CKR_DOMAIN_PARAMS_INVALID
Elliptic curve, Diffie-Hellman and DSA keys are defined relative to a set of domain parameters, and this is the code for a set the token cannot use. For EC keys it nearly always means the curve, either one the token does not implement or one supplied in an encoding it does not parse. For DH and DSA it often means the reverse, parameters given to a generation call that wanted to produce them itself.
What the token is reporting
The domain parameters supplied in the template, or attached to the key you are using, are invalid or unsupported here. For EC that is the parameters attribute, for DH and DSA the prime, base and subprime.Likely causes
Ordered by how often they turn out to be the answer. That ordering is a judgement from experience, not a measured frequency.
A curve the token does not implement
A Koblitz curve on a validated token that only carries the NIST set, a Brainpool curve on a token that never had it, an Edwards curve asked for through the generic EC mechanism rather than the Edwards one. The mechanism is present, the curve behind it is not.Check it: List the token’s curves with the vendor’s own tool. The mechanism information call gives key sizes and says nothing about curves.
Fix: Use a curve the token lists, or the vendor’s own curve constants where it has them.
The EC parameters in the wrong encoding
The parameters attribute is DER, normally an object identifier naming the curve. A bare identifier without the DER tag and length, or the curve’s name as text on a token that only takes identifiers, is refused as invalid rather than as unsupported.Check it: Hex-dump the attribute. A named curve begins with the object identifier tag, which is 06.
DH or DSA parameters supplied to a call that generates them
Generating a domain parameter object means the token chooses the prime, base and subprime. A template that supplies them anyway, copied from a create call, is refused on some libraries under this code.Check it: Remove the prime, base and subprime from a generation template. They belong in a create template only.
Parameters that fail the token's validation
A prime that is not prime, a subprime that does not divide the prime minus one, a group too small for the token’s policy. Tokens that check report the failure here.Check it: Validate the parameters with a general-purpose library before handing them to the token.
Which calls return it
C_GenerateKeyPair, C_CreateObject, C_DeriveKey, C_UnwrapKey
What it is not
It is not the key size, which is key size range, and not the mechanism. The mechanism is fine and the parameters it was asked to work with are not.Often confused with
CKR_CURVE_NOT_SUPPORTED: The newer, narrower code for the first cause. Libraries that have adopted it use it for a missing curve and keep this one for malformed parameters.CKR_KEY_SIZE_RANGE: A supported group of an unsupported size. Some tokens report a curve of the wrong size this way.CKR_ATTRIBUTE_VALUE_INVALID: What a malformed parameters attribute is on libraries that do not use this code at all.
By library
IBM opencryptoki
Returned when a domain parameter template supplies the prime, base or subprime to a generation call, and when a create omits them ([dp_obj.c] (https://github.com/opencryptoki/opencryptoki/blob/430a47d7478236891ff174d096b55e04026981a8/usr/lib/common/dp_obj.c#L224-L250)). Curve problems are reported with the newer curve-not-supported code, which has many more sites in the library than this one.SoftHSMv2
Never returned. An unsupported curve comes back as an attribute value error or a mechanism error.OpenSC
Never returned by the PKCS#11 layer. A card that cannot do a curve fails at the card, and that failure translates to a different code.YubiHSM 2
Never returned. The library reports a curve the device lacks through the attribute and mechanism codes instead.Sources
- PKCS #11 Specification Version 3.2, OASIS. Read 2026-09-10. Used for constant name and numeric value.
Every description, cause and check on this page is written from scratch. The specification is cited for the constant's name and its number, which are facts, and for nothing else.