pkcs11 module gave us a nil CKA_PUBLIC_KEY_INFO, and reading

Error message

pkcs11 module gave us a nil CKA_PUBLIC_KEY_INFO, and reading CKA_EC_POINT also failed: %w

What it means

After the CKA_PUBLIC_KEY_INFO fallback lookup succeeds, GetPubKey reads CKA_EC_POINT from the located public key object. If reading that attribute fails, this error wraps it, meaning the token refused or could not return the EC point needed to rebuild the public key.

Source

Thrown at pkclient/pkclient_cgo.go:217

	copy(secret[:], tmpKey[:NoiseKeySize])
	return secret, nil
}

func (c *PKClient) GetPubKey() ([]byte, error) {
	d, err := c.privKeyObj.Attribute(pkcs11.CKA_PUBLIC_KEY_INFO)
	if err != nil {
		return nil, err
	}
	if d != nil && len(d) > 0 {
		return formatPubkeyFromPublicKeyInfoAttr(d)
	}
	c.pubKeyObj, err = c.findDeriveKey(c.id, c.label, false)
	if err != nil {
		return nil, fmt.Errorf("pkcs11 module gave us a nil CKA_PUBLIC_KEY_INFO, and looking up the public key also failed: %w", err)
	}
	d, err = c.pubKeyObj.Attribute(pkcs11.CKA_EC_POINT)
	if err != nil {
		return nil, fmt.Errorf("pkcs11 module gave us a nil CKA_PUBLIC_KEY_INFO, and reading CKA_EC_POINT also failed: %w", err)
	}
	if d == nil || len(d) < 1 {
		return nil, fmt.Errorf("pkcs11 module gave us a nil or empty CKA_EC_POINT")
	}
	switch len(d) {
	case 65: //length of 0x04 + len(X) + len(Y)
		return d, nil
	case 67: //as above, DER-encoded IIRC?
		return d[2:], nil
	default:
		return nil, fmt.Errorf("unknown public key length: %d", len(d))
	}
}

View on GitHub (pinned to dd8f660c0a)

Solutions

Relax the token's attribute policy so CKA_EC_POINT is readable, or provision CKA_PUBLIC_KEY_INFO so the fallback isn't needed.
Re-run after re-login — stale session/object handles can cause attribute read failures.
Check vendor module capabilities; some tokens require different mechanisms to export the EC point.
Regenerate the key with public attributes marked CKA_TOKEN=true and readable.

Defensive patterns

Strategy: fallback

Try / catch

pub, err := client.GetPubKey()
if err != nil {
  if strings.Contains(err.Error(), "reading CKA_EC_POINT also failed") {
    // fallback: rebuild from cached/known public key or re-login and retry once
    if e := client.relogin(); e == nil { pub, err = client.GetPubKey() }
  }
  if err != nil { return err }
}

Prevention

Configure token policy so EC_POINT is readable (not sensitive) for non-private attributes.
Prefer provisioning CKA_PUBLIC_KEY_INFO so the EC_POINT fallback path is never used.
Re-create sessions after token events (removal/reinsert, PIN retries) instead of reusing stale handles.
Test the full GetPubKey path on a staging token with the same vendor module version.

When it happens

Trigger: Calling GetPubKey when the token denies access to CKA_EC_POINT (sensitive/extractable policy) or the object handle became invalid, causing pubKeyObj.Attribute(pkcs11.CKA_EC_POINT) to error.

Common situations: HSM security policy marking EC_POINT as sensitive; vendor module that does not implement C_GetAttributeValue for EC_POINT; session/token state invalidated mid-operation; object deleted between lookup and attribute read.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/e415a1130166a702. Report an issue: GitHub.