808bits

CKR_ARGUMENTS_BAD

PKCS#11 return value · 0x00000007 · decimal 7
hex 0x00000007 decimal 7 name CKR_ARGUMENTS_BAD

Unlike most codes here, this one really is about your call. The library checked the arguments, found something it could not work with, and stopped before involving the token at all. The awkward case is the second one below, where the arguments look perfectly reasonable and the mechanism requires them to be empty, because nothing in the call site suggests that.

What the token is reporting

One of the arguments failed the library’s own validation. Usually a null pointer where one is required, a count that does not match the array it describes, or a structure whose size field disagrees with its type.

Likely causes

Ordered by how often they turn out to be the answer. That ordering is a judgement from experience, not a measured frequency.

A null pointer or a mismatched count

The ordinary case. A template pointer with a count of zero, a count that does not match the array, or an output length pointer that was never set. In languages with a binding layer this often comes from the binding rather than from your own code.

Check it: Log the pointers and counts immediately before the call. If you are going through a binding, log them on the far side of it too, because bindings are where lengths get lost.

The mechanism requires the arguments to be empty

Some mechanisms take everything through their parameter structure and require the ordinary arguments to be null. A derivation that produces two keys cannot report them through a single output pointer, so it takes templates and returns handles inside its own parameters, and passing anything in the normal positions is an error.

Check it: Read the mechanism’s own documentation rather than the generic description of the function. If the parameter structure contains templates or output handles, the ordinary arguments are almost certainly required to be null.

A structure whose size does not match its declaration

The parameter length passed alongside a mechanism must match the structure the library expects. A version mismatch between the header you compiled against and the library you loaded changes a structure’s size and produces exactly this.

Check it: Compare the library version you loaded against the header version you built with. If they differ, that is the first thing to fix, because nothing else will be reliable either.

Which calls return it

C_Initialize, C_GetSlotList, C_DeriveKey, C_GetAttributeValue

What it is not

It is not about permissions, keys or policy. Nothing was asked of the token, so no amount of logging in will change it.

By library

Thales Luna

A worked example of the awkward case. The BIP32 master derivation mechanism derives a key pair rather than a single key, so it takes both templates and returns both handles through its own parameter structure. The documentation states that the last three arguments to the derive call must be null or zero, and returns this code if any of them is not. A caller filling them in the ordinary way is writing a correct-looking call that cannot work.

Sources

Every description, cause and check on this page is written from scratch. The specification is cited for the constant's name and its number, which are facts, and for nothing else.