OpenSSL pkcs11-provider cannot load ATECC608B private key because CKA_ALWAYS_AUTHENTICATE returns CKR_ARGUMENTS_BAD

[alveenarifat]

This issue is related to #412.

I commented on the closed issue with additional findings but did not receive a response. Since the issue is closed, I am opening a new report because I have reproduced the problem on the latest CryptoAuthLib release (3.8.0) and believe I have isolated the root cause.

Environment

• CryptoAuthLib 3.8.0
• OpenSSL 3.0.20
• pkcs11-provider
• Raspberry Pi OS on Raspberry Pi 5
• ATECC608B Trust&GO

Original behavior

openssl req fails because the PKCS#11 provider cannot load the private key.

Running

pkcs11-tool --list-objects

reports

C_GetAttributeValue(ALWAYS_AUTHENTICATE)
CKR_ARGUMENTS_BAD

I investigated the PKCS#11 implementation and found that the error originates from pkcs11_key_auth_required().

For CA devices the function executes:

if (atcab_is_ca_device(...))
{
#if ATCA_CA_SUPPORT
    ((void)pAttribute);
#endif
}

Since rv is initialized as

CK_RV rv = CKR_ARGUMENTS_BAD;

and is never modified in the CA-device branch, the function always returns CKR_ARGUMENTS_BAD.

Diagnostic test

For diagnostic purposes only, I temporarily replaced the implementation with:

static CK_RV pkcs11_key_auth_required(
    CK_VOID_PTR pObject,
    CK_ATTRIBUTE_PTR pAttribute,
    pkcs11_session_ctx_ptr session_ctx)
{
    if (NULL == pObject || NULL == pAttribute || NULL == session_ctx)
    {
        return CKR_ARGUMENTS_BAD;
    }

    return pkcs11_attrib_false(pObject, pAttribute, session_ctx);
}

After rebuilding and reinstalling CryptoAuthLib:

• pkcs11-tool no longer reports the ALWAYS_AUTHENTICATE error.
• openssl storeutl successfully loads the PKCS#11 private key.
• openssl req successfully generates a CSR using the hardware-backed private key.
• openssl req -verify verifies the CSR successfully.

For example:

PKCS11 EC Private Key (256 bits)
Total found: 1

Certificate request self-signature verify OK

This suggests that the OpenSSL interoperability issue is caused by CKA_ALWAYS_AUTHENTICATE returning CKR_ARGUMENTS_BAD for CA devices.

The modification above is not intended as a proposed fix. It was used only to verify the root cause.

Could you clarify whether the CA-device implementation of pkcs11_key_auth_required() is incomplete, or whether CKA_ALWAYS_AUTHENTICATE is expected to return CK_FALSE for ATECC608 devices?

[Srinivas-E]

Hi @alveenarifat
Thank you for posting additional info on it. Sorry about the closure of #412, but we can take the combined discussions in this thread.
We have not yet prioritized this task, we will keep you posted.