RFR: 8368073: PKCS11 HKDF can't use byte array IKM in FIPS mode [v2]

[Daniel Jeliński]

On Mon, 22 Sep 2025 23:52:04 GMT, Valerie Peng <valeriep at openjdk.org> wrote:

>> Daniel Jeliński has updated the pull request incrementally with one additional commit since the last revision:
>> 
>>   Address review comments
>
> src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11HKDF.java line 178:
> 
>> 176:             if (!isExtract || !"RAW".equalsIgnoreCase(baseKey.getFormat())) {
>> 177:                 throw pe;
>> 178:             }
> 
> How about merging line 202-207 with this code block, so that the key/data conversion is together.
> 
> +        long baseKeyID = 0L;
> +        P11Key p11BaseKey = null;
> +        try {
> +            p11BaseKey = convertKey(baseKey, (isExtract ? "IKM" : "PRK") +
> +                    " could not be converted to a token key for HKDF derivation.");
> +            baseKeyID = p11BaseKey.getKeyID();
> +        } catch (ProviderException pe) {
> +            // special handling for FIPS mode when key cannot be imported
> +            if (isExtract && "RAW".equalsIgnoreCase(baseKey.getFormat())) {
> +                baseKeyID = convertKeyToData(baseKey);
> +            } else {
> +                throw pe;
> +            }
> +        }

Done.

> test/jdk/sun/security/pkcs11/tls/tls12/nss.cfg line 14:
> 
>> 12: 
>> 13: attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET) = {
>> 14:   CKA_SIGN = true
> 
> also add `CKA_EXTRACTABLE = false` ?

I'd rather not. That would disable key extraction, and would likely bring back [JDK-6913047](https://bugs.openjdk.org/browse/JDK-6913047)

-------------

PR Review Comment: https://git.openjdk.org/jdk/pull/27384#discussion_r2372779361
PR Review Comment: https://git.openjdk.org/jdk/pull/27384#discussion_r2372740241