illumos gate

PKCS#11 defines several errors that deal with invalid object handles:

CKR_OBJECT_HANDLE_INVALID
CKR_KEY_HANDLE_INVALID
CKR_UNWRAPPING_KEY_HANDLE_INVALID
CKR_WRAPPING_KEY_HANDLE_INVALID

The standard also defines that errors are allowed for a given PKCS#11 function. To summarize them, as the error values suggest, arguments that are supposed to be key objects should return CKR_KEY_HANDLE_INVALID if the handle is invalid. When C_{Unwrap,Wrap}Key() is called CKR_{UN}WRAPPING_KEY_HANDLE_INVALID should be returned when the (un)wrapping key object handle is invalid (C_WrapKey() takes two key handle arguments, so this allows disambiguation on error).