diff -up jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11KeyWrapper.c.cfu jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11KeyWrapper.c
--- jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11KeyWrapper.c.cfu	2011-10-18 09:16:08.362000000 -0700
+++ jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11KeyWrapper.c	2011-10-19 17:55:01.162000000 -0700
@@ -283,8 +283,9 @@ Java_org_mozilla_jss_pkcs11_PK11KeyWrapp
     status = PK11_WrapPrivKey(slot, wrapping, toBeWrapped, mech, param,
                 &wrapped, NULL /* wincx */ );
     if(status != SECSuccess) {
-        JSS_throwMsg(env, TOKEN_EXCEPTION,
-                "Wrapping operation failed on token");
+        char err[256] = {0};
+        PR_snprintf(err, 256, "Wrapping operation failed on token:%d", PR_GetError());
+        JSS_throwMsg(env, TOKEN_EXCEPTION, err);
         goto finish;
     }
     PR_ASSERT(wrapped.len>0 && wrapped.data!=NULL);
@@ -328,11 +329,15 @@ Java_org_mozilla_jss_pkcs11_PK11KeyWrapp
     int numAttribs = 0;
     CK_TOKEN_INFO tokenInfo;
 
+    /* ideal defaults */
     PRBool isSensitive = PR_TRUE;
     PRBool isExtractable = PR_FALSE;
-    /* special case nethsm*/
+
+    /* special case nethsm and lunasa*/
     CK_UTF8CHAR nethsmLabel[4] = {'N','H','S','M'};
+    CK_UTF8CHAR lunasaLabel[4] = {'l','u','n','a'};
     PRBool isNethsm = PR_TRUE;
+    PRBool isLunasa = PR_TRUE;
 
     if( JSS_PK11_getTokenSlotPtr(env, tokenObj, &slot) != PR_SUCCESS) {
         /* exception was thrown */
@@ -347,9 +352,17 @@ Java_org_mozilla_jss_pkcs11_PK11KeyWrapp
                break;
             }
         }
+        ix = 0;
+        for(ix=0; ix < 4; ix++) {
+            if (tokenInfo.label[ix] != lunasaLabel[ix]) {
+               isLunasa = PR_FALSE;
+               break;
+            }
+        }
 
     } else {
         isNethsm = PR_FALSE;
+        isLunasa = PR_FALSE;
     }
 
     /* get unwrapping key */
@@ -412,23 +425,25 @@ Java_org_mozilla_jss_pkcs11_PK11KeyWrapp
     }
     keyType = PK11_GetKeyType(keyTypeMech, 0);
 
+    /* special case nethsm and lunasa*/
     if( isNethsm ) {
         isSensitive = PR_FALSE;
         isExtractable = PR_FALSE;
+    } else if ( isLunasa) {
+        isSensitive = PR_FALSE;
+        isExtractable = PR_TRUE;
     }
 
-setAttrs:
     /* figure out which operations to enable for this key */
     switch (keyType) {
     case CKK_RSA:
+        numAttribs = 3;
         attribs[0] = CKA_SIGN;
         attribs[1] = CKA_SIGN_RECOVER;
         attribs[2] = CKA_UNWRAP;
         if (isExtractable) {
             attribs[3] = CKA_EXTRACTABLE;
             numAttribs = 4;
-        } else {
-            numAttribs = 3;
         }
 	break;
     case CKK_DSA:
@@ -459,7 +474,9 @@ setAttrs:
                 &label, pubValue, token, isSensitive /*sensitive*/, keyType,
                 attribs, numAttribs, NULL /*wincx*/);
     if( privk == NULL ) {
-        JSS_throwMsg(env, TOKEN_EXCEPTION, "Key Unwrap failed on token");
+        char err[256] = {0};
+        PR_snprintf(err, 256, "Key Unwrap failed on token:%d", PR_GetError());
+        JSS_throwMsg(env, TOKEN_EXCEPTION, err);
         goto finish;
     }
                 
diff -up jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11KeyWrapper.java.cfu jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11KeyWrapper.java
--- jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11KeyWrapper.java.cfu	2011-10-18 15:29:50.597000000 -0700
+++ jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11KeyWrapper.java	2011-10-18 15:49:40.073000000 -0700
@@ -322,10 +322,13 @@ final class PK11KeyWrapper implements Ke
             throw new InvalidKeyException("key to be wrapped is not a "+
                 "PKCS #11 key");
         }
+/* NSS is capable of moving keys appropriately,
+   so this call is prematurely bailing
         if( ! symKey.getOwningToken().equals(token) ) {
             throw new InvalidKeyException("key to be wrapped does not live"+
                 " on the same token as the wrapping key");
         }
+*/
     }
 
     /**
@@ -340,10 +343,13 @@ final class PK11KeyWrapper implements Ke
             throw new InvalidKeyException("key to be wrapped is not a "+
                 "PKCS #11 key");
         }
+/* NSS is capable of moving keys appropriately,
+   so this call is prematurely bailing
         if( ! privKey.getOwningToken().equals(token) ) {
             throw new InvalidKeyException("key to be wrapped does not live"+
                 " on the same token as the wrapping key");
         }
+*/
     }
 
     /**
diff -up jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11Token.java.cfu jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11Token.java
--- jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11Token.java.cfu	2011-10-18 14:34:32.148000000 -0700
+++ jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkcs11/PK11Token.java	2011-10-18 14:35:20.402000000 -0700
@@ -135,10 +135,13 @@ public final class PK11Token implements 
     getKeyWrapper(KeyWrapAlgorithm algorithm)
         throws NoSuchAlgorithmException, TokenException
     {
+/* NSS is capable of finding the right token to do algorithm,
+   so this call is prematurely bailing
         if( ! doesAlgorithm(algorithm) ) {
             throw new NoSuchAlgorithmException(
                 algorithm+" is not supported by this token");
         }
+*/
         return new PK11KeyWrapper(this, algorithm);
     }
 
diff -up jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java.cfu jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java
--- jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java.cfu	2011-10-18 09:24:13.796001000 -0700
+++ jss-4.2.6/mozilla/security/jss/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java	2011-10-18 15:41:24.687000000 -0700
@@ -243,7 +243,7 @@ public class EncryptedPrivateKeyInfo imp
         }
 
         KeyWrapper wrapper = token.getKeyWrapper(
-                KeyWrapAlgorithm.DES3_CBC);
+                KeyWrapAlgorithm.DES3_CBC_PAD);
         wrapper.initWrap(key, params);
         byte encrypted[] = wrapper.wrap(pri);
 
@@ -260,6 +260,7 @@ public class EncryptedPrivateKeyInfo imp
         return epki;
 
       } catch (Exception e) {
+        System.out.println("createPBE: exception:"+e.toString());
         Assert.notReached("EncryptedPrivateKeyInfo exception:"
             +".createPBE");
       }