Skip to content

SoftHSM returns invalid value for CKA_ALLOWED_MECHANISMS when there is no limitation #825

@Jakuje

Description

@Jakuje

When listing attributes of object that was created without any allowed algorithms, it should not return empty list (uninitialized pointer + 0 length) as it does now:

76: C_GetAttributeValue
P:2127568; T:0x140248153966528 2025-11-19 17:57:57.573
[in] hSession = 0x1
[in] hObject = 0x2
[in] pTemplate[1]: 
    CKA_ALLOWED_MECHANISMS  0000000000000001 / 0
[out] pTemplate[1]: 
    CKA_ALLOWED_MECHANISMS  0000000000000001 / 0
Returned:  0 CKR_OK

We had to implement a workaround for this in pkcs11-provider before:

https://github.com/latchset/pkcs11-provider/blob/e4f723ddb1a287165177f2d4f5c1635e916526b1/src/sig/rsasig.c#L260-L266

and we are hitting the same issue in rust-cryptoki now parallaxsecond/rust-cryptoki#323 so it would be great to get this fixed.

While this is under-specified in the PKCS#11 standard, returning zero-length is unexpected by most of the application. From my reading of the C_GetAttributeValue description, I think the best would be to set the length to the CK_UNAVAILABLE_INFORMATION to signalize the attribute is valid, but not present on the given object.

https://docs.oasis-open.org/pkcs11/pkcs11-spec/v3.2/pkcs11-spec-v3.2.html#_Toc195693161

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions