{"record":{"id":"2688740a20d3e20f","repo":"slackhq/nebula","slug":"pkcs11-module-gave-us-a-nil-or-empty-cka-ec-point","errorCode":null,"errorMessage":"pkcs11 module gave us a nil or empty CKA_EC_POINT","messagePattern":"pkcs11 module gave us a nil or empty CKA_EC_POINT","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkclient/pkclient_cgo.go","lineNumber":220,"sourceCode":"\nfunc (c *PKClient) GetPubKey() ([]byte, error) {\n\td, err := c.privKeyObj.Attribute(pkcs11.CKA_PUBLIC_KEY_INFO)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif d != nil && len(d) > 0 {\n\t\treturn formatPubkeyFromPublicKeyInfoAttr(d)\n\t}\n\tc.pubKeyObj, err = c.findDeriveKey(c.id, c.label, false)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"pkcs11 module gave us a nil CKA_PUBLIC_KEY_INFO, and looking up the public key also failed: %w\", err)\n\t}\n\td, err = c.pubKeyObj.Attribute(pkcs11.CKA_EC_POINT)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"pkcs11 module gave us a nil CKA_PUBLIC_KEY_INFO, and reading CKA_EC_POINT also failed: %w\", err)\n\t}\n\tif d == nil || len(d) < 1 {\n\t\treturn nil, fmt.Errorf(\"pkcs11 module gave us a nil or empty CKA_EC_POINT\")\n\t}\n\tswitch len(d) {\n\tcase 65: //length of 0x04 + len(X) + len(Y)\n\t\treturn d, nil\n\tcase 67: //as above, DER-encoded IIRC?\n\t\treturn d[2:], nil\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unknown public key length: %d\", len(d))\n\t}\n}\n","sourceCodeStart":202,"sourceCodeEnd":231,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/pkclient/pkclient_cgo.go#L202-L231","documentation":"GetPubKey obtained a CKA_EC_POINT attribute value, but it was nil or zero-length, so there is no usable EC point to construct the public key from. The library refuses to continue rather than emit an invalid public key.","triggerScenarios":"Calling GetPubKey when pubKeyObj.Attribute(pkcs11.CKA_EC_POINT) succeeds but returns an empty byte slice — a token returning an empty buffer for a nonexistent/unset EC_POINT attribute.","commonSituations":"Vendor modules that return CKR_OK with length 0 for unsupported attributes instead of erroring; public key object provisioned without EC point data; corrupted token objects.","solutions":["Provision CKA_PUBLIC_KEY_INFO on the private key so the primary path is used instead of EC_POINT.","Regenerate the keypair on the HSM so the public key object includes valid EC_POINT data.","Test with a different PKCS#11 module version that correctly returns attribute values.","Inspect the token with pkcs11-tool --read-object to confirm EC point data exists."],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"// After GetPubKey success, callers can still sanity check\nfunc validNebulaPubKey(d []byte) bool { return len(d) == 65 && d[0] == 0x04 }","typeGuard":"func isNonEmptyAttr(d []byte) bool { return len(d) > 0 }","tryCatchPattern":"pub, err := client.GetPubKey()\nif err != nil {\n  if strings.Contains(err.Error(), \"nil or empty CKA_EC_POINT\") {\n    return fmt.Errorf(\"HSM returned no EC point; re-provision keypair with public attributes: %w\", err)\n  }\n  return err\n}","preventionTips":["Regenerate keypairs with standard tooling so EC_POINT is populated.","Verify vendor module returns real attribute values (some return empty on unsupported attrs).","Include token object inspection in deployment smoke tests."],"tags":["pkcs11","hsm","empty-attribute"],"backgroundTag":"hsm-empty-derive-output","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}