Skip to content

Hardening fixes for examples, fwTPM command handlers, and crypto helpers#503

Open
aidangarske wants to merge 43 commits into
wolfSSL:masterfrom
aidangarske:fenrir-fixes-11
Open

Hardening fixes for examples, fwTPM command handlers, and crypto helpers#503
aidangarske wants to merge 43 commits into
wolfSSL:masterfrom
aidangarske:fenrir-fixes-11

Conversation

@aidangarske
Copy link
Copy Markdown
Member

@aidangarske aidangarske commented May 12, 2026 •
edited
Loading 

F-3708, F-3709, F-3710, F-3711, F-3712, F-3713, F-3714, F-3715,
F-3716, F-3717, F-3718, F-3719, F-3720, F-3721, F-3722, F-3723,
F-3918, F-3919, F-3920, F-3921, F-3922, F-3923, F-3924, F-3925,
F-3926, F-3927, F-3928, F-3929, F-3930, F-3931

aidangarske added 30 commits May 11, 2026 20:03
@aidangarske
F-3708 - Zero-initialize TBS_CONTEXT_PARAMS2 in TPM2_WinApi_SendCommand
a8947e6
@aidangarske
F-3709 - NULL check wolfTPM2_NewKeyBlob in external_import
fc87b4b
@aidangarske
F-3710 - Use goto exit on TPM2_LoadExternal failure in make_credential
25ccf1c
@aidangarske
F-3711 - Set rc on cert/key buffer load failure in tls_client_notpm
e9d4f58
@aidangarske
F-3918 - Bounds check pcrArray writes in secret_unseal and policy_sign
65e0daa
@aidangarske
F-3919 - Treat swtpm response size as uint32_t and bound below by header
1a91936
@aidangarske
F-3924 - Reject non-aligned size in block modes for EncryptDecryptBlock
660d3e7
@aidangarske
F-3722 - Reject x509sign keyHandle in FwCmd_Sign
22c7b40
@aidangarske
F-3920 - Bitwise AND poll revents to accept POLLIN|POLLHUP
256faf9
@aidangarske
F-3921 - Restore goto exit on TPM2_ObjectChangeAuth failure in native…
6d90662 
…_test
@aidangarske
F-3922 - Clamp -auth length in keygen example
069dd33
@aidangarske
F-3926 - Clamp -ownerauth length in seal_nv example
4e16a16
@aidangarske
F-3927 - Clamp -password length in keyimport example
c13dc57
@aidangarske
F-3925 - Scale AES wrap to key strength in DecodeRsaDer and DecodeEccDer
1c06cba
@aidangarske
F-3716 - ForceZero encKeyBuf and importedAuth in FwCmd_Import
d695c06
@aidangarske
F-3717 - ForceZero authValue in FwCmd_LoadExternal
c4c1fb6
@aidangarske
F-3718 - ForceZero SPDM vdMsg/vdRsp plaintext buffers before release
fc35f9e
@aidangarske
F-3928 - ForceZero dataBuf in FwCmd_NV_Write before release
acefdd2
@aidangarske
F-3720 - Zero in.auth on BAD_FUNC_ARG paths in NVCreateAuthPolicy_ex
1b6fcae
@aidangarske
F-3721 - ForceZero HMAC/hash context in TPM2_KDFa_ex and TPM2_KDFe_ex
558dcc9
@aidangarske
F-3931 - ForceZero GetRandom_Out in wolfTPM2_GetRandom
e7de853
@aidangarske
F-3712 - Branch-free HMAC comparison for FwCmd_Sign ticket
3ebc3a0
@aidangarske
F-3713 - Branch-free HMAC comparison for FwCmd_CertifyCreation ticket
7d57dba
@aidangarske
F-3714 - Use TPM2_ConstantCompare for SPDM responder verify-data HMAC
6faedd7
@aidangarske
F-3715 - Add SHA3 and PQC reverse mappings in TPM2_GetAlgId
694b5cd
@aidangarske
F-3723 - Replace derivedDataOrigin with firmwareLimited and svnLimited
e1f6d66
@aidangarske
F-3923 - Log Zephyr getaddrinfo and per-attempt connect failures
a1e161b
@aidangarske
F-3929 - Unconditional left-pad of ECDH X-coordinate in HPKE encap/decap
8037c0f
@aidangarske
F-3930 - Bound check offsets in ifx_fw_extract extractFW
31b8121
@aidangarske
F-3719 - Add KAT for TPM2_ParamEnc_AESCFB cross-checking KDFa+AES-CFB
8db493a
@aidangarske aidangarske requested review from Copilot and removed request for Copilot May 12, 2026 03:46
Copilot AI review requested due to automatic review settings May 12, 2026 03:52

This comment was marked as resolved.

Sign in to view

@aidangarske aidangarske self-assigned this May 12, 2026
@aidangarske aidangarske requested a review from dgarske May 12, 2026 06:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@dgarske dgarske Awaiting requested review from dgarske

At least 1 approving review is required to merge this pull request.

Assignees

@aidangarske aidangarske

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@aidangarske