129563 - C_CopyObject doesn't copy session private keys

Status: NEW

(NSS :: Libraries, defect, P2)

Description

[Jamie Nicolson]

I'm calling C_CopyObject on a session private key, passing in the attribute
CKA_TOKEN==CK_TRUE in order to convert it to a token private key.

The operation fails in pk11_mkPrivKey at this line
crv=pk11_Attribute2SSecItem(arena,&privKey->u.rsa.privateExponent,object
,CKA_PRIVATE_EXPONENT);
This is failing because pk11_FindRSAPrivateKeyAttribute always returns
pk11_StaticNullAttr for the private exponent of an RSA key (pkcs11u.c:718).

Comment 1

[Robert Relyea]

I'm not sure copying token private keys ever worked. We have always cleared out
the Sensitive attributes for Token private keys. What's weird, though, is
mkprivKey should actually be looking the key up in the database, not extracting
it from attributes.

bob

Comment 2

[Jamie Nicolson]

There is a workaround. This bug only occurs for keys that were created with the
CKA_SENSITIVE attribute. If you generate the key with sensitive==false, you can
copy it.

Comment 3

[Wan-Teh Chang]

Moved to 3.4.1.

Comment 4

[Wan-Teh Chang]

Changed the QA contact to Bishakha.

Comment 5

[Wan-Teh Chang]

Moved to NSS 3.5.

Bob, should we fix this bug or mark it WONTFIX?

Jamie, in comment #2 you said there is a workaround.  Would
it be a serious problem for JSS if we don't fix this bug?

Comment 6

[Jamie Nicolson]

I think we can workaround in JSS.

However, if this behavior is not in accordance with the spec, we should fix it
anyway.

Comment 7

[Robert Relyea]

I'm not sure complete PKCS #11 compliance of softoken is necessary for 3.x,
setting target for 4.0 because it's still a noble goal and the bug is still valid.

Comment 8

[Nelson Bolyard (seldom reads bugmail)]

Change bug description to differentiate this bug from bug 289530.
I wonder if this bug has been fixed as a side effect of work on that bug.

Comment 9

[Robert Relyea]

I think it is. It's the mirror the the case where we tried to copy a CKA_TOKEN
private key to a 'Session' private key. The affending code was the code that was
NULL'ing out attributes in pk11_handlePrivateKey.

Comment 10

[Nelson Bolyard (seldom reads bugmail)]

Would be good if we had a PKCS11 test program that checked our ability to 
copy any combination of token/session key to token/session key.

Comment 11

[Robert Relyea]

Any PKCS #11 tests we can add to the suite would be good;).

bob

Comment 12

[Julien Pierre]

Glen, could pk11mode be used to test this ?