Merge pull request #329 from BobMDu/bob-cka

8325254: CKA_TOKEN private and secret keys are not necessarily sensitive
ibmruntimes · Feb 29, 2024 · 1ee356f · 1ee356f
2 parents c161fa2 + 338cf0d
commit 1ee356f
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 2 deletions.
diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
@@ -422,8 +422,9 @@ static PrivateKey privateKey(Session session, long keyID, String algorithm,
  new CK_ATTRIBUTE(CKA_EXTRACTABLE),
  });
 
- boolean keySensitive = (attrs[0].getBoolean() ||
- attrs[1].getBoolean() || !attrs[2].getBoolean());
+ boolean keySensitive =
+ (attrs[0].getBoolean() && P11Util.isNSS(session.token)) ||
+ attrs[1].getBoolean() || !attrs[2].getBoolean();
 
  if (keySensitive && (SunPKCS11.mysunpkcs11 != null) && "RSA".equals(algorithm)) {
  try {

diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Util.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Util.java
@@ -44,6 +44,15 @@ private P11Util() {
  // empty
  }
 
+ static boolean isNSS(Token token) {
+ char[] tokenLabel = token.tokenInfo.label;
+ if (tokenLabel != null && tokenLabel.length >= 3) {
+ return (tokenLabel[0] == 'N' && tokenLabel[1] == 'S'
+ && tokenLabel[2] == 'S');
+ }
+ return false;
+ }
+
  static Provider getSunProvider() {
  Provider p = sun;
  if (p == null) {