Don't insist that both keys in a pair must be token objects if either

one is.  Apparently making the public key be a session object is a
standard hack for conserving space on the token.

1 files changed, 2 insertions, 3 deletions

diff --git a/pkcs11.c b/pkcs11.c
index 9997768..2cf704f 100644
--- a/pkcs11.c
+++ b/pkcs11.c
@@ -1796,10 +1796,9 @@ static CK_RV generate_keypair_rsa_pkcs(p11_session_t *session,
   }
 
   /*
-   * We require a key size, and if either key is a token object, the
-   * other must be too.
+   * We require a key size.
    */
-  if (keysize == 0 || public_handle_flavor != private_handle_flavor)
+  if (keysize == 0)
     return CKR_TEMPLATE_INCOMPLETE;
 
   /*