DANH MỤC LỖI PKCS#11

Mã trả về và cách khắc phục

Nhóm lỗi ổn định giúp ứng dụng phân biệt sự kiện session có thể retry với lỗi chính sách hoặc lỗi thiết bị bảo vệ.

Danh mục mã trả về

Return code	Typical cause	Remediation	Retry
CKR_CRYPTOKI_NOT_INITIALIZED	C_Initialize missing/failed	Initialize once under documented threading model	No
CKR_SLOT_ID_INVALID	Unknown or stale slot	Refresh slot list; check failover/token removal	Conditional
CKR_SESSION_HANDLE_INVALID	Session invalidated	Open a new session and re-authenticate	Yes
CKR_USER_NOT_LOGGED_IN	Operation requires role	Login under approved role	Yes
CKR_PIN_LOCKED	Retry threshold exceeded	Follow controlled unlock/recovery	No immediate retry
CKR_MECHANISM_INVALID	Mechanism not in release list	Use approved mechanism/profile	No
CKR_TEMPLATE_INCONSISTENT	Object/key template violates policy	Correct attributes and policy	No automatic retry
CKR_KEY_HANDLE_INVALID	Key missing or handle stale	Rediscover object by CKA_ID	Conditional
CKR_DEVICE_ERROR	Backend/provider failure	Collect correlation; apply approved failover	Conditional
CKR_BUFFER_TOO_SMALL	Caller buffer insufficient	Resize using returned length	Yes

Liên kết kiểm toán

Application logs should record the Cryptoki return code, operation, slot/token identifier, correlation ID and redacted backend reference. They must never log PINs, private-key material or unredacted SAD/credential data.