Derive keys with CKM_EXTRACT_KEY_FROM_KEY returns key handle invalid error about pkcs11interop

[jariq]

Similar issue has been discussed recently in our mailing-list. My guess was that PKCS#11 library might be indicating that the base key type is not usable for this type of derivation. Which HSM / PKCS#11 implementation are you using?

We will need to determine whether the problem is in Pkcs11Interop or in unmanaged PKCS#11 library provided by the device vendor so please use pkcs11-logger to capture all unmanaged PKCS#11 calls made by your application and share the logs with me.

[ratihS]

Hi Jariq,

It is indeed the same problem, I'm using safenet HSM.
Will do that, but have you ever encountered this question or problem before as per your knowledge?

Thank you kindly for your response.

[ratihS]

Hi Jariq,

Please find the log:

0x000021ec : 0x000023d4 : ****************************** 2016-04-14 11:15:46 ***
0x000021ec : 0x000023d4 : Calling C_FindObjectsInit
0x000021ec : 0x000023d4 : Input
0x000021ec : 0x000023d4 :  hSession: 262146
0x000021ec : 0x000023d4 :  pTemplate: 00000000016F3840
0x000021ec : 0x000023d4 :  ulCount: 1
0x000021ec : 0x000023d4 :   *** Begin attribute template ***
0x000021ec : 0x000023d4 :   Attribute 0
0x000021ec : 0x000023d4 :    Attribute: 3 (CKA_LABEL)
0x000021ec : 0x000023d4 :    pValue: 00000000016F3800
0x000021ec : 0x000023d4 :    ulValueLen: 16
0x000021ec : 0x000023d4 :    *pValue: HEX(546573744B6579446573334F70656E32) --> sample key, it works fine in getting the data, set the attribute as not sensitive.
0x000021ec : 0x000023d4 :   *** End attribute template ***
0x000021ec : 0x000023d4 : Returning 0 (CKR_OK)
0x000021ec : 0x000023d4 : ****************************** 2016-04-14 11:15:46 ***
0x000021ec : 0x000023d4 : Calling C_FindObjects
0x000021ec : 0x000023d4 : Input
0x000021ec : 0x000023d4 :  hSession: 262146
0x000021ec : 0x000023d4 :  phObject: 0000000005DB4048
0x000021ec : 0x000023d4 :  ulMaxObjectCount: 2
0x000021ec : 0x000023d4 :  pulObjectCount: 000000000322DD20
0x000021ec : 0x000023d4 :  *pulObjectCount: 0
0x000021ec : 0x000023d4 :   *phObject[0]: 0
0x000021ec : 0x000023d4 :   *phObject[1]: 0
0x000021ec : 0x000023d4 : Output
0x000021ec : 0x000023d4 :  phObject: 0000000005DB4048
0x000021ec : 0x000023d4 :  ulMaxObjectCount: 2
0x000021ec : 0x000023d4 :  pulObjectCount: 000000000322DD20
0x000021ec : 0x000023d4 :  *pulObjectCount: 1
0x000021ec : 0x000023d4 :   *phObject[0]: 17
0x000021ec : 0x000023d4 :   *phObject[1]: 0
0x000021ec : 0x000023d4 : Returning 0 (CKR_OK)
0x000021ec : 0x000023d4 : ****************************** 2016-04-14 11:15:46 ***
0x000021ec : 0x000023d4 : Calling C_FindObjectsFinal
0x000021ec : 0x000023d4 : Input
0x000021ec : 0x000023d4 :  hSession: 262146
0x000021ec : 0x000023d4 : Returning 0 (CKR_OK)
0x000021ec : 0x000023d4 : ****************************** 2016-04-14 11:15:54 ***
0x000021ec : 0x000023d4 : Calling C_DeriveKey
0x000021ec : 0x000023d4 : Input
0x000021ec : 0x000023d4 :  hSession: 262146
0x000021ec : 0x000023d4 :  pMechanism: 000000000322DCD8
0x000021ec : 0x000023d4 :   mechanism: 869 (CKM_EXTRACT_KEY_FROM_KEY)
0x000021ec : 0x000023d4 :   pParameter: 00000000017079A0
0x000021ec : 0x000023d4 :  *pParameter: HEX(08000000)
0x000021ec : 0x000023d4 :   ulParameterLen: 0000000000000004
0x000021ec : 0x000023d4 :  hBaseKey: 17
0x000021ec : 0x000023d4 :  pTemplate: 0000000000000000
0x000021ec : 0x000023d4 :  ulAttributeCount: 0
0x000021ec : 0x000023d4 :  phKey: 000000000322DCC0
0x000021ec : 0x000023d4 :  *phKey: 0
0x000021ec : 0x000023d4 : Returning 96 (CKR_KEY_HANDLE_INVALID)

Please let me know if you find anything useful from the log,

Thank you as always.

[jariq]

Will do that, but have you ever encountered this question or problem before as per your knowledge?

No I have not. You and poster from previously linked discussion in mailing-list are the first guys I know who are using CKM_EXTRACT_KEY_FROM_KEY mechanism.

Please find the log:

I don't see any obvious error in the log so I guess your best bet is to contact SafeNet support. I would be grateful if you could share the result here.

[ratihS]

Hi Jariq,

Apparently we need to set the configuration to be pure PKCS#11 instead of using FIPS or others.
After setting of the security of the token, we manage to perform the CKM_EXTRACT_KEY_FROM_KEY just fine.

Thank you for your help,

[jariq]

Thanks for sharing the solution!