查找对象后如何更新特定属性。 得到错误方法C_SetAttributeValue返回CKR_ATTRIBUTE_READ_ONLY

Question

I am trying to update an attribute after finding the object. Have tried out different cases.

My creation code:

using (var pkcs11 = new Pkcs11(@"C:\SoftHSM2\lib\softhsm2.dll", AppType.SingleThreaded))
{
    var slot = pkcs11.GetSlotList(SlotsType.WithTokenPresent)[0];
    using (var session = slot.OpenSession(SessionType.ReadWrite))
    {
        session.Login(CKU.CKU_USER, "1111");
        var objectAttributes = new List<ObjectAttribute>
        {
            new ObjectAttribute(CKA.CKA_CLASS, CKO.CKO_DATA),
            new ObjectAttribute(CKA.CKA_TOKEN, true),
            new ObjectAttribute(CKA.CKA_MODIFIABLE, true),
            new ObjectAttribute(CKA.CKA_APPLICATION, txtTypeofData.Text),
            new ObjectAttribute(CKA.CKA_LABEL,txtMsisdn.Text),
            new ObjectAttribute(CKA.CKA_VALUE, "Data object content original " + DateTime.Now)
        };
        var result = session.CreateObject(objectAttributes);
        session.Logout();
    }
}

My modifying code is:

using (Pkcs11 pkcs11 = new Pkcs11(@"C:\SoftHSM2\lib\softhsm2.dll", AppType.MultiThreaded))
{            
    var slot = pkcs11.GetSlotList(SlotsType.WithTokenPresent)[0];
    using (Session session = slot.OpenSession(SessionType.ReadWrite))
    {
        session.Login(CKU.CKU_USER, "1111");
        List<ObjectAttribute> objectAttributes = new List<ObjectAttribute>();
        objectAttributes.Add(new ObjectAttribute(CKA.CKA_CLASS, CKO.CKO_DATA));
        objectAttributes.Add(new ObjectAttribute(CKA.CKA_TOKEN, true));
        objectAttributes.Add(new ObjectAttribute(CKA.CKA_APPLICATION, txtTypeofData.Text));
        objectAttributes.Add(new ObjectAttribute(CKA.CKA_LABEL, txtMsisdn.Text));
        objectAttributes.Add(new ObjectAttribute(CKA.CKA_MODIFIABLE, true));

        var findA = session.FindAllObjects(objectAttributes);
        if(findA != null && findA.Count > 0)
        {
            List<ObjectAttribute> objectAttributesNew = new List<ObjectAttribute>();
            objectAttributesNew.Add(new ObjectAttribute(CKA.CKA_VALUE, "Data object content two changed " + DateTime.Now));
            session.SetAttributeValue(findA[0], objectAttributesNew);                        
        }                   
        session.Logout();
    }
}

Answer 1

The behavior you are observing seems to be specific to SoftHSM implementation. You can find following comment in its source code:

// NOTE: There is no mention in the PKCS#11 v2.40 spec that for a Data
//  Object the CKA_VALUE attribute may be modified after creation!
//  Therefore we assume it is not allowed to change the CKA_VALUE
//  attribute of a Data Object.

Answer 2

Check if CKA_MODIFIABLE is set to TRUE because this attribute indicates whether a Data Object is read-only or not. CKA_MODIFIABLE is by default TRUE and can only be changed by copying the object.

Also, pay attention to this note from the PKCS#11 standard:

attributes which Cryptoki specifies are modifiable may actually not be modifiable on some tokens. That is, if a Cryptoki attribute is described as being modifiable, that really means only that it is modifiable insofar as the Cryptoki specification is concerned. A particular token might not actually support modification of some such attributes.

So, it could be the case that the token is not allowing you to change the attribute and that it's not a problem from your code.