8325254: CKA_TOKEN private and secret keys are not necessarily sensitive

Backport-of: 0f5f3c9b9718c610406088327401210486447462
openjdk · Feb 23, 2024 · c80bb72 · c80bb72 · openjdk-notifier · Feb 23, 2024
1 parent e69b611
commit c80bb72
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
@@ -401,8 +401,9 @@ static PrivateKey privateKey(Session session, long keyID, String algorithm,
                     new CK_ATTRIBUTE(CKA_EXTRACTABLE),
         });
 
-        boolean keySensitive = (attrs[0].getBoolean() ||
-                attrs[1].getBoolean() || !attrs[2].getBoolean());
+        boolean keySensitive =
+                (attrs[0].getBoolean() && P11Util.isNSS(session.token)) ||
+                attrs[1].getBoolean() || !attrs[2].getBoolean();
 
         return switch (algorithm) {
             case "RSA" -> P11RSAPrivateKeyInternal.of(session, keyID, algorithm,