Skip to content

8209398: sun/security/pkcs11/KeyStore/SecretKeysBasic.sh failed with "PKCS11Exception: CKR_ATTRIBUTE_SENSITIVE" #462

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

8209398: sun/security/pkcs11/KeyStore/SecretKeysBasic.sh failed with "PKCS11Exception: CKR_ATTRIBUTE_SENSITIVE" #462

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions jdk/src/share/classes/sun/security/pkcs11/P11Key.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,9 @@ abstract class P11Key implements Key, Length {
// flags indicating whether the key is a token object, sensitive, extractable
final boolean tokenObject, sensitive, extractable;

// flag indicating whether the current token is NSS
final transient boolean isNSS;

private final NativeKeyHolder keyIDHolder;

private static final boolean DISABLE_NATIVE_KEYS_EXTRACTION;
Expand Down Expand Up @@ -136,7 +139,7 @@ abstract class P11Key implements Key, Length {
this.sensitive = sensitive;
this.extractable = extractable;
char[] tokenLabel = this.token.tokenInfo.label;
boolean isNSS = (tokenLabel[0] == 'N' && tokenLabel[1] == 'S'
isNSS = (tokenLabel[0] == 'N' && tokenLabel[1] == 'S'
&& tokenLabel[2] == 'S');
boolean extractKeyInfo = (!DISABLE_NATIVE_KEYS_EXTRACTION && isNSS &&
extractable && !tokenObject);
Expand Down Expand Up @@ -225,7 +228,8 @@ protected Object writeReplace() throws ObjectStreamException {
} else {
// XXX short term serialization for unextractable keys
throw new NotSerializableException
("Cannot serialize sensitive and unextractable keys");
("Cannot serialize sensitive, unextractable " + (isNSS ?
", and NSS token keys" : "keys"));
}
return new KeyRep(type, getAlgorithm(), format, getEncoded());
}
Expand Down Expand Up @@ -440,7 +444,7 @@ private static class P11SecretKey extends P11Key implements SecretKey {
}
public String getFormat() {
token.ensureValid();
if (sensitive || (extractable == false)) {
if (sensitive || !extractable || (isNSS && tokenObject)) {
return null;
} else {
return "RAW";
Expand Down