The PKCS #11 2.40 spec is a little ambiguous in its description of whether an object handle retrieved using session A can be used in session B to the same token.
The main spec states (all emphasis below is mine):
A particular object on a token does not necessarily have a handle which is fixed for the lifetime of the object; however, if a particular session can use a particular handle to access a particular object, then that session will continue to be able to use that handle to access that object as long as the session continues to exist, the object continues to exist, and the object continues to be accessible to the session.
While the usage guide states:
Object handles are similar to session handles in the sense that visibility of a given object through an object handle is the same among all threads of a given application.
Note that a Cryptoki implementation may or may not support separate spaces of handles for sessions and objects.
Finally, the usage guide includes a scenario, of which steps 16, 17 and 18 suggest you can use the same object handles. But the wording used is "the object associated with object handle 1", so it's not 100% clear that the handle was valid to use:
A1 uses [A’s] session 4 to perform an object search operation to get a handle for O2. The search returns object handle 1....
A1 attempts to use [A’s] session 4 to modify the object associated with [A’s] object handle 1. The attempt fails, because A’s session 4 is a R/O session, and is therefore incapable of modifying O2, which is a token object....
A1 uses [A’s] session 7 to modify the object associated with [A’s] object handle 1. This time, since A’s session 7 is a R/W session, the attempt succeeds in modifying O2
Can anyone comment definitively on this topic? Or point to another part of the spec that unambiguously defines this?