aws cloudhsm C_FindObjectsInit CKR_ATTRIBUTE_TYPE_INVALID

Question

Using iaik.pkcs.pkcs11 wrapper to communicate with cloudhsm on ubuntu.

When trying to retrieve all public keys of class RSAPublicKey I get this exception:

iaik.pkcs.pkcs11.wrapper.PKCS11Exception: CKR_ATTRIBUTE_TYPE_INVALID
at iaik.pkcs.pkcs11.wrapper.PKCS11Implementation.C_FindObjectsInit(Native Method)
at iaik.pkcs.pkcs11.Session.findObjectsInit(Session.java:642)

Using the logging pkcs11 wrapper I managed to find:

0x00002b8c : 0x438b4700 : Calling C_FindObjectsInit
0x00002b8c : 0x438b4700 : Input
0x00002b8c : 0x438b4700 :  hSession: 10240
0x00002b8c : 0x438b4700 :  pTemplate: 0x7f2a58031f60
0x00002b8c : 0x438b4700 :  ulCount: 4
0x00002b8c : 0x438b4700 :   *** Begin attribute template ***
0x00002b8c : 0x438b4700 :   Attribute 0
0x00002b8c : 0x438b4700 :    Attribute: 256 (CKA_KEY_TYPE)
0x00002b8c : 0x438b4700 :    pValue: 0x7f2a58011c10
0x00002b8c : 0x438b4700 :    ulValueLen: 8
0x00002b8c : 0x438b4700 :    *pValue: HEX(0000000000000000)
0x00002b8c : 0x438b4700 :   Attribute 1
0x00002b8c : 0x438b4700 :    Attribute: 1073743360 (CKA_ALLOWED_MECHANISMS)
0x00002b8c : 0x438b4700 :    pValue: 0x7f2a58031ed0
0x00002b8c : 0x438b4700 :    ulValueLen: 32
0x00002b8c : 0x438b4700 :    *pValue: HEX(4300000000000000440000000000000045000000000000000D00000000000000)
0x00002b8c : 0x438b4700 :   Attribute 2
0x00002b8c : 0x438b4700 :    Attribute: 264 (CKA_SIGN)
0x00002b8c : 0x438b4700 :    pValue: 0x7f2a5802f450
0x00002b8c : 0x438b4700 :    ulValueLen: 1
0x00002b8c : 0x438b4700 :    *pValue: HEX(01)
0x00002b8c : 0x438b4700 :   Attribute 3
0x00002b8c : 0x438b4700 :    Attribute: 0 (CKA_CLASS)
0x00002b8c : 0x438b4700 :    pValue: 0x7f2a5802f470
0x00002b8c : 0x438b4700 :    ulValueLen: 8
0x00002b8c : 0x438b4700 :    *pValue: HEX(0300000000000000)
0x00002b8c : 0x438b4700 :   *** End attribute template ***
0x00002b8c : 0x438b4700 : Returning 18 (CKR_ATTRIBUTE_TYPE_INVALID)

but cannot understand what's the problem. The mechanisms should all be allowed properly as well by cloudhsm.

Answer 1

From AWS support on this issue: cloudhsm does not accept any allowed mechanism attributes for the C_FindObjectsInit call.

Answer 2

If I read output of pkcs11-logger correctly then this is your search template:

CKA_CLASS = CKO_PRIVATE_KEY
CKA_KEY_TYPE = CKK_RSA
CKA_SIGN = CK_TRUE
CKA_ALLOWED_MECHANISMS = { CKM_SHA256_RSA_PKCS_PSS, CKM_SHA384_RSA_PKCS_PSS, CKM_SHA512_RSA_PKCS_PSS, CKM_RSA_PKCS_PSS }

It seems completely fine to me.

Unfortunately PKCS#11 API does not provide details which exact attribute from supplied template caused CKR_ATTRIBUTE_TYPE_INVALID error but many PKCS#11 libraries support some kind of internal logging mechanism which may reveal the real cause of error. Exact steps needed to enable logging should be present in the documentation provided by the PKCS#11 library vendor.