Skip to content

Allow call with null pointer for handle key and template - #367

Open
placintaalexandru wants to merge 1 commit into
parallaxsecond:mainfrom
placintaalexandru:Allow-null-ptr
Open

Allow call with null pointer for handle key and template#367
placintaalexandru wants to merge 1 commit into
parallaxsecond:mainfrom
placintaalexandru:Allow-null-ptr

Conversation

@placintaalexandru

@placintaalexandru placintaalexandru commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

Some calls to Thales Luna HSMs allows the following call of C_DeriveKey:

const CK_RV rv = C_DeriveKey( session, &mech, parent, NULL, 0, NULL );

One example is when trying to do bip32 derivation using CKM_BIP32_CHILD_DERIVE CK_BIP32_CHILD_DERIVE_PARAMS. The call works as follows:

  • pTemplate and phKey are null pointers
  • private and public key handles are found in CK_BIP32_CHILD_DERIVE_PARAMS.hPublicKey and CK_BIP32_CHILD_DERIVE_PARAMS.hPrivateKey

At the moment this is not expressable by the cryptoki crate so I was thinking it would be nice to allow it.

I tested this against a Thales Luna Network HSM

If there is interest in this, I can work on making the tests pass as well, which is trivial

Downsides

  1. It breaks the API of derive_key
  2. When allowing the above call, the returned handle contains 0 as value so the return type should be changed as well to better reflect user's intention

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant