_InitializeToken when this flag is set will cause
+     * the token to be reinitialized. */
+    public static final long  CKF_TOKEN_INITIALIZED       = 0x00000400L;
+
+    /* CKF_SECONDARY_AUTHENTICATION if new for v2.10. If it is
+     * true, the token supports secondary authentication for
+     * private key objects. */
+    public static final long  CKF_SECONDARY_AUTHENTICATION  = 0x00000800L;
+
+    /* CKF_USER_PIN_COUNT_LOW if new for v2.10. If it is true, an
+     * incorrect user login PIN has been entered at least once
+     * since the last successful authentication. */
+    public static final long  CKF_USER_PIN_COUNT_LOW       = 0x00010000L;
+
+    /* CKF_USER_PIN_FINAL_TRY if new for v2.10. If it is true,
+     * supplying an incorrect user PIN will it to become locked. */
+    public static final long  CKF_USER_PIN_FINAL_TRY       = 0x00020000L;
+
+    /* CKF_USER_PIN_LOCKED if new for v2.10. If it is true, the
+     * user PIN has been locked. User login to the token is not
+     * possible. */
+    public static final long  CKF_USER_PIN_LOCKED          = 0x00040000L;
+
+    /* CKF_USER_PIN_TO_BE_CHANGED if new for v2.10. If it is true,
+     * the user PIN value is the default value set by token
+     * initialization or manufacturing. */
+    public static final long  CKF_USER_PIN_TO_BE_CHANGED   = 0x00080000L;
+
+    /* CKF_SO_PIN_COUNT_LOW if new for v2.10. If it is true, an
+     * incorrect SO login PIN has been entered at least once since
+     * the last successful authentication. */
+    public static final long  CKF_SO_PIN_COUNT_LOW         = 0x00100000L;
+
+    /* CKF_SO_PIN_FINAL_TRY if new for v2.10. If it is true,
+     * supplying an incorrect SO PIN will it to become locked. */
+    public static final long  CKF_SO_PIN_FINAL_TRY         = 0x00200000L;
+
+    /* CKF_SO_PIN_LOCKED if new for v2.10. If it is true, the SO
+     * PIN has been locked. SO login to the token is not possible.
+     */
+    public static final long  CKF_SO_PIN_LOCKED            = 0x00400000L;
+
+    /* CKF_SO_PIN_TO_BE_CHANGED if new for v2.10. If it is true,
+     * the SO PIN value is the default value set by token
+     * initialization or manufacturing. */
+    public static final long  CKF_SO_PIN_TO_BE_CHANGED     = 0x00800000L;
+
+
+    /* CK_USER_TYPE enumerates the types of Cryptoki users */
+    /* CK_USER_TYPE has been changed from an enum to a CK_ULONG for
+     * v2.0 */
+    /* Security Officer */
+    public static final long CKU_SO = 0L;
+    /* Normal user */
+    public static final long CKU_USER = 1L;
+
+    /* CK_STATE enumerates the session states */
+    /* CK_STATE has been changed from an enum to a CK_ULONG for
+     * v2.0 */
+    public static final long  CKS_RO_PUBLIC_SESSION = 0L;
+    public static final long  CKS_RO_USER_FUNCTIONS = 1L;
+    public static final long  CKS_RW_PUBLIC_SESSION = 2L;
+    public static final long  CKS_RW_USER_FUNCTIONS = 3L;
+    public static final long  CKS_RW_SO_FUNCTIONS   = 4L;
+
+
+    /* The flags are defined in the following table:
+     *      Bit Flag                Mask        Meaning
+     */
+    /* session is r/w */
+    public static final long  CKF_RW_SESSION        = 0x00000002L;
+    /* no parallel */
+    public static final long  CKF_SERIAL_SESSION    = 0x00000004L;
+
+
+    /* The following classes of objects are defined: */
+    /* CKO_HW_FEATURE is new for v2.10 */
+    /* CKO_DOMAIN_PARAMETERS is new for v2.11 */
+    public static final long  CKO_DATA              = 0x00000000L;
+    public static final long  CKO_CERTIFICATE       = 0x00000001L;
+    public static final long  CKO_PUBLIC_KEY        = 0x00000002L;
+    public static final long  CKO_PRIVATE_KEY       = 0x00000003L;
+    public static final long  CKO_SECRET_KEY        = 0x00000004L;
+    public static final long  CKO_HW_FEATURE        = 0x00000005L;
+    public static final long  CKO_DOMAIN_PARAMETERS = 0x00000006L;
+    public static final long  CKO_VENDOR_DEFINED    = 0x80000000L;
+
+    // pseudo object class ANY (for template manager)
+    public static final long  PCKO_ANY              = 0x7FFFFF23L;
+
+
+    /* The following hardware feature types are defined */
+    public static final long  CKH_MONOTONIC_COUNTER = 0x00000001L;
+    public static final long  CKH_CLOCK             = 0x00000002L;
+    public static final long  CKH_VENDOR_DEFINED    = 0x80000000L;
+
+    /* the following key types are defined: */
+    public static final long  CKK_RSA             = 0x00000000L;
+    public static final long  CKK_DSA             = 0x00000001L;
+    public static final long  CKK_DH              = 0x00000002L;
+
+    /* CKK_ECDSA and CKK_KEA are new for v2.0 */
+    /* CKK_ECDSA is deprecated in v2.11, CKK_EC is preferred. */
+    public static final long  CKK_ECDSA           = 0x00000003L;
+    public static final long  CKK_EC              = 0x00000003L;
+    public static final long  CKK_X9_42_DH        = 0x00000004L;
+    public static final long  CKK_KEA             = 0x00000005L;
+
+    public static final long  CKK_GENERIC_SECRET  = 0x00000010L;
+    public static final long  CKK_RC2             = 0x00000011L;
+    public static final long  CKK_RC4             = 0x00000012L;
+    public static final long  CKK_DES             = 0x00000013L;
+    public static final long  CKK_DES2            = 0x00000014L;
+    public static final long  CKK_DES3            = 0x00000015L;
+
+    /* all these key types are new for v2.0 */
+    public static final long  CKK_CAST            = 0x00000016L;
+    public static final long  CKK_CAST3           = 0x00000017L;
+    /* CKK_CAST5 is deprecated in v2.11, CKK_CAST128 is preferred. */
+    public static final long  CKK_CAST5           = 0x00000018L;
+    /* CAST128=CAST5 */
+    public static final long  CKK_CAST128         = 0x00000018L;
+    public static final long  CKK_RC5             = 0x00000019L;
+    public static final long  CKK_IDEA            = 0x0000001AL;
+    public static final long  CKK_SKIPJACK        = 0x0000001BL;
+    public static final long  CKK_BATON           = 0x0000001CL;
+    public static final long  CKK_JUNIPER         = 0x0000001DL;
+    public static final long  CKK_CDMF            = 0x0000001EL;
+    public static final long  CKK_AES             = 0x0000001FL;
+    // v2.20
+    public static final long  CKK_BLOWFISH        = 0x00000020L;
+
+    public static final long  CKK_VENDOR_DEFINED  = 0x80000000L;
+
+    // new for v2.20 amendment 3
+    //public static final long  CKK_CAMELLIA          = 0x00000025L;
+    //public static final long  CKK_ARIA              = 0x00000026L;
+
+    // pseudo key type ANY (for template manager)
+    public static final long  PCKK_ANY            = 0x7FFFFF22L;
+
+    public static final long  PCKK_HMAC            = 0x7FFFFF23L;
+    public static final long  PCKK_SSLMAC          = 0x7FFFFF24L;
+    public static final long  PCKK_TLSPREMASTER    = 0x7FFFFF25L;
+    public static final long  PCKK_TLSRSAPREMASTER = 0x7FFFFF26L;
+    public static final long  PCKK_TLSMASTER       = 0x7FFFFF27L;
+
+    /* The following certificate types are defined: */
+    /* CKC_X_509_ATTR_CERT is new for v2.10 */
+    public static final long  CKC_X_509           = 0x00000000L;
+    public static final long  CKC_X_509_ATTR_CERT = 0x00000001L;
+    public static final long  CKC_VENDOR_DEFINED  = 0x80000000L;
+
+
+    /* The following attribute types are defined: */
+    public static final long  CKA_CLASS              = 0x00000000L;
+    public static final long  CKA_TOKEN              = 0x00000001L;
+    public static final long  CKA_PRIVATE            = 0x00000002L;
+    public static final long  CKA_LABEL              = 0x00000003L;
+    public static final long  CKA_APPLICATION        = 0x00000010L;
+    public static final long  CKA_VALUE              = 0x00000011L;
+
+    /* CKA_OBJECT_ID is new for v2.10 */
+    public static final long  CKA_OBJECT_ID          = 0x00000012L;
+
+    public static final long  CKA_CERTIFICATE_TYPE   = 0x00000080L;
+    public static final long  CKA_ISSUER             = 0x00000081L;
+    public static final long  CKA_SERIAL_NUMBER      = 0x00000082L;
+
+    /* CKA_AC_ISSUER, CKA_OWNER, and CKA_ATTR_TYPES are new L;
+     * for v2.10 */
+    public static final long  CKA_AC_ISSUER          = 0x00000083L;
+    public static final long  CKA_OWNER              = 0x00000084L;
+    public static final long  CKA_ATTR_TYPES         = 0x00000085L;
+
+    /* CKA_TRUSTED is new for v2.11 */
+    public static final long  CKA_TRUSTED            = 0x00000086L;
+
+    public static final long  CKA_KEY_TYPE           = 0x00000100L;
+    public static final long  CKA_SUBJECT            = 0x00000101L;
+    public static final long  CKA_ID                 = 0x00000102L;
+    public static final long  CKA_SENSITIVE          = 0x00000103L;
+    public static final long  CKA_ENCRYPT            = 0x00000104L;
+    public static final long  CKA_DECRYPT            = 0x00000105L;
+    public static final long  CKA_WRAP               = 0x00000106L;
+    public static final long  CKA_UNWRAP             = 0x00000107L;
+    public static final long  CKA_SIGN               = 0x00000108L;
+    public static final long  CKA_SIGN_RECOVER       = 0x00000109L;
+    public static final long  CKA_VERIFY             = 0x0000010AL;
+    public static final long  CKA_VERIFY_RECOVER     = 0x0000010BL;
+    public static final long  CKA_DERIVE             = 0x0000010CL;
+    public static final long  CKA_START_DATE         = 0x00000110L;
+    public static final long  CKA_END_DATE           = 0x00000111L;
+    public static final long  CKA_MODULUS            = 0x00000120L;
+    public static final long  CKA_MODULUS_BITS       = 0x00000121L;
+    public static final long  CKA_PUBLIC_EXPONENT    = 0x00000122L;
+    public static final long  CKA_PRIVATE_EXPONENT   = 0x00000123L;
+    public static final long  CKA_PRIME_1            = 0x00000124L;
+    public static final long  CKA_PRIME_2            = 0x00000125L;
+    public static final long  CKA_EXPONENT_1         = 0x00000126L;
+    public static final long  CKA_EXPONENT_2         = 0x00000127L;
+    public static final long  CKA_COEFFICIENT        = 0x00000128L;
+    public static final long  CKA_PRIME              = 0x00000130L;
+    public static final long  CKA_SUBPRIME           = 0x00000131L;
+    public static final long  CKA_BASE               = 0x00000132L;
+
+    /* CKA_PRIME_BITS and CKA_SUB_PRIME_BITS are new for v2.11 */
+    public static final long  CKA_PRIME_BITS         = 0x00000133L;
+    public static final long  CKA_SUB_PRIME_BITS     = 0x00000134L;
+
+    public static final long  CKA_VALUE_BITS         = 0x00000160L;
+    public static final long  CKA_VALUE_LEN          = 0x00000161L;
+
+    /* CKA_EXTRACTABLE, CKA_LOCAL, CKA_NEVER_EXTRACTABLE,
+     * CKA_ALWAYS_SENSITIVE, CKA_MODIFIABLE, CKA_ECDSA_PARAMS,
+     * and CKA_EC_POINT are new for v2.0 */
+    public static final long  CKA_EXTRACTABLE        = 0x00000162L;
+    public static final long  CKA_LOCAL              = 0x00000163L;
+    public static final long  CKA_NEVER_EXTRACTABLE  = 0x00000164L;
+    public static final long  CKA_ALWAYS_SENSITIVE   = 0x00000165L;
+
+    /* CKA_KEY_GEN_MECHANISM is new for v2.11 */
+    public static final long  CKA_KEY_GEN_MECHANISM  = 0x00000166L;
+
+    public static final long  CKA_MODIFIABLE         = 0x00000170L;
+
+    /* CKA_ECDSA_PARAMS is deprecated in v2.11,
+     * CKA_EC_PARAMS is preferred. */
+    public static final long  CKA_ECDSA_PARAMS       = 0x00000180L;
+    public static final long  CKA_EC_PARAMS          = 0x00000180L;
+    public static final long  CKA_EC_POINT           = 0x00000181L;
+
+    /* CKA_SECONDARY_AUTH, CKA_AUTH_PIN_FLAGS,
+     * CKA_HW_FEATURE_TYPE, CKA_RESET_ON_INIT, and CKA_HAS_RESET
+     * are new for v2.10 */
+    public static final long  CKA_SECONDARY_AUTH     = 0x00000200L;
+    public static final long  CKA_AUTH_PIN_FLAGS     = 0x00000201L;
+    public static final long  CKA_HW_FEATURE_TYPE    = 0x00000300L;
+    public static final long  CKA_RESET_ON_INIT      = 0x00000301L;
+    public static final long  CKA_HAS_RESET          = 0x00000302L;
+
+    public static final long  CKA_VENDOR_DEFINED     = 0x80000000L;
+
+    /* the following mechanism types are defined: */
+    public static final long  CKM_RSA_PKCS_KEY_PAIR_GEN      = 0x00000000L;
+    public static final long  CKM_RSA_PKCS                   = 0x00000001L;
+    public static final long  CKM_RSA_9796                   = 0x00000002L;
+    public static final long  CKM_RSA_X_509                  = 0x00000003L;
+
+    /* CKM_MD2_RSA_PKCS, CKM_MD5_RSA_PKCS, and CKM_SHA1_RSA_PKCS
+     * are new for v2.0.  They are mechanisms which hash and sign */
+    public static final long  CKM_MD2_RSA_PKCS               = 0x00000004L;
+    public static final long  CKM_MD5_RSA_PKCS               = 0x00000005L;
+    public static final long  CKM_SHA1_RSA_PKCS              = 0x00000006L;
+
+    /* CKM_RIPEMD128_RSA_PKCS, CKM_RIPEMD160_RSA_PKCS, and
+     * CKM_RSA_PKCS_OAEP are new for v2.10 */
+    public static final long  CKM_RIPEMD128_RSA_PKCS         = 0x00000007L;
+    public static final long  CKM_RIPEMD160_RSA_PKCS         = 0x00000008L;
+    public static final long  CKM_RSA_PKCS_OAEP              = 0x00000009L;
+
+    /* CKM_RSA_X9_31_KEY_PAIR_GEN, CKM_RSA_X9_31, CKM_SHA1_RSA_X9_31,
+     * CKM_RSA_PKCS_PSS, and CKM_SHA1_RSA_PKCS_PSS are new for v2.11 */
+    public static final long  CKM_RSA_X9_31_KEY_PAIR_GEN     = 0x0000000AL;
+    public static final long  CKM_RSA_X9_31                  = 0x0000000BL;
+    public static final long  CKM_SHA1_RSA_X9_31             = 0x0000000CL;
+    public static final long  CKM_RSA_PKCS_PSS               = 0x0000000DL;
+    public static final long  CKM_SHA1_RSA_PKCS_PSS          = 0x0000000EL;
+
+    public static final long  CKM_DSA_KEY_PAIR_GEN           = 0x00000010L;
+    public static final long  CKM_DSA                        = 0x00000011L;
+    public static final long  CKM_DSA_SHA1                   = 0x00000012L;
+    public static final long  CKM_DH_PKCS_KEY_PAIR_GEN       = 0x00000020L;
+    public static final long  CKM_DH_PKCS_DERIVE             = 0x00000021L;
+
+    /* CKM_X9_42_DH_KEY_PAIR_GEN, CKM_X9_42_DH_DERIVE,
+     * CKM_X9_42_DH_HYBRID_DERIVE, and CKM_X9_42_MQV_DERIVE are new for
+     * v2.11 */
+    public static final long  CKM_X9_42_DH_KEY_PAIR_GEN      = 0x00000030L;
+    public static final long  CKM_X9_42_DH_DERIVE            = 0x00000031L;
+    public static final long  CKM_X9_42_DH_HYBRID_DERIVE     = 0x00000032L;
+    public static final long  CKM_X9_42_MQV_DERIVE           = 0x00000033L;
+
+    // v2.20
+    public static final long  CKM_SHA256_RSA_PKCS            = 0x00000040L;
+    public static final long  CKM_SHA384_RSA_PKCS            = 0x00000041L;
+    public static final long  CKM_SHA512_RSA_PKCS            = 0x00000042L;
+
+    public static final long  CKM_RC2_KEY_GEN                = 0x00000100L;
+    public static final long  CKM_RC2_ECB                    = 0x00000101L;
+    public static final long  CKM_RC2_CBC                    = 0x00000102L;
+    public static final long  CKM_RC2_MAC                    = 0x00000103L;
+
+    /* CKM_RC2_MAC_GENERAL and CKM_RC2_CBC_PAD are new for v2.0 */
+    public static final long  CKM_RC2_MAC_GENERAL            = 0x00000104L;
+    public static final long  CKM_RC2_CBC_PAD                = 0x00000105L;
+
+    public static final long  CKM_RC4_KEY_GEN                = 0x00000110L;
+    public static final long  CKM_RC4                        = 0x00000111L;
+    public static final long  CKM_DES_KEY_GEN                = 0x00000120L;
+    public static final long  CKM_DES_ECB                    = 0x00000121L;
+    public static final long  CKM_DES_CBC                    = 0x00000122L;
+    public static final long  CKM_DES_MAC                    = 0x00000123L;
+
+    /* CKM_DES_MAC_GENERAL and CKM_DES_CBC_PAD are new for v2.0 */
+    public static final long  CKM_DES_MAC_GENERAL            = 0x00000124L;
+    public static final long  CKM_DES_CBC_PAD                = 0x00000125L;
+
+    public static final long  CKM_DES2_KEY_GEN               = 0x00000130L;
+    public static final long  CKM_DES3_KEY_GEN               = 0x00000131L;
+    public static final long  CKM_DES3_ECB                   = 0x00000132L;
+    public static final long  CKM_DES3_CBC                   = 0x00000133L;
+    public static final long  CKM_DES3_MAC                   = 0x00000134L;
+
+    /* CKM_DES3_MAC_GENERAL, CKM_DES3_CBC_PAD, CKM_CDMF_KEY_GEN,
+     * CKM_CDMF_ECB, CKM_CDMF_CBC, CKM_CDMF_MAC,
+     * CKM_CDMF_MAC_GENERAL, and CKM_CDMF_CBC_PAD are new for v2.0 */
+    public static final long  CKM_DES3_MAC_GENERAL           = 0x00000135L;
+    public static final long  CKM_DES3_CBC_PAD               = 0x00000136L;
+    public static final long  CKM_CDMF_KEY_GEN               = 0x00000140L;
+    public static final long  CKM_CDMF_ECB                   = 0x00000141L;
+    public static final long  CKM_CDMF_CBC                   = 0x00000142L;
+    public static final long  CKM_CDMF_MAC                   = 0x00000143L;
+    public static final long  CKM_CDMF_MAC_GENERAL           = 0x00000144L;
+    public static final long  CKM_CDMF_CBC_PAD               = 0x00000145L;
+
+    public static final long  CKM_MD2                        = 0x00000200L;
+
+    /* CKM_MD2_HMAC and CKM_MD2_HMAC_GENERAL are new for v2.0 */
+    public static final long  CKM_MD2_HMAC                   = 0x00000201L;
+    public static final long  CKM_MD2_HMAC_GENERAL           = 0x00000202L;
+
+    public static final long  CKM_MD5                        = 0x00000210L;
+
+    /* CKM_MD5_HMAC and CKM_MD5_HMAC_GENERAL are new for v2.0 */
+    public static final long  CKM_MD5_HMAC                   = 0x00000211L;
+    public static final long  CKM_MD5_HMAC_GENERAL           = 0x00000212L;
+
+    public static final long  CKM_SHA_1                      = 0x00000220L;
+
+    /* CKM_SHA_1_HMAC and CKM_SHA_1_HMAC_GENERAL are new for v2.0 */
+    public static final long  CKM_SHA_1_HMAC                 = 0x00000221L;
+    public static final long  CKM_SHA_1_HMAC_GENERAL         = 0x00000222L;
+
+    /* CKM_RIPEMD128, CKM_RIPEMD128_HMAC,
+     * CKM_RIPEMD128_HMAC_GENERAL, CKM_RIPEMD160, CKM_RIPEMD160_HMAC,
+     * and CKM_RIPEMD160_HMAC_GENERAL are new for v2.10 */
+    public static final long  CKM_RIPEMD128                  = 0x00000230L;
+    public static final long  CKM_RIPEMD128_HMAC             = 0x00000231L;
+    public static final long  CKM_RIPEMD128_HMAC_GENERAL     = 0x00000232L;
+    public static final long  CKM_RIPEMD160                  = 0x00000240L;
+    public static final long  CKM_RIPEMD160_HMAC             = 0x00000241L;
+    public static final long  CKM_RIPEMD160_HMAC_GENERAL     = 0x00000242L;
+
+    // v2.20
+    public static final long  CKM_SHA256                     = 0x00000250L;
+    public static final long  CKM_SHA256_HMAC                = 0x00000251L;
+    public static final long  CKM_SHA256_HMAC_GENERAL        = 0x00000252L;
+
+    public static final long  CKM_SHA384                     = 0x00000260L;
+    public static final long  CKM_SHA384_HMAC                = 0x00000261L;
+    public static final long  CKM_SHA384_HMAC_GENERAL        = 0x00000262L;
+
+    public static final long  CKM_SHA512                     = 0x00000270L;
+    public static final long  CKM_SHA512_HMAC                = 0x00000271L;
+    public static final long  CKM_SHA512_HMAC_GENERAL        = 0x00000272L;
+
+    /* All of the following mechanisms are new for v2.0 */
+    /* Note that CAST128 and CAST5 are the same algorithm */
+    public static final long  CKM_CAST_KEY_GEN               = 0x00000300L;
+    public static final long  CKM_CAST_ECB                   = 0x00000301L;
+    public static final long  CKM_CAST_CBC                   = 0x00000302L;
+    public static final long  CKM_CAST_MAC                   = 0x00000303L;
+    public static final long  CKM_CAST_MAC_GENERAL           = 0x00000304L;
+    public static final long  CKM_CAST_CBC_PAD               = 0x00000305L;
+    public static final long  CKM_CAST3_KEY_GEN              = 0x00000310L;
+    public static final long  CKM_CAST3_ECB                  = 0x00000311L;
+    public static final long  CKM_CAST3_CBC                  = 0x00000312L;
+    public static final long  CKM_CAST3_MAC                  = 0x00000313L;
+    public static final long  CKM_CAST3_MAC_GENERAL          = 0x00000314L;
+    public static final long  CKM_CAST3_CBC_PAD              = 0x00000315L;
+    public static final long  CKM_CAST5_KEY_GEN              = 0x00000320L;
+    public static final long  CKM_CAST128_KEY_GEN            = 0x00000320L;
+    public static final long  CKM_CAST5_ECB                  = 0x00000321L;
+    public static final long  CKM_CAST128_ECB                = 0x00000321L;
+    public static final long  CKM_CAST5_CBC                  = 0x00000322L;
+    public static final long  CKM_CAST128_CBC                = 0x00000322L;
+    public static final long  CKM_CAST5_MAC                  = 0x00000323L;
+    public static final long  CKM_CAST128_MAC                = 0x00000323L;
+    public static final long  CKM_CAST5_MAC_GENERAL          = 0x00000324L;
+    public static final long  CKM_CAST128_MAC_GENERAL        = 0x00000324L;
+    public static final long  CKM_CAST5_CBC_PAD              = 0x00000325L;
+    public static final long  CKM_CAST128_CBC_PAD            = 0x00000325L;
+    public static final long  CKM_RC5_KEY_GEN                = 0x00000330L;
+    public static final long  CKM_RC5_ECB                    = 0x00000331L;
+    public static final long  CKM_RC5_CBC                    = 0x00000332L;
+    public static final long  CKM_RC5_MAC                    = 0x00000333L;
+    public static final long  CKM_RC5_MAC_GENERAL            = 0x00000334L;
+    public static final long  CKM_RC5_CBC_PAD                = 0x00000335L;
+    public static final long  CKM_IDEA_KEY_GEN               = 0x00000340L;
+    public static final long  CKM_IDEA_ECB                   = 0x00000341L;
+    public static final long  CKM_IDEA_CBC                   = 0x00000342L;
+    public static final long  CKM_IDEA_MAC                   = 0x00000343L;
+    public static final long  CKM_IDEA_MAC_GENERAL           = 0x00000344L;
+    public static final long  CKM_IDEA_CBC_PAD               = 0x00000345L;
+    public static final long  CKM_GENERIC_SECRET_KEY_GEN     = 0x00000350L;
+    public static final long  CKM_CONCATENATE_BASE_AND_KEY   = 0x00000360L;
+    public static final long  CKM_CONCATENATE_BASE_AND_DATA  = 0x00000362L;
+    public static final long  CKM_CONCATENATE_DATA_AND_BASE  = 0x00000363L;
+    public static final long  CKM_XOR_BASE_AND_DATA          = 0x00000364L;
+    public static final long  CKM_EXTRACT_KEY_FROM_KEY       = 0x00000365L;
+    public static final long  CKM_SSL3_PRE_MASTER_KEY_GEN    = 0x00000370L;
+    public static final long  CKM_SSL3_MASTER_KEY_DERIVE     = 0x00000371L;
+    public static final long  CKM_SSL3_KEY_AND_MAC_DERIVE    = 0x00000372L;
+
+    /* CKM_SSL3_MASTER_KEY_DERIVE_DH, CKM_TLS_PRE_MASTER_KEY_GEN,
+     * CKM_TLS_MASTER_KEY_DERIVE, CKM_TLS_KEY_AND_MAC_DERIVE, and
+     * CKM_TLS_MASTER_KEY_DERIVE_DH are new for v2.11 */
+    public static final long  CKM_SSL3_MASTER_KEY_DERIVE_DH  = 0x00000373L;
+    public static final long  CKM_TLS_PRE_MASTER_KEY_GEN     = 0x00000374L;
+    public static final long  CKM_TLS_MASTER_KEY_DERIVE      = 0x00000375L;
+    public static final long  CKM_TLS_KEY_AND_MAC_DERIVE     = 0x00000376L;
+    public static final long  CKM_TLS_MASTER_KEY_DERIVE_DH   = 0x00000377L;
+    public static final long  CKM_TLS_PRF                    = 0x00000378L;
+
+    public static final long  CKM_SSL3_MD5_MAC               = 0x00000380L;
+    public static final long  CKM_SSL3_SHA1_MAC              = 0x00000381L;
+    public static final long  CKM_MD5_KEY_DERIVATION         = 0x00000390L;
+    public static final long  CKM_MD2_KEY_DERIVATION         = 0x00000391L;
+    public static final long  CKM_SHA1_KEY_DERIVATION        = 0x00000392L;
+
+    // v2.20
+    public static final long  CKM_SHA256_KEY_DERIVATION      = 0x00000393L;
+    public static final long  CKM_SHA384_KEY_DERIVATION      = 0x00000394L;
+    public static final long  CKM_SHA512_KEY_DERIVATION      = 0x00000395L;
+
+    public static final long  CKM_PBE_MD2_DES_CBC            = 0x000003A0L;
+    public static final long  CKM_PBE_MD5_DES_CBC            = 0x000003A1L;
+    public static final long  CKM_PBE_MD5_CAST_CBC           = 0x000003A2L;
+    public static final long  CKM_PBE_MD5_CAST3_CBC          = 0x000003A3L;
+    public static final long  CKM_PBE_MD5_CAST5_CBC          = 0x000003A4L;
+    public static final long  CKM_PBE_MD5_CAST128_CBC        = 0x000003A4L;
+    public static final long  CKM_PBE_SHA1_CAST5_CBC         = 0x000003A5L;
+    public static final long  CKM_PBE_SHA1_CAST128_CBC       = 0x000003A5L;
+    public static final long  CKM_PBE_SHA1_RC4_128           = 0x000003A6L;
+    public static final long  CKM_PBE_SHA1_RC4_40            = 0x000003A7L;
+    public static final long  CKM_PBE_SHA1_DES3_EDE_CBC      = 0x000003A8L;
+    public static final long  CKM_PBE_SHA1_DES2_EDE_CBC      = 0x000003A9L;
+    public static final long  CKM_PBE_SHA1_RC2_128_CBC       = 0x000003AAL;
+    public static final long  CKM_PBE_SHA1_RC2_40_CBC        = 0x000003ABL;
+
+    /* CKM_PKCS5_PBKD2 is new for v2.10 */
+    public static final long  CKM_PKCS5_PBKD2                = 0x000003B0L;
+
+    public static final long  CKM_PBA_SHA1_WITH_SHA1_HMAC    = 0x000003C0L;
+    public static final long  CKM_KEY_WRAP_LYNKS             = 0x00000400L;
+    public static final long  CKM_KEY_WRAP_SET_OAEP          = 0x00000401L;
+
+    /* Fortezza mechanisms */
+    public static final long  CKM_SKIPJACK_KEY_GEN           = 0x00001000L;
+    public static final long  CKM_SKIPJACK_ECB64             = 0x00001001L;
+    public static final long  CKM_SKIPJACK_CBC64             = 0x00001002L;
+    public static final long  CKM_SKIPJACK_OFB64             = 0x00001003L;
+    public static final long  CKM_SKIPJACK_CFB64             = 0x00001004L;
+    public static final long  CKM_SKIPJACK_CFB32             = 0x00001005L;
+    public static final long  CKM_SKIPJACK_CFB16             = 0x00001006L;
+    public static final long  CKM_SKIPJACK_CFB8              = 0x00001007L;
+    public static final long  CKM_SKIPJACK_WRAP              = 0x00001008L;
+    public static final long  CKM_SKIPJACK_PRIVATE_WRAP      = 0x00001009L;
+    public static final long  CKM_SKIPJACK_RELAYX            = 0x0000100AL;
+    public static final long  CKM_KEA_KEY_PAIR_GEN           = 0x00001010L;
+    public static final long  CKM_KEA_KEY_DERIVE             = 0x00001011L;
+    public static final long  CKM_FORTEZZA_TIMESTAMP         = 0x00001020L;
+    public static final long  CKM_BATON_KEY_GEN              = 0x00001030L;
+    public static final long  CKM_BATON_ECB128               = 0x00001031L;
+    public static final long  CKM_BATON_ECB96                = 0x00001032L;
+    public static final long  CKM_BATON_CBC128               = 0x00001033L;
+    public static final long  CKM_BATON_COUNTER              = 0x00001034L;
+    public static final long  CKM_BATON_SHUFFLE              = 0x00001035L;
+    public static final long  CKM_BATON_WRAP                 = 0x00001036L;
+
+    /* CKM_ECDSA_KEY_PAIR_GEN is deprecated in v2.11,
+     * CKM_EC_KEY_PAIR_GEN is preferred */
+    public static final long  CKM_ECDSA_KEY_PAIR_GEN         = 0x00001040L;
+    public static final long  CKM_EC_KEY_PAIR_GEN            = 0x00001040L;
+
+    public static final long  CKM_ECDSA                      = 0x00001041L;
+    public static final long  CKM_ECDSA_SHA1                 = 0x00001042L;
+
+    /* CKM_ECDH1_DERIVE, CKM_ECDH1_COFACTOR_DERIVE, and CKM_ECMQV_DERIVE
+     * are new for v2.11 */
+    public static final long  CKM_ECDH1_DERIVE               = 0x00001050L;
+    public static final long  CKM_ECDH1_COFACTOR_DERIVE      = 0x00001051L;
+    public static final long  CKM_ECMQV_DERIVE               = 0x00001052L;
+
+    public static final long  CKM_JUNIPER_KEY_GEN            = 0x00001060L;
+    public static final long  CKM_JUNIPER_ECB128             = 0x00001061L;
+    public static final long  CKM_JUNIPER_CBC128             = 0x00001062L;
+    public static final long  CKM_JUNIPER_COUNTER            = 0x00001063L;
+    public static final long  CKM_JUNIPER_SHUFFLE            = 0x00001064L;
+    public static final long  CKM_JUNIPER_WRAP               = 0x00001065L;
+    public static final long  CKM_FASTHASH                   = 0x00001070L;
+
+    /* CKM_AES_KEY_GEN, CKM_AES_ECB, CKM_AES_CBC, CKM_AES_MAC,
+     * CKM_AES_MAC_GENERAL, CKM_AES_CBC_PAD, CKM_DSA_PARAMETER_GEN,
+     * CKM_DH_PKCS_PARAMETER_GEN, and CKM_X9_42_DH_PARAMETER_GEN are
+     * new for v2.11 */
+    public static final long  CKM_AES_KEY_GEN                = 0x00001080L;
+    public static final long  CKM_AES_ECB                    = 0x00001081L;
+    public static final long  CKM_AES_CBC                    = 0x00001082L;
+    public static final long  CKM_AES_MAC                    = 0x00001083L;
+    public static final long  CKM_AES_MAC_GENERAL            = 0x00001084L;
+    public static final long  CKM_AES_CBC_PAD                = 0x00001085L;
+    // v2.20
+    public static final long  CKM_BLOWFISH_KEY_GEN           = 0x00001090L;
+    public static final long  CKM_BLOWFISH_CBC               = 0x00001091L;
+    public static final long  CKM_DSA_PARAMETER_GEN          = 0x00002000L;
+    public static final long  CKM_DH_PKCS_PARAMETER_GEN      = 0x00002001L;
+    public static final long  CKM_X9_42_DH_PARAMETER_GEN     = 0x00002002L;
+
+    public static final long  CKM_VENDOR_DEFINED             = 0x80000000L;
+
+    // new for v2.20 amendment 3
+    public static final long  CKM_SHA224                     = 0x00000255L;
+    public static final long  CKM_SHA224_HMAC                = 0x00000256L;
+    public static final long  CKM_SHA224_HMAC_GENERAL        = 0x00000257L;
+    public static final long  CKM_SHA224_KEY_DERIVATION      = 0x00000396L;
+    public static final long  CKM_SHA224_RSA_PKCS            = 0x00000046L;
+    public static final long  CKM_SHA224_RSA_PKCS_PSS        = 0x00000047L;
+    public static final long  CKM_AES_CTR                    = 0x00001086L;
+    /*
+    public static final long  CKM_CAMELLIA_KEY_GEN           = 0x00000550L;
+    public static final long  CKM_CAMELLIA_ECB               = 0x00000551L;
+    public static final long  CKM_CAMELLIA_CBC               = 0x00000552L;
+    public static final long  CKM_CAMELLIA_MAC               = 0x00000553L;
+    public static final long  CKM_CAMELLIA_MAC_GENERAL       = 0x00000554L;
+    public static final long  CKM_CAMELLIA_CBC_PAD           = 0x00000555L;
+    public static final long  CKM_CAMELLIA_ECB_ENCRYPT_DATA  = 0x00000556L;
+    public static final long  CKM_CAMELLIA_CBC_ENCRYPT_DATA  = 0x00000557L;
+    public static final long  CKM_CAMELLIA_CTR               = 0x00000558L;
+    public static final long  CKM_ARIA_KEY_GEN               = 0x00000560L;
+    public static final long  CKM_ARIA_ECB                   = 0x00000561L;
+    public static final long  CKM_ARIA_CBC                   = 0x00000562L;
+    public static final long  CKM_ARIA_MAC                   = 0x00000563L;
+    public static final long  CKM_ARIA_MAC_GENERAL           = 0x00000564L;
+    public static final long  CKM_ARIA_CBC_PAD               = 0x00000565L;
+    public static final long  CKM_ARIA_ECB_ENCRYPT_DATA      = 0x00000566L;
+    public static final long  CKM_ARIA_CBC_ENCRYPT_DATA      = 0x00000567L;
+    */
+
+    // NSS private
+    public static final long  CKM_NSS_TLS_PRF_GENERAL        = 0x80000373L;
+
+    // ids for our pseudo mechanisms SecureRandom and KeyStore
+    public static final long  PCKM_SECURERANDOM              = 0x7FFFFF20L;
+    public static final long  PCKM_KEYSTORE                  = 0x7FFFFF21L;
+
+    /* The flags are defined as follows:
+     *      Bit Flag               Mask        Meaning */
+    /* performed by HW */
+    public static final long  CKF_HW                 = 0x00000001L;
+
+    /* The flags CKF_ENCRYPT, CKF_DECRYPT, CKF_DIGEST, CKF_SIGN,
+     * CKG_SIGN_RECOVER, CKF_VERIFY, CKF_VERIFY_RECOVER,
+     * CKF_GENERATE, CKF_GENERATE_KEY_PAIR, CKF_WRAP, CKF_UNWRAP,
+     * and CKF_DERIVE are new for v2.0.  They specify whether or not
+     * a mechanism can be used for a particular task */
+    public static final long  CKF_ENCRYPT            = 0x00000100L;
+    public static final long  CKF_DECRYPT            = 0x00000200L;
+    public static final long  CKF_DIGEST             = 0x00000400L;
+    public static final long  CKF_SIGN               = 0x00000800L;
+    public static final long  CKF_SIGN_RECOVER       = 0x00001000L;
+    public static final long  CKF_VERIFY             = 0x00002000L;
+    public static final long  CKF_VERIFY_RECOVER     = 0x00004000L;
+    public static final long  CKF_GENERATE           = 0x00008000L;
+    public static final long  CKF_GENERATE_KEY_PAIR  = 0x00010000L;
+    public static final long  CKF_WRAP               = 0x00020000L;
+    public static final long  CKF_UNWRAP             = 0x00040000L;
+    public static final long  CKF_DERIVE             = 0x00080000L;
+
+    /* CKF_EC_F_P, CKF_EC_F_2M, CKF_EC_ECPARAMETERS, CKF_EC_NAMEDCURVE,
+     * CKF_EC_UNCOMPRESS, and CKF_EC_COMPRESS are new for v2.11. They
+     * describe a token's EC capabilities not available in mechanism
+     * information. */
+    public static final long  CKF_EC_F_P              = 0x00100000L;
+    public static final long  CKF_EC_F_2M           = 0x00200000L;
+    public static final long  CKF_EC_ECPARAMETERS   = 0x00400000L;
+    public static final long  CKF_EC_NAMEDCURVE     = 0x00800000L;
+    public static final long  CKF_EC_UNCOMPRESS     = 0x01000000L;
+    public static final long  CKF_EC_COMPRESS       = 0x02000000L;
+
+    /* FALSE for 2.01 */
+    public static final long  CKF_EXTENSION          = 0x80000000L;
+
+
+    /* CK_RV is a value that identifies the return value of a
+     * Cryptoki function */
+    /* CK_RV was changed from CK_USHORT to CK_ULONG for v2.0 */
+    public static final long  CKR_OK                                = 0x00000000L;
+    public static final long  CKR_CANCEL                            = 0x00000001L;
+    public static final long  CKR_HOST_MEMORY                       = 0x00000002L;
+    public static final long  CKR_SLOT_ID_INVALID                   = 0x00000003L;
+
+    /* CKR_FLAGS_INVALID was removed for v2.0 */
+
+    /* CKR_GENERAL_ERROR and CKR_FUNCTION_FAILED are new for v2.0 */
+    public static final long  CKR_GENERAL_ERROR                     = 0x00000005L;
+    public static final long  CKR_FUNCTION_FAILED                   = 0x00000006L;
+
+    /* CKR_ARGUMENTS_BAD, CKR_NO_EVENT, CKR_NEED_TO_CREATE_THREADS,
+     * and CKR_CANT_LOCK are new for v2.01 */
+    public static final long  CKR_ARGUMENTS_BAD                     = 0x00000007L;
+    public static final long  CKR_NO_EVENT                          = 0x00000008L;
+    public static final long  CKR_NEED_TO_CREATE_THREADS            = 0x00000009L;
+    public static final long  CKR_CANT_LOCK                         = 0x0000000AL;
+
+    public static final long  CKR_ATTRIBUTE_READ_ONLY               = 0x00000010L;
+    public static final long  CKR_ATTRIBUTE_SENSITIVE               = 0x00000011L;
+    public static final long  CKR_ATTRIBUTE_TYPE_INVALID            = 0x00000012L;
+    public static final long  CKR_ATTRIBUTE_VALUE_INVALID           = 0x00000013L;
+    public static final long  CKR_DATA_INVALID                      = 0x00000020L;
+    public static final long  CKR_DATA_LEN_RANGE                    = 0x00000021L;
+    public static final long  CKR_DEVICE_ERROR                      = 0x00000030L;
+    public static final long  CKR_DEVICE_MEMORY                     = 0x00000031L;
+    public static final long  CKR_DEVICE_REMOVED                    = 0x00000032L;
+    public static final long  CKR_ENCRYPTED_DATA_INVALID            = 0x00000040L;
+    public static final long  CKR_ENCRYPTED_DATA_LEN_RANGE          = 0x00000041L;
+    public static final long  CKR_FUNCTION_CANCELED                 = 0x00000050L;
+    public static final long  CKR_FUNCTION_NOT_PARALLEL             = 0x00000051L;
+
+    /* CKR_FUNCTION_NOT_SUPPORTED is new for v2.0 */
+    public static final long  CKR_FUNCTION_NOT_SUPPORTED            = 0x00000054L;
+
+    public static final long  CKR_KEY_HANDLE_INVALID                = 0x00000060L;
+
+    /* CKR_KEY_SENSITIVE was removed for v2.0 */
+
+    public static final long  CKR_KEY_SIZE_RANGE                    = 0x00000062L;
+    public static final long  CKR_KEY_TYPE_INCONSISTENT             = 0x00000063L;
+
+    /* CKR_KEY_NOT_NEEDED, CKR_KEY_CHANGED, CKR_KEY_NEEDED,
+     * CKR_KEY_INDIGESTIBLE, CKR_KEY_FUNCTION_NOT_PERMITTED,
+     * CKR_KEY_NOT_WRAPPABLE, and CKR_KEY_UNEXTRACTABLE are new for
+     * v2.0 */
+    public static final long  CKR_KEY_NOT_NEEDED                    = 0x00000064L;
+    public static final long  CKR_KEY_CHANGED                       = 0x00000065L;
+    public static final long  CKR_KEY_NEEDED                        = 0x00000066L;
+    public static final long  CKR_KEY_INDIGESTIBLE                  = 0x00000067L;
+    public static final long  CKR_KEY_FUNCTION_NOT_PERMITTED        = 0x00000068L;
+    public static final long  CKR_KEY_NOT_WRAPPABLE                 = 0x00000069L;
+    public static final long  CKR_KEY_UNEXTRACTABLE                 = 0x0000006AL;
+
+    public static final long  CKR_MECHANISM_INVALID                 = 0x00000070L;
+    public static final long  CKR_MECHANISM_PARAM_INVALID           = 0x00000071L;
+
+    /* CKR_OBJECT_CLASS_INCONSISTENT and CKR_OBJECT_CLASS_INVALID
+     * were removed for v2.0 */
+    public static final long  CKR_OBJECT_HANDLE_INVALID             = 0x00000082L;
+    public static final long  CKR_OPERATION_ACTIVE                  = 0x00000090L;
+    public static final long  CKR_OPERATION_NOT_INITIALIZED         = 0x00000091L;
+    public static final long  CKR_PIN_INCORRECT                     = 0x000000A0L;
+    public static final long  CKR_PIN_INVALID                       = 0x000000A1L;
+    public static final long  CKR_PIN_LEN_RANGE                     = 0x000000A2L;
+
+    /* CKR_PIN_EXPIRED and CKR_PIN_LOCKED are new for v2.0 */
+    public static final long  CKR_PIN_EXPIRED                       = 0x000000A3L;
+    public static final long  CKR_PIN_LOCKED                        = 0x000000A4L;
+
+    public static final long  CKR_SESSION_CLOSED                    = 0x000000B0L;
+    public static final long  CKR_SESSION_COUNT                     = 0x000000B1L;
+    public static final long  CKR_SESSION_HANDLE_INVALID            = 0x000000B3L;
+    public static final long  CKR_SESSION_PARALLEL_NOT_SUPPORTED    = 0x000000B4L;
+    public static final long  CKR_SESSION_READ_ONLY                 = 0x000000B5L;
+    public static final long  CKR_SESSION_EXISTS                    = 0x000000B6L;
+
+    /* CKR_SESSION_READ_ONLY_EXISTS and
+     * CKR_SESSION_READ_WRITE_SO_EXISTS are new for v2.0 */
+    public static final long  CKR_SESSION_READ_ONLY_EXISTS          = 0x000000B7L;
+    public static final long  CKR_SESSION_READ_WRITE_SO_EXISTS      = 0x000000B8L;
+
+    public static final long  CKR_SIGNATURE_INVALID                 = 0x000000C0L;
+    public static final long  CKR_SIGNATURE_LEN_RANGE               = 0x000000C1L;
+    public static final long  CKR_TEMPLATE_INCOMPLETE               = 0x000000D0L;
+    public static final long  CKR_TEMPLATE_INCONSISTENT             = 0x000000D1L;
+    public static final long  CKR_TOKEN_NOT_PRESENT                 = 0x000000E0L;
+    public static final long  CKR_TOKEN_NOT_RECOGNIZED              = 0x000000E1L;
+    public static final long  CKR_TOKEN_WRITE_PROTECTED             = 0x000000E2L;
+    public static final long  CKR_UNWRAPPING_KEY_HANDLE_INVALID     = 0x000000F0L;
+    public static final long  CKR_UNWRAPPING_KEY_SIZE_RANGE         = 0x000000F1L;
+    public static final long  CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT  = 0x000000F2L;
+    public static final long  CKR_USER_ALREADY_LOGGED_IN            = 0x00000100L;
+    public static final long  CKR_USER_NOT_LOGGED_IN                = 0x00000101L;
+    public static final long  CKR_USER_PIN_NOT_INITIALIZED          = 0x00000102L;
+    public static final long  CKR_USER_TYPE_INVALID                 = 0x00000103L;
+
+    /* CKR_USER_ANOTHER_ALREADY_LOGGED_IN and CKR_USER_TOO_MANY_TYPES
+     * are new to v2.01 */
+    public static final long  CKR_USER_ANOTHER_ALREADY_LOGGED_IN    = 0x00000104L;
+    public static final long  CKR_USER_TOO_MANY_TYPES               = 0x00000105L;
+
+    public static final long  CKR_WRAPPED_KEY_INVALID               = 0x00000110L;
+    public static final long  CKR_WRAPPED_KEY_LEN_RANGE             = 0x00000112L;
+    public static final long  CKR_WRAPPING_KEY_HANDLE_INVALID       = 0x00000113L;
+    public static final long  CKR_WRAPPING_KEY_SIZE_RANGE           = 0x00000114L;
+    public static final long  CKR_WRAPPING_KEY_TYPE_INCONSISTENT    = 0x00000115L;
+    public static final long  CKR_RANDOM_SEED_NOT_SUPPORTED         = 0x00000120L;
+
+    /* These are new to v2.0 */
+    public static final long  CKR_RANDOM_NO_RNG                     = 0x00000121L;
+
+    /* These are new to v2.11 */
+    public static final long  CKR_DOMAIN_PARAMS_INVALID             = 0x00000130L;
+
+    /* These are new to v2.0 */
+    public static final long  CKR_BUFFER_TOO_SMALL                  = 0x00000150L;
+    public static final long  CKR_SAVED_STATE_INVALID               = 0x00000160L;
+    public static final long  CKR_INFORMATION_SENSITIVE             = 0x00000170L;
+    public static final long  CKR_STATE_UNSAVEABLE                  = 0x00000180L;
+
+    /* These are new to v2.01 */
+    public static final long  CKR_CRYPTOKI_NOT_INITIALIZED          = 0x00000190L;
+    public static final long  CKR_CRYPTOKI_ALREADY_INITIALIZED      = 0x00000191L;
+    public static final long  CKR_MUTEX_BAD                         = 0x000001A0L;
+    public static final long  CKR_MUTEX_NOT_LOCKED                  = 0x000001A1L;
+
+    public static final long  CKR_VENDOR_DEFINED                    = 0x80000000L;
+
+
+    /* flags: bit flags that provide capabilities of the slot
+     *        Bit Flag = Mask
+     */
+    public static final long  CKF_LIBRARY_CANT_CREATE_OS_THREADS = 0x00000001L;
+    public static final long  CKF_OS_LOCKING_OK                  = 0x00000002L;
+
+
+    /* CKF_DONT_BLOCK is for the function C_WaitForSlotEvent */
+    public static final long  CKF_DONT_BLOCK =    1L;
+
+
+    /* The following MGFs are defined */
+    public static final long  CKG_MGF1_SHA1       =  0x00000001L;
+    // new for v2.20 amendment 3
+    public static final long  CKG_MGF1_SHA224     = 0x00000005L;
+
+    /* The following encoding parameter sources are defined */
+    public static final long  CKZ_DATA_SPECIFIED   = 0x00000001L;
+
+
+    /* The following PRFs are defined in PKCS #5 v2.0. */
+    public static final long  CKP_PKCS5_PBKD2_HMAC_SHA1 = 0x00000001L;
+
+
+    /* The following salt value sources are defined in PKCS #5 v2.0. */
+    public static final long CKZ_SALT_SPECIFIED        = 0x00000001L;
+
+    /* the following EC Key Derivation Functions are defined */
+    public static final long CKD_NULL                 = 0x00000001L;
+    public static final long CKD_SHA1_KDF             = 0x00000002L;
+
+    /* the following X9.42 Diffie-Hellman Key Derivation Functions are defined */
+    public static final long CKD_SHA1_KDF_ASN1        = 0x00000003L;
+    public static final long CKD_SHA1_KDF_CONCATENATE = 0x00000004L;
+
+
+    // private NSS attribute (for DSA and DH private keys)
+    public static final long  CKA_NETSCAPE_DB         = 0xD5A0DB00L;
+
+    // base number of NSS private attributes
+    public static final long  CKA_NETSCAPE_BASE       = 0x80000000L + 0x4E534350L;
+
+    // object type for NSS trust
+    public static final long  CKO_NETSCAPE_TRUST      = CKA_NETSCAPE_BASE + 3;
+
+    // base number for NSS trust attributes
+    public static final long  CKA_NETSCAPE_TRUST_BASE = CKA_NETSCAPE_BASE + 0x2000;
+
+    // attributes for NSS trust
+    public static final long  CKA_NETSCAPE_TRUST_SERVER_AUTH      = CKA_NETSCAPE_TRUST_BASE +   8;
+    public static final long  CKA_NETSCAPE_TRUST_CLIENT_AUTH      = CKA_NETSCAPE_TRUST_BASE +   9;
+    public static final long  CKA_NETSCAPE_TRUST_CODE_SIGNING     = CKA_NETSCAPE_TRUST_BASE +  10;
+    public static final long  CKA_NETSCAPE_TRUST_EMAIL_PROTECTION = CKA_NETSCAPE_TRUST_BASE +  11;
+    public static final long  CKA_NETSCAPE_CERT_SHA1_HASH         = CKA_NETSCAPE_TRUST_BASE + 100;
+    public static final long  CKA_NETSCAPE_CERT_MD5_HASH          = CKA_NETSCAPE_TRUST_BASE + 101;
+
+    // trust values for each of the NSS trust attributes
+    public static final long  CKT_NETSCAPE_TRUSTED           = CKA_NETSCAPE_BASE + 1;
+    public static final long  CKT_NETSCAPE_TRUSTED_DELEGATOR = CKA_NETSCAPE_BASE + 2;
+    public static final long  CKT_NETSCAPE_UNTRUSTED         = CKA_NETSCAPE_BASE + 3;
+    public static final long  CKT_NETSCAPE_MUST_VERIFY       = CKA_NETSCAPE_BASE + 4;
+    public static final long  CKT_NETSCAPE_TRUST_UNKNOWN     = CKA_NETSCAPE_BASE + 5; /* default */
+    public static final long  CKT_NETSCAPE_VALID             = CKA_NETSCAPE_BASE + 10;
+    public static final long  CKT_NETSCAPE_VALID_DELEGATOR   = CKA_NETSCAPE_BASE + 11;
+
+}
+
diff --git a/org/mozilla/jss/pkix/cmc/RevokeRequest.java b/org/mozilla/jss/pkix/cmc/RevokeRequest.java
index e5f4962a..012a263f 100644
--- a/org/mozilla/jss/pkix/cmc/RevokeRequest.java
+++ b/org/mozilla/jss/pkix/cmc/RevokeRequest.java
@@ -218,6 +218,7 @@ public class RevokeRequest implements ASN1Value {
      * @param comment The <code>comment</code> field.  This field is optional,
      *      so <code>null</code> may be used.
      */
+    @Deprecated
     public RevokeRequest(ANY issuerName, INTEGER serialNumber,
                     ENUMERATED reason, OCTET_STRING passphrase,
                     UTF8String comment)
diff --git a/org/mozilla/jss/pkix/cmmf/RevRequest.java b/org/mozilla/jss/pkix/cmmf/RevRequest.java
index c9166a10..a4393da5 100644
--- a/org/mozilla/jss/pkix/cmmf/RevRequest.java
+++ b/org/mozilla/jss/pkix/cmmf/RevRequest.java
@@ -154,6 +154,7 @@ public class RevRequest implements ASN1Value {
      * @deprecated The <tt>passphrase</tt> field has been renamed
      *  <tt>sharedSecret</tt>. Call <tt>getSharedSecret</tt> instead.
      */
+    @Deprecated
     public OCTET_STRING getPassphrase() {
         return sharedSecret;
     }
@@ -194,6 +195,7 @@ public class RevRequest implements ASN1Value {
      * @param comment The <code>comment</code> field.  This field is optional,
      *      so <code>null</code> may be used.
      */
+    @Deprecated
     public RevRequest(ANY issuerName, INTEGER serialNumber,
                     ENUMERATED reason, OCTET_STRING sharedSecret,
                     UTF8String comment)
diff --git a/org/mozilla/jss/provider/javax/crypto/JSSKeyGeneratorSpi.java b/org/mozilla/jss/provider/javax/crypto/JSSKeyGeneratorSpi.java
index b6a8caee..9b7d5e00 100644
--- a/org/mozilla/jss/provider/javax/crypto/JSSKeyGeneratorSpi.java
+++ b/org/mozilla/jss/provider/javax/crypto/JSSKeyGeneratorSpi.java
@@ -105,6 +105,7 @@ class JSSKeyGeneratorSpi extends javax.crypto.KeyGeneratorSpi {
      * is used for generating Password-Based Authentication keys
      * for use with HmacSHA1. Use PBAHmacSHA1 instead.
      */
+    @Deprecated
     public static class HmacSHA1 extends JSSKeyGeneratorSpi {
         public HmacSHA1() {
             super(KeyGenAlgorithm.PBA_SHA1_HMAC);
diff --git a/org/mozilla/jss/provider/javax/crypto/JSSSecretKeyFactorySpi.java b/org/mozilla/jss/provider/javax/crypto/JSSSecretKeyFactorySpi.java
index 76bd3604..ab53eeae 100644
--- a/org/mozilla/jss/provider/javax/crypto/JSSSecretKeyFactorySpi.java
+++ b/org/mozilla/jss/provider/javax/crypto/JSSSecretKeyFactorySpi.java
@@ -403,6 +403,7 @@ class JSSSecretKeyFactorySpi extends SecretKeyFactorySpi {
      * is used for generating Password-Based Authentication keys
      * for use with HmacSHA1. Use PBAHmacSHA1 instead.
      */
+    @Deprecated
     public static class HmacSHA1 extends JSSSecretKeyFactorySpi {
         public HmacSHA1() {
             super(KeyGenAlgorithm.PBA_SHA1_HMAC);
diff --git a/org/mozilla/jss/ssl/SSLSecurityStatus.java b/org/mozilla/jss/ssl/SSLSecurityStatus.java
index b122fddd..b8267fbb 100644
--- a/org/mozilla/jss/ssl/SSLSecurityStatus.java
+++ b/org/mozilla/jss/ssl/SSLSecurityStatus.java
@@ -28,6 +28,7 @@ public class SSLSecurityStatus {
      * @deprecated As of NSS 3.11, FORTEZZA is no longer supported.
      * STATUS_FORTEZZA is a placeholder for backward compatibility.
      */
+    @Deprecated
     final public int STATUS_FORTEZZA = 3;
 
 	/**
diff --git a/org/mozilla/jss/ssl/SSLServerSocket.java b/org/mozilla/jss/ssl/SSLServerSocket.java
index a17d7906..4f921860 100644
--- a/org/mozilla/jss/ssl/SSLServerSocket.java
+++ b/org/mozilla/jss/ssl/SSLServerSocket.java
@@ -303,6 +303,7 @@ public class SSLServerSocket extends java.net.ServerSocket {
      * @deprecated As of JSS 3.0. This method is misnamed. Use
      *  <code>requestClientAuth</code> instead.
      */
+    @Deprecated
     public void setNeedClientAuth(boolean b) throws SocketException {
         base.requestClientAuth(b);
     }
@@ -324,6 +325,7 @@ public class SSLServerSocket extends java.net.ServerSocket {
      * @deprecated As of JSS 3.0. This method is misnamed. Use
      *  <code>requestClientAuthNoExpiryCheck</code> instead.
      */
+    @Deprecated
     public void setNeedClientAuthNoExpiryCheck(boolean b)
         throws SocketException
     {
@@ -477,6 +479,7 @@ public class SSLServerSocket extends java.net.ServerSocket {
      *  it.
      * @deprecated use requireClientAuth(int)
      */
+    @Deprecated
     public void requireClientAuth(boolean require, boolean onRedo)
             throws SocketException
     {
diff --git a/org/mozilla/jss/ssl/SSLSocket.java b/org/mozilla/jss/ssl/SSLSocket.java
index e104d3cd..8ca3ea77 100644
--- a/org/mozilla/jss/ssl/SSLSocket.java
+++ b/org/mozilla/jss/ssl/SSLSocket.java
@@ -480,6 +480,7 @@ public class SSLSocket extends java.net.Socket {
      * @deprecated As of JSS 3.0. The stream parameter is ignored, because
      *      only stream sockets are supported.
      */
+    @Deprecated
     public SSLSocket(InetAddress address, int port, InetAddress localAddr,
         int localPort, boolean stream,
         SSLCertificateApprovalCallback certApprovalCallback,
@@ -1168,6 +1169,7 @@ public class SSLSocket extends java.net.Socket {
      *  it.
      * @deprecated use requireClientAuth(int)
      */
+    @Deprecated
     public void requireClientAuth(boolean require, boolean onRedo)
             throws SocketException
     {
@@ -1203,6 +1205,7 @@ public class SSLSocket extends java.net.Socket {
      *  All subsequently created sockets will use this default setting.
      * @deprecated use requireClientAuthDefault(int)
      */
+    @Deprecated
     public void requireClientAuthDefault(boolean require, boolean onRedo)
             throws SocketException
     {
@@ -1311,6 +1314,7 @@ public class SSLSocket extends java.net.Socket {
      * @deprecated As of JSS 3.0. This method is misnamed. Use
      *  <code>requestClientAuth</code> instead.
      */
+    @Deprecated
     public void setNeedClientAuth(boolean b) throws SocketException {
         base.requestClientAuth(b);
     }
@@ -1332,6 +1336,7 @@ public class SSLSocket extends java.net.Socket {
      * @deprecated As of JSS 3.0. This method is misnamed. Use
      *  <code>requestClientAuthNoExpiryCheck</code> instead.
      */
+    @Deprecated
     public void setNeedClientAuthNoExpiryCheck(boolean b)
         throws SocketException
     {
diff --git a/org/mozilla/jss/tests/SymKeyDeriving.java b/org/mozilla/jss/tests/SymKeyDeriving.java
index 43ba84d8..6a4b5e70 100644
--- a/org/mozilla/jss/tests/SymKeyDeriving.java
+++ b/org/mozilla/jss/tests/SymKeyDeriving.java
@@ -40,7 +40,7 @@ import org.mozilla.jss.crypto.*;
 import org.mozilla.jss.CryptoManager;
 import org.mozilla.jss.InitializationValues;
 
-import sun.security.pkcs11.wrapper.PKCS11Constants;
+import org.mozilla.jss.pkcs11.PKCS11Constants;
 import java.nio.ByteBuffer;
 import java.util.Arrays;
 import java.util.Enumeration;
diff --git a/org/mozilla/jss/util/NativeErrcodes.java b/org/mozilla/jss/util/NativeErrcodes.java
index cfee0225..36e3bf03 100644
--- a/org/mozilla/jss/util/NativeErrcodes.java
+++ b/org/mozilla/jss/util/NativeErrcodes.java
@@ -111,6 +111,7 @@ public class NativeErrcodes {
      * SSL_ERROR_FORTEZZA_PQG is a placeholder for backward
      * compatibility.
      */
+    @Deprecated
     public static final int SSL_ERROR_FORTEZZA_PQG = 97;
     public static final int SSL_ERROR_UNKNOWN_CIPHER_SUITE = 98;
     public static final int SSL_ERROR_NO_CIPHERS_SUPPORTED = 99;
@@ -310,6 +311,7 @@ public class NativeErrcodes {
      * SEC_ERROR_NOT_FORTEZZA_ISSUER is a placeholder for backward
      * compatibility.
      */
+    @Deprecated
     public static final int SEC_ERROR_NOT_FORTEZZA_ISSUER = 283;
     public static final int SEC_ERROR_CANNOT_MOVE_SENSITIVE_KEY = 284;
     public static final int SEC_ERROR_JS_INVALID_MODULE_NAME = 285;
