808bits

CKR_ATTRIBUTE_VALUE_INVALID

PKCS#11 return value · 0x00000013 · decimal 19
hex 0x00000013 decimal 19 name CKR_ATTRIBUTE_VALUE_INVALID

This is the narrow attribute error and therefore the useful one: exactly one thing is wrong, and it is a value rather than a combination. The catch is that the token will not say which, so the practical approach is to reduce the template until it works. Most of the time the culprit turns out to be a size rather than anything cryptographic.

What the token is reporting

A single attribute in the template carries a value the token will not accept. The attribute itself is recognised and applicable, which is what separates this from the other two attribute errors.

Likely causes

Ordered by how often they turn out to be the answer. That ordering is a judgement from experience, not a measured frequency.

A boolean of the wrong width

The specification’s boolean type is a single byte. Passing a native integer instead means passing four or eight bytes where one was expected, and the token rejects the value rather than the attribute. This is the most common cause in hand-written C, and the code compiles cleanly.

Check it: Check the size you passed alongside each boolean attribute. It must be one byte. If your code takes the size of an int, that is the bug.

A key length the token will not produce

Every mechanism has a key size range and it is narrower than the algorithm allows in general. Tokens also refuse sizes below a policy floor, so a length that worked years ago can stop working after a firmware update.

Check it: Read the mechanism’s minimum and maximum key size for that slot and compare. Those numbers are per-token, so a value that is fine on one device may be outside the range on another.

Curve parameters in the wrong encoding

Elliptic curve parameters are passed as an encoded structure, and there is more than one way to name a curve. A token that accepts an object identifier will reject a printable curve name, and the mechanism’s own flags say which forms it understands.

Check it: Check the mechanism’s flags for which parameter forms it accepts, then confirm what your library actually encoded. A hex dump of the attribute settles it faster than reading the binding’s documentation.

A label or identifier longer than the token allows

Fixed-width fields are common inside tokens, and an over-long label is rejected rather than truncated.

Check it: Shorten the label to something clearly small and retry. If that works, the limit is the answer and it is worth finding the exact one.

Which calls return it

C_CreateObject, C_GenerateKey, C_GenerateKeyPair, C_SetAttributeValue

What it is not

It is not a contradiction between attributes. If removing one attribute does not help but simplifying the whole template does, you are probably reading the wrong error and should look at the inconsistency code instead.

Often confused with

  • CKR_ATTRIBUTE_TYPE_INVALID: The token does not recognise the attribute at all. That points at a vendor-specific attribute or a version mismatch rather than at the value.
  • CKR_TEMPLATE_INCONSISTENT: No single attribute is at fault. If you cannot find one bad value, that is the more likely code.

Sources

Every description, cause and check on this page is written from scratch. The specification is cited for the constant's name and its number, which are facts, and for nothing else.