luksOpen with pkcs11 token error: The field is sensitive and cannot be revealed

Hello,

I'm working with a secure element and trying to unlock a luks2 partition.

I have successfully enrolled the device with a pkcs11 URI, but when I
attempt to unlock the partition I get:

Failed to get attributes of a found private key: The field is
sensitive and cannot be revealed

Digging into this a bit it seems that the the private key slot is
marked as CKR_ATTRIBUTE_SENSITIVE, which to me makes sense.

I'm confused why this error is happening because it's my understanding
that the purpose of the secure element is to keep the private key safe
and perform the cryptographic operations within the device.  I would
not expect the private key to be returned.

The device is a Microchip ECC608.

Any advice would be appreciated.  Full log below.

Thanks, Matt

cryptsetup luksOpen /dev/mmcblk0p4 test --token-id 0 --token-only --debug
# cryptsetup 2.7.2 processing "cryptsetup luksOpen /dev/mmcblk0p4 test
--token-id 0 --token-only --debug"
# Verifying parameters for command open.
# Running command open.
# Installing SIGINT/SIGTERM handler.
# Unblocking interruption on signal.
# Allocating context for crypt device /dev/mmcblk0p4.
# Trying to open and read device /dev/mmcblk0p4 with direct-io.
# Initialising device-mapper backend library.
# Trying to load any crypt type from device /dev/mmcblk0p4.
# Crypto backend (OpenSSL 3.2.4 11 Feb 2025
[default][legacy][threads][argon2]) initialized in cryptsetup library
version 2.7.2.
# Detected kernel Linux 6.12.22-linux4microchip-2025.04 armv7l.
# Loading LUKS2 header (repair disabled).
# Acquiring read lock for device /dev/mmcblk0p4.
# Opening lock resource file /run/cryptsetup/L_179:4
# Verifying lock handle for /dev/mmcblk0p4.
# Device /dev/mmcblk0p4 READ lock taken.
# Trying to read primary LUKS2 header at offset 0x0.
# Opening locked device /dev/mmcblk0p4
# Verifying locked device handle (bdev)
# LUKS2 header version 2 of size 16384 bytes, checksum sha256.
# Checksum:56ae1c95c37b2df138652ed1c587ce1aa1ee5f38baf80609e04329a3e70cbe5d
(on-disk)
# Checksum:56ae1c95c37b2df138652ed1c587ce1aa1ee5f38baf80609e04329a3e70cbe5d
(in-memory)
# Trying to read secondary LUKS2 header at offset 0x4000.
# Reusing open ro fd on device /dev/mmcblk0p4
# LUKS2 header version 2 of size 16384 bytes, checksum sha256.
# Checksum:5f527aa9c9c9f2343bbd38d27f80d065399b5523d8676987aa0003d0e3b67dec
(on-disk)
# Checksum:5f527aa9c9c9f2343bbd38d27f80d065399b5523d8676987aa0003d0e3b67dec
(in-memory)
# Device size 134217728, offset 16777216.
# Device /dev/mmcblk0p4 READ lock released.
# Only 1 active CPUs detected, PBKDF threads decreased from 4 to 1.
# Not enough physical memory detected, PBKDF max memory decreased from
1048576kB to 76828kB.
# PBKDF argon2i, time_ms 2000 (iterations 0), max_memory_kb 76828,
parallel_threads 1.
# Activating volume test [keyslot -1] using token.
# dm version   [ opencount flush ]   [16384] (*1)
# dm versions   [ opencount flush ]   [16384] (*1)
# Detected dm-ioctl version 4.48.0.
# Detected dm-verity version 1.10.0.
# Detected dm-crypt version 1.28.0.
# Device-mapper backend running with UDEV support enabled.
# dm status test  [ opencount noflush ]   [16384] (*1)
# Trying to load /usr/lib/cryptsetup/libcryptsetup-token-systemd-pkcs11.so.
# Loading symbol cryptsetup_token_open@CRYPTSETUP_TOKEN_1.0.
# Loading symbol cryptsetup_token_buffer_free@CRYPTSETUP_TOKEN_1.0.
# Loading symbol cryptsetup_token_validate@CRYPTSETUP_TOKEN_1.0.
# Loading symbol cryptsetup_token_dump@CRYPTSETUP_TOKEN_1.0.
# Loading symbol cryptsetup_token_open_pin@CRYPTSETUP_TOKEN_1.0.
# Loading symbol cryptsetup_token_version@CRYPTSETUP_TOKEN_1.0.
# Token handler systemd-pkcs11-1.0 systemd-v256.5 (256.5) loaded successfully.
# Requesting JSON for token 0.
No login into security token 'MCHP' required.
Failed to get attributes of a found private key: The field is
sensitive and cannot be revealed
# Token 0 (systemd-pkcs11) open failed with -5.
# Releasing crypt device /dev/mmcblk0p4 context.
# Releasing device-mapper backend.
# Closing read only fd for /dev/mmcblk0p4.
Command failed with code -1 (wrong or missing parameters).
# Unloading systemd-pkcs11 token handler.