On Fri, 19 Sep 2025 08:32:41 GMT, Daniel Jeliński <[email protected]> wrote:
> Enable HDKF to work with providers that do not allow secret keys to be
> created from arbitrary data.
>
> This permits the TLS 1.3 handshake to complete with SunPKCS11 provider backed
> by NSS in FIPS mode.
>
> I added a TLS 1.3 test case to an existing test. The new test passes with the
> HKDF changes, fails without them. Other tier1-3 tests continue to pass.
test/jdk/sun/security/pkcs11/tls/tls12/nss.cfg line 14:
> 12:
> 13: attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET) = {
> 14: CKA_SIGN = true
also add `CKA_EXTRACTABLE = false` ?
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/27384#discussion_r2370679569
