Re: the better slot?

On Fri, 29 May 2026 at 09:42, Andrew Cagney <[email protected]> wrote:

> > - the IKE_SA_INIT exchange generates a KE DH secret
> > - this secret is fed into the KDF which returns keymat and a key D
> > with slot A (I'm not sure where that slot came from)
> > - the IKE_INTERMEDIATE exchange generates an ADDKE ML_KEM secret with
> > an ML_KEM slot
> > - D+ADDKE are then fed into the KDF (CKM_NSS_IKE_PRF_DERIVE) which
> > barfs (fails gracefully) because ADDKE (.hNewKey) isn't in D's slot
>
> We've figured out it has something to do with the on-disk NSS DB -
> copy one DB to a new machine and the problem appears there.

Here are some notes.

- the first exchange gets an ECP slot
- the hack:
208         * The key returned above doesn't play well with PK11_Derive()
209         * - "softokn" fails to extract its value when trying to
210         * CKM_CONCATENATE_BASE_AND_KEY - work around this by
211         * returning a copy of the key.
may switch slots
- the second exchange gets an ML_KEM slot
- the ML_KEM slot and the hack don't agree

On a machine that "works":
- module load populates pk11_ecSlotList with NSS Internal
Cryptographic Services slot mechanism 4161 which I assume is something
like ECC in
Flags: RSA:ECC:EDDSA:DH:RC2:RC4:DES:AES:CAMELLIA:SEED:SHA1:SHA256:SHA512:MD5:MD2:SSL:TLS
- ECP uses the NSS Internal Cryptographic Services slot from pk11_ecSlotList
- the hack leaves things on that slot
- ML_KEM  uses the NSS Internal Cryptographic Services slot from pk11_ecSlotList
-> no clash, no problem

On a machine that "doesn't work":
- pk11_ecSlotList is not populated during module load because NSS
Internal PKCS #11 Module only has:
Flags: RSA:DH:RC2:RC4:DES:AES:CAMELLIA:SEED:SHA1:SHA256:SHA512:MD5:MD2:SSL:TLS
- ECP gets back an empty pk11_ecSlotList so picks "NSS Certificate DB"
from the list (NSS Certificate DB, NSS Generic Crypto Services)
returned by PK11_GetAllTokens()
- the hack moves the ECP from "NSS Certificate DB" to "NSS Generic
Crypto Services"
- ML_KEM, like ECP, ends up with NSS Certificate DB
=> hence the clash

I guess this leaves the question:

Do slots have any (multi threaded) performance implications?  For
instance, in the above, I've a suspicion that D's slot is being shared
across threads and is very long lived

-- 
You received this message because you are subscribed to the Google Groups "[email protected]" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-tech-crypto/CAJeAr6t7KramZdMKanNR_QjfiwhXkDWDx0yoC8sSZOW2Q6e-EA%40mail.gmail.com.