808bits

CKR_TEMPLATE_INCOMPLETE

PKCS#11 return value · 0x000000D0 · decimal 208
hex 0x000000D0 decimal 208 name CKR_TEMPLATE_INCOMPLETE

Object classes have attributes that must be present at creation, and this is the code for a template that lacks one. Which attributes are mandatory changes with the function, since creating, generating and unwrapping each have their own list, and it changes again with the token, because a vendor may require something the specification calls optional. The library seldom says which attribute it wanted.

What the token is reporting

The template, together with the defaults and whatever the function itself contributes, does not fully specify the object. A required attribute is absent. Nothing was created.

Likely causes

Ordered by how often they turn out to be the answer. That ordering is a judgement from experience, not a measured frequency.

CKA_CLASS or CKA_KEY_TYPE missing on C_CreateObject

Both are required for any key, and a certificate needs its certificate type. Import code that copies a template from a generate call, where the mechanism supplies the key type, forgets that create has no mechanism to supply it.

Check it: Compare the template against the specification’s table for the class. The footnotes mark which attributes must be present for create.

CKA_VALUE_LEN missing on C_GenerateKey

Generating an AES or generic secret key needs the length, and nothing else in the call supplies it. The same template works for a DES key on some tokens because the length is implied, which is how the omission survives testing.

Check it: Check whether the mechanism produces a fixed-length key. If it does not, the template has to say the length.

A requirement that depends on the function

The same template that creates an object can fail on an unwrap, because unwrap contributes the value and still needs the class and key type stated. A key pair generation has its own list for the public template. The specification marks these with separate footnotes per function, and most readers only look at one.

Check it: Check the footnote for the function you are actually calling, not the one you tested with.

A vendor or library rule beyond the specification

A token may insist on an attribute the specification leaves optional, or report a wrong length for a fixed-length key under this code rather than as a bad value. The library’s log usually names the attribute even when the return code does not.

Check it: Turn on the library’s logging and look for a line naming an attribute just before the failure.

Which calls return it

C_CreateObject, C_GenerateKey, C_GenerateKeyPair, C_UnwrapKey, C_DeriveKey

What it is not

It is not a contradiction between attributes, which is template inconsistent, and not a wrong value, which is attribute value invalid. The attribute in question is simply not there.

Often confused with

By library

SoftHSMv2

Mandatory attributes are checked per function from the specification’s footnotes (P11Objects.cpp), and create insists on class, key type for keys and certificate type for certificates. The surprise is that a DES, DES2 or DES3 key with the wrong CKA_VALUE_LEN is reported as incomplete while AES gets a value error (SoftHSM.cpp). The log line names the length it wanted.

IBM opencryptoki

The base check only insists on the class for create ([template.c](http s://github.com/opencryptoki/opencryptoki/blob/430a47d7478236891ff174d09 6b55e04026981a8/usr/lib/common/template.c#L590-L600)), and each key type checks its own list. The attribute lookup helpers also return this code when an attribute is not found (template.c), so it can come from inside a mechanism that expected an attribute on an existing object.

OpenSC

Object creation and the loader for profile objects are the main sources, and the attribute-finding helpers return it when a required attribute is absent from a template.

Thales Luna

Three native codes map here, and two of them say a private or secret key must carry the sensitive attribute. A template that leaves sensitive unset can fail as incomplete on a Luna where other tokens would default it.

Sources

Every description, cause and check on this page is written from scratch. The specification is cited for the constant's name and its number, which are facts, and for nothing else.