Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8350661

PKCS11 HKDF throws ProviderException when requesting a 31-byte AES key

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: P3 P3
    • None
    • 25
    • security-libs
    • None
    • Cause Known

      The following code

              var k = KDF.getInstance("HKDF-SHA256", pkcs11Provider);
              k.deriveKey("AES", HKDFParameterSpec.ofExtract().thenExpand(null, 31));

      fails with

      Exception in thread "main" java.security.ProviderException: HKDF derivation for algorithm 'AES' failed.
      at jdk.crypto.cryptoki/sun.security.pkcs11.P11HKDF.derive(P11HKDF.java:219)
      at jdk.crypto.cryptoki/sun.security.pkcs11.P11HKDF.engineDeriveKey(P11HKDF.java:107)
      at java.base/javax.crypto.KDF.deriveKey(KDF.java:526)
      at Test.main(Test.java:10)
      Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_KEY_SIZE_RANGE
      at jdk.crypto.cryptoki/sun.security.pkcs11.wrapper.PKCS11.C_DeriveKey(Native Method)
      at jdk.crypto.cryptoki/sun.security.pkcs11.P11HKDF.derive(P11HKDF.java:199)
      ... 3 more

      This is user input issue. An InvalidAlgorithmParameterException should be thrown.

            mbalao Martin Balao Alonso
            weijun Weijun Wang
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated: