RFR: 8368073: PKCS11 HKDF can't use byte array IKM in FIPS mode

[Valerie Peng]

On Fri, 19 Sep 2025 08:32:41 GMT, Daniel Jeliński <djelinski at openjdk.org> wrote:

> Enable HDKF to work with providers that do not allow secret keys to be created from arbitrary data.
> 
> This permits the TLS 1.3 handshake to complete with SunPKCS11 provider backed by NSS in FIPS mode.
> 
> I added a TLS 1.3 test case to an existing test. The new test passes with the HKDF changes, fails without them. Other tier1-3 tests continue to pass.

test/jdk/sun/security/pkcs11/tls/tls12/nss.cfg line 14:

> 12: 
> 13: attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET) = {
> 14:   CKA_SIGN = true

also add `CKA_EXTRACTABLE = false` ?

-------------

PR Review Comment: https://git.openjdk.org/jdk/pull/27384#discussion_r2370679569