code: func ecArgs(label string, curve *elliptic.CurveParams, keyID []byte) generateArgs {
  	encodedCurve := curveToOIDDER[curve.Name]
  	log.Printf("\tEncoded curve parameters for %s: %X\n", curve.Params().Name, encodedCurve)
  	return generateArgs{
  		mechanism: []*pkcs11.Mechanism{
  			pkcs11.NewMechanism(pkcs11.CKM_EC_KEY_PAIR_GEN, nil),
  		},
  		publicAttrs: []*pkcs11.Attribute{
  			pkcs11.NewAttribute(pkcs11.CKA_ID, keyID),
  			pkcs11.NewAttribute(pkcs11.CKA_LABEL, label),
  			pkcs11.NewAttribute(pkcs11.CKA_TOKEN, true),
  			pkcs11.NewAttribute(pkcs11.CKA_VERIFY, true),
  			pkcs11.NewAttribute(pkcs11.CKA_EC_PARAMS, encodedCurve),
  		},
  		privateAttrs: []*pkcs11.Attribute{
  			pkcs11.NewAttribute(pkcs11.CKA_ID, keyID),
  			pkcs11.NewAttribute(pkcs11.CKA_LABEL, label),
  			pkcs11.NewAttribute(pkcs11.CKA_TOKEN, true),
  			// Prevent attributes being retrieved
  			pkcs11.NewAttribute(pkcs11.CKA_SENSITIVE, true),
  			// Prevent the key being extracted from the device
  			pkcs11.NewAttribute(pkcs11.CKA_EXTRACTABLE, false),
  			// Allow the key to sign data
  			pkcs11.NewAttribute(pkcs11.CKA_SIGN, true),
  		},
  	}
  }
docs: // ecArgs constructs the private and public key template attributes sent to the
  // device and specifies which mechanism should be used. curve determines which
  // type of key should be generated.