Currently, the code I am staring at uses the
CKM_EXTRACT_KEY_FROM_KEY mechanism. That has been disabled in our hardware module, so I need a different mechanism to derive a new key from an existing aes key. I don't want to change too much code as I don't know what the ramifications will be. I could use
C_CopyObject, but that is no more secure that the mechanism it would replace, from my very limited understanding of crypto stuff.
What alternatives exist to derive a key from an existing AES key?