Bug ID: JDK-8209398 sun/security/pkcs11/KeyStore/SecretKeysBasic.sh failed with "PKCS11Exception: CKR_ATTRIBUTE

JDK-8209398 : sun/security/pkcs11/KeyStore/SecretKeysBasic.sh failed with "PKCS11Exception: CKR_ATTRIBUTE_SENSITIVE"

Type: Bug
Component: security-libs
Sub-Component: javax.crypto:pkcs11
Affected Version: 7,8,11

Priority: P3
Status: Resolved
Resolution: Fixed

Submitted: 2018-08-13
Updated: 2024-12-24
Resolved: 2021-12-22

Versions (Unresolved/Resolved/Fixed)

The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.

JDK 11	JDK 17	JDK 19	JDK 8
11.0.21-oracleFixed	17.0.9-oracleFixed	19 b04Fixed	8u401Fixed

Related Reports

Relates :

JDK-8180837 - SunPKCS11-NSS tests failing with CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID

Description

Beginning test run SecretKeysBasic...
nssLibDir: /scratch/mesos/jib-master/install/jpg/tests/jdk/nsslib/nsslib-macosx_x64/3.35/nsslib-macosx_x64-3.35.zip/nsslib/
Running test with provider SunPKCS11-nss (security manager disabled) ...
softkey> javax.crypto.spec.SecretKeySpec@fffe8ae6
	ALGO=AES
	[RAW] VALUE=c68c8358f7e7bfab80a9e0d382f76326
skey1> SunPKCS11-nss DESede secret key, 168 bits (id 1, session object, not sensitive, extractable)
	ALGO=DESede
	[RAW] VALUE=4a46a2f26ea8b392910bf7730440798cec540d891ace194f
skey2> SunPKCS11-nss DESede secret key, 168 bits (id 2, session object, not sensitive, extractable)
	ALGO=DESede
	[RAW] VALUE=043e1c7cb6cb6275238fc8295b7cb3e373670134eff45d1c
nssLibDir: /scratch/mesos/jib-master/install/jpg/tests/jdk/nsslib/nsslib-macosx_x64/3.35/nsslib-macosx_x64-3.35.zip/nsslib/
libsoftokn3 version = 3.35.  ECC Basic.
nssLibDir: /scratch/mesos/jib-master/install/jpg/tests/jdk/nsslib/nsslib-macosx_x64/3.35/nsslib-macosx_x64-3.35.zip/nsslib/
libnss3 version = 3.35.  ECC None.
Number of entries: 0
Test against  nss  Failed!
----------System.err:(15/983)----------
Exception in thread "main" java.security.ProviderException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ATTRIBUTE_SENSITIVE
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11Key$P11SecretKey.getEncodedInternal(P11Key.java:447)
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11Key.getEncoded(P11Key.java:137)
	at SecretKeysBasic.checkSecretKeyEntry(SecretKeysBasic.java:120)
	at SecretKeysBasic.doTest(SecretKeysBasic.java:169)
	at SecretKeysBasic.main(SecretKeysBasic.java:83)
	at PKCS11Test.premain(PKCS11Test.java:179)
	at PKCS11Test.testNSS(PKCS11Test.java:558)
	at PKCS11Test.main(PKCS11Test.java:215)
	at PKCS11Test.main(PKCS11Test.java:191)
	at SecretKeysBasic.main(SecretKeysBasic.java:46)
Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ATTRIBUTE_SENSITIVE
	at jdk.crypto.cryptoki/sun.security.pkcs11.wrapper.PKCS11.C_GetAttributeValue(Native Method)
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11Key$P11SecretKey.getEncodedInternal(P11Key.java:444)
	... 9 more

Comments

A pull request was submitted for review. Branch: master URL: https://git.openjdk.org/jdk8u-dev/pull/462 Date: 2024-02-28 13:13:40 +0000
24-12-2024
Fix request [11u] I backport this for parity with 11.0.21 oracle. Simple fix but in security files, low risk. Clean backport from 17 De-problem listed test passes and fails without the fix. SAP nightly testing passed.
04-07-2023
A pull request was submitted for review. URL: https://git.openjdk.org/jdk11u-dev/pull/2007 Date: 2023-06-29 14:54:40 +0000
29-06-2023
Fix request [17u] I backport this for parity with 17.0.8-oracle. Simple fix but in security files, low risk. Trivial resolves SAP nighlty testing passed De-problem listed test passes and fails without the fix. SAP nighlty testing passed
17-06-2023
A pull request was submitted for review. URL: https://git.openjdk.org/jdk17u-dev/pull/1454 Date: 2023-06-16 10:04:16 +0000
16-06-2023
Added noreg-other label to indicate that this change is tested by updating the ProblemList.txt to add back the sun/security/pkcs11/KeyStore/SecretKeysBasic.java reg test.
04-01-2022
Changeset: d64820df Author: Valerie Peng <valeriep@openjdk.org> Date: 2021-12-22 19:50:51 +0000 URL: https://git.openjdk.java.net/jdk/commit/d64820dfefc0bac578df43fe58d2bce8577ec94e
22-12-2021
Fix is to modify P11SecretKey.getFormat() to return null for such keys, so that the failed test knows that it should not call getEncoded() to retrieve the encoding which fails with PKCS11Exception anyway.
09-12-2021
Here is the stack trace reported by JDK 18: test SecretKeysBasic.testBasic(): failure java.security.ProviderException: sun.security.pkcs11.wrapper.PKCS11Exception: CK R_ATTRIBUTE_SENSITIVE 0x11 <= CKA_VALUE at jdk.crypto.cryptoki/sun.security.pkcs11.P11Key$P11SecretKey.getEncode dInternal(P11Key.java:498) at jdk.crypto.cryptoki/sun.security.pkcs11.P11Key.getEncoded(P11Key.java :165) at SecretKeysBasic.checkSecretKeyEntry(SecretKeysBasic.java:139) at SecretKeysBasic.doTest(SecretKeysBasic.java:188) at SecretKeysBasic.main(SecretKeysBasic.java:102) at PKCS11Test.premain(PKCS11Test.java:174) at PKCS11Test.testNSS(PKCS11Test.java:550) at PKCS11Test.main(PKCS11Test.java:210) at PKCS11Test.main(PKCS11Test.java:186) at SecretKeysBasic.testBasic(SecretKeysBasic.java:65) at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(Dire ctMethodHandleAccessor.java:104) at java.base/java.lang.reflect.Method.invoke(Method.java:577) at org.testng.internal.MethodInvocationHelper.invokeMethod(MethodInvocat ionHelper.java:132) at org.testng.internal.TestInvoker.invokeMethod(TestInvoker.java:599) ..... The debug tracing confirms that this particular P11SecretKey key object => isNSS = true => tokenObject = true => sensitive = false => extractable = true Thus, we should treat NSS token keys as sensitive \|\| !extractable since retrieving its key value would lead to PKCS11Exception: CKR_ATTRIBUTE_SENSITIVE.
09-12-2021
It seems that for NSS, if the secret key is a token object, then even when the key is (!sensitive && extractable), the C_GetAttribute(...) call with CKA_VALUE would lead to CKR_ATTRIBUTE_SENSITIVE. Probably P11SecretKey.getFormat() should be updated to return null for NSS token keys. To help future troubleshooting, we should also consider adding attribute info into the exception message.
31-10-2020
Observed similar issue on JDK7u271b01 with OEL 8
08-04-2020