slackhq/nebula · error

pkcs11 module gave us a nil or empty CKA_EC_POINT

Error message

pkcs11 module gave us a nil or empty CKA_EC_POINT

What it means

GetPubKey obtained a CKA_EC_POINT attribute value, but it was nil or zero-length, so there is no usable EC point to construct the public key from. The library refuses to continue rather than emit an invalid public key.

Source

Thrown at pkclient/pkclient_cgo.go:220

func (c *PKClient) GetPubKey() ([]byte, error) {
	d, err := c.privKeyObj.Attribute(pkcs11.CKA_PUBLIC_KEY_INFO)
	if err != nil {
		return nil, err
	}
	if d != nil && len(d) > 0 {
		return formatPubkeyFromPublicKeyInfoAttr(d)
	}
	c.pubKeyObj, err = c.findDeriveKey(c.id, c.label, false)
	if err != nil {
		return nil, fmt.Errorf("pkcs11 module gave us a nil CKA_PUBLIC_KEY_INFO, and looking up the public key also failed: %w", err)
	}
	d, err = c.pubKeyObj.Attribute(pkcs11.CKA_EC_POINT)
	if err != nil {
		return nil, fmt.Errorf("pkcs11 module gave us a nil CKA_PUBLIC_KEY_INFO, and reading CKA_EC_POINT also failed: %w", err)
	}
	if d == nil || len(d) < 1 {
		return nil, fmt.Errorf("pkcs11 module gave us a nil or empty CKA_EC_POINT")
	}
	switch len(d) {
	case 65: //length of 0x04 + len(X) + len(Y)
		return d, nil
	case 67: //as above, DER-encoded IIRC?
		return d[2:], nil
	default:
		return nil, fmt.Errorf("unknown public key length: %d", len(d))
	}
}

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Provision CKA_PUBLIC_KEY_INFO on the private key so the primary path is used instead of EC_POINT.
2. Regenerate the keypair on the HSM so the public key object includes valid EC_POINT data.
3. Test with a different PKCS#11 module version that correctly returns attribute values.
4. Inspect the token with pkcs11-tool --read-object to confirm EC point data exists.

// After GetPubKey success, callers can still sanity check
func validNebulaPubKey(d []byte) bool { return len(d) == 65 && d[0] == 0x04 }

func isNonEmptyAttr(d []byte) bool { return len(d) > 0 }

pub, err := client.GetPubKey()
if err != nil {
  if strings.Contains(err.Error(), "nil or empty CKA_EC_POINT") {
    return fmt.Errorf("HSM returned no EC point; re-provision keypair with public attributes: %w", err)
  }
  return err
}

When it happens

Trigger: Calling GetPubKey when pubKeyObj.Attribute(pkcs11.CKA_EC_POINT) succeeds but returns an empty byte slice — a token returning an empty buffer for a nonexistent/unset EC_POINT attribute.

Common situations: Vendor modules that return CKR_OK with length 0 for unsupported attributes instead of erroring; public key object provisioned without EC point data; corrupted token objects.

Related errors

• notImplemented
• error while creating PKCS#11 client: %w
• error while getting public key with PKCS#11: %w
• error while signing with PKCS#11: %w
• error while creating PKCS#11 client: %w

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/2688740a20d3e20f. Report an issue: GitHub.