Commit 2f0c3a99ef for strongswan.org

commit 2f0c3a99ef89ad32a51217fe4d49cfb889662eb0
Author: Duc Anh Luu <luuducanh05051995@gmail.com>
Date:   Sun Oct 18 09:39:18 2026 +0700

    pkcs11: Explicitly make derived DH secrets non-sensitive and extractable

    The shared secret is read via CKA_VALUE after deriving it.  However, the
    default for CKA_SENSITIVE is token-specific and some tokens (e.g. SoftHSM)
    mark derived keys as sensitive, in which case reading the value fails with
    CKR_ATTRIBUTE_SENSITIVE.

diff --git a/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c b/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c
index fdf3464a53..bb91459658 100644
--- a/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c
+++ b/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c
@@ -91,9 +91,12 @@ static bool derive_secret(private_pkcs11_dh_t *this, chunk_t other)
 {
 	CK_OBJECT_CLASS klass = CKO_SECRET_KEY;
 	CK_KEY_TYPE type = CKK_GENERIC_SECRET;
+	CK_BBOOL ck_false = CK_FALSE, ck_true = CK_TRUE;
 	CK_ATTRIBUTE attr[] = {
 		{ CKA_CLASS, &klass, sizeof(klass) },
 		{ CKA_KEY_TYPE, &type, sizeof(type) },
+		{ CKA_SENSITIVE, &ck_false, sizeof(ck_false) },
+		{ CKA_EXTRACTABLE, &ck_true, sizeof(ck_true) },
 	};
 	CK_MECHANISM mech = {
 		this->mech_derive,