-
Notifications
You must be signed in to change notification settings - Fork 386
Description
When listing attributes of object that was created without any allowed algorithms, it should not return empty list (uninitialized pointer + 0 length) as it does now:
76: C_GetAttributeValue
P:2127568; T:0x140248153966528 2025-11-19 17:57:57.573
[in] hSession = 0x1
[in] hObject = 0x2
[in] pTemplate[1]:
CKA_ALLOWED_MECHANISMS 0000000000000001 / 0
[out] pTemplate[1]:
CKA_ALLOWED_MECHANISMS 0000000000000001 / 0
Returned: 0 CKR_OK
We had to implement a workaround for this in pkcs11-provider before:
and we are hitting the same issue in rust-cryptoki now parallaxsecond/rust-cryptoki#323 so it would be great to get this fixed.
While this is under-specified in the PKCS#11 standard, returning zero-length is unexpected by most of the application. From my reading of the C_GetAttributeValue description, I think the best would be to set the length to the CK_UNAVAILABLE_INFORMATION to signalize the attribute is valid, but not present on the given object.
https://docs.oasis-open.org/pkcs11/pkcs11-spec/v3.2/pkcs11-spec-v3.2.html#_Toc195693161