diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11KDF.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11KDF.java
index e45fb141bc5fb..9d2963892015d 100644
--- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11KDF.java
+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11KDF.java
@@ -108,7 +108,7 @@ protected byte[] engineDeriveData(AlgorithmParameterSpec derivationSpec)
     private <T> T derive(String alg, AlgorithmParameterSpec derivationSpec,
             Class<T> retType) throws InvalidAlgorithmParameterException {
         SecretKey baseKey;
-        SecretKey salt = null;
+        SecretKey salt = EMPTY_KEY;
         byte[] info = null;
         int outLen;
         boolean isExtract = false, isExpand = false;