src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11TlsMasterSecretGenerator.java

@@ -145,22 +145,28 @@
         Session session = null;
         try {
             session = token.getObjSession();
             CK_ATTRIBUTE[] attributes = token.getAttributes(O_GENERATE,
                 CKO_SECRET_KEY, CKK_GENERIC_SECRET, new CK_ATTRIBUTE[0]);
-            long keyID = token.p11.C_DeriveKey(session.id(),
+            p11Key.incNativeKeyRef();
+            long keyID;
+            try {
+                keyID = token.p11.C_DeriveKey(session.id(),
                 new CK_MECHANISM(mechanism, params), p11Key.keyID, attributes);
+            } finally {
+                p11Key.decNativeKeyRef();
+            }
             int major, minor;
             if (params.pVersion == null) {
                 major = -1;
                 minor = -1;
             } else {
                 major = params.pVersion.major;
                 minor = params.pVersion.minor;
             }
             SecretKey key = P11Key.masterSecretKey(session, keyID,
-                "TlsMasterSecret", 48 << 3, attributes, major, minor);
+                "TlsMasterSecret", 48 << 3, attributes, major, minor, true);
             return key;
         } catch (Exception e) {
             throw new ProviderException("Could not generate key", e);
         } finally {
             token.releaseSession(session);