{"record":{"id":"e415a1130166a702","repo":"slackhq/nebula","slug":"pkcs11-module-gave-us-a-nil-cka-public-key-info-a-e415a1","errorCode":null,"errorMessage":"pkcs11 module gave us a nil CKA_PUBLIC_KEY_INFO, and reading CKA_EC_POINT also failed: %w","messagePattern":"pkcs11 module gave us a nil CKA_PUBLIC_KEY_INFO, and reading CKA_EC_POINT also failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkclient/pkclient_cgo.go","lineNumber":217,"sourceCode":"\tcopy(secret[:], tmpKey[:NoiseKeySize])\n\treturn secret, nil\n}\n\nfunc (c *PKClient) GetPubKey() ([]byte, error) {\n\td, err := c.privKeyObj.Attribute(pkcs11.CKA_PUBLIC_KEY_INFO)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif d != nil && len(d) > 0 {\n\t\treturn formatPubkeyFromPublicKeyInfoAttr(d)\n\t}\n\tc.pubKeyObj, err = c.findDeriveKey(c.id, c.label, false)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"pkcs11 module gave us a nil CKA_PUBLIC_KEY_INFO, and looking up the public key also failed: %w\", err)\n\t}\n\td, err = c.pubKeyObj.Attribute(pkcs11.CKA_EC_POINT)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"pkcs11 module gave us a nil CKA_PUBLIC_KEY_INFO, and reading CKA_EC_POINT also failed: %w\", err)\n\t}\n\tif d == nil || len(d) < 1 {\n\t\treturn nil, fmt.Errorf(\"pkcs11 module gave us a nil or empty CKA_EC_POINT\")\n\t}\n\tswitch len(d) {\n\tcase 65: //length of 0x04 + len(X) + len(Y)\n\t\treturn d, nil\n\tcase 67: //as above, DER-encoded IIRC?\n\t\treturn d[2:], nil\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unknown public key length: %d\", len(d))\n\t}\n}\n","sourceCodeStart":199,"sourceCodeEnd":231,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/pkclient/pkclient_cgo.go#L199-L231","documentation":"After the CKA_PUBLIC_KEY_INFO fallback lookup succeeds, GetPubKey reads CKA_EC_POINT from the located public key object. If reading that attribute fails, this error wraps it, meaning the token refused or could not return the EC point needed to rebuild the public key.","triggerScenarios":"Calling GetPubKey when the token denies access to CKA_EC_POINT (sensitive/extractable policy) or the object handle became invalid, causing pubKeyObj.Attribute(pkcs11.CKA_EC_POINT) to error.","commonSituations":"HSM security policy marking EC_POINT as sensitive; vendor module that does not implement C_GetAttributeValue for EC_POINT; session/token state invalidated mid-operation; object deleted between lookup and attribute read.","solutions":["Relax the token's attribute policy so CKA_EC_POINT is readable, or provision CKA_PUBLIC_KEY_INFO so the fallback isn't needed.","Re-run after re-login — stale session/object handles can cause attribute read failures.","Check vendor module capabilities; some tokens require different mechanisms to export the EC point.","Regenerate the key with public attributes marked CKA_TOKEN=true and readable."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"pub, err := client.GetPubKey()\nif err != nil {\n  if strings.Contains(err.Error(), \"reading CKA_EC_POINT also failed\") {\n    // fallback: rebuild from cached/known public key or re-login and retry once\n    if e := client.relogin(); e == nil { pub, err = client.GetPubKey() }\n  }\n  if err != nil { return err }\n}","preventionTips":["Configure token policy so EC_POINT is readable (not sensitive) for non-private attributes.","Prefer provisioning CKA_PUBLIC_KEY_INFO so the EC_POINT fallback path is never used.","Re-create sessions after token events (removal/reinsert, PIN retries) instead of reusing stale handles.","Test the full GetPubKey path on a staging token with the same vendor module version."],"tags":["pkcs11","hsm","attribute-access-denied"],"backgroundTag":"hsm-attribute-read-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}