Cannot set CKA_DERIVE key attribute to true

The behavior you're experiencing with the CKA_DERIVE attribute is actually expected and documented, despite the initial confusion. Let me clarify:

For AWS CloudHSM Client SDK 5, the CKA_DERIVE attribute has specific restrictions:

1. For public keys, CKA_DERIVE must always be set to False. It cannot be set to True for any public key.

2. For secret keys and EC private keys, CKA_DERIVE can be set to either True or False.

The error you're encountering (CKR_ATTRIBUTE_VALUE_INVALID) is likely because you're trying to set CKA_DERIVE to True for a public key in your key pair. This is not allowed.

It's important to note that while key derivation is supported for certain key types, AWS CloudHSM has not fully implemented key derivation function support. In fact, there was a known issue in earlier versions where CKA_DERIVE was not properly handled. This has been partially addressed in more recent versions, where the system now accepts CKA_DERIVE if it is set to False.

If you need to use key derivation, you should only set CKA_DERIVE to True for secret keys or EC private keys. For public keys, always set it to False.

Keep in mind that full support for key derivation functions is still a work in progress for AWS CloudHSM. You may want to check the latest documentation or contact AWS support for the most up-to-date information on the status of key derivation support.
Sources
Modifying PKCS #11 library attributes for AWS CloudHSM Client SDK 5 - AWS CloudHSM
Modifying PKCS #11 library attributes for AWS CloudHSM Client SDK 3 - AWS CloudHSM
Known issues for the PKCS #11 library for AWS CloudHSM - AWS CloudHSM