1890069 - CKM_EC_EDWARDS_KEY_PAIR_GEN for CKK_EC_EDWARDS fails

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[joachim]

Steps to reproduce:

C_GenerateKeyPair with a CKM_EC_EDWARDS_KEY_PAIR_GEN mechanism with a CKK_EC_EDWARDS key type.

Actual results:

Key pair fails to generate due to a failure in pair-wise consistency test (PCT). PCT fails because CKA_DERIVE attribute is erroneously set to CK_TRUE for the generated private key, even though CKK_EC_EDWARDS cannot be used for key derivation (shared secret computation). This results in isDerivable = true and switch (keyType) { ending up in the default case. CKA_DERIVE is erroneously set to CK_TRUE in sftk_handlePrivateKeyObject because CKK_EC, CKK_EC_EDWARDS, and CKK_EC_MONTGOMERY are all handled in the same switch case.

Expected results:

Key pair generation succeeds

Comment 1

[joachim]

Attachment: Bug 1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys r=#nss-reviewers,rrelyea

Comment 2

[John Schanck [:jschanck]]

https://hg.mozilla.org/projects/nss/rev/5bb0eb39d0fc368e5cd275c0fbe3df4cbaeb1459