Skip to content

Hardening fixes for examples, fwTPM command handlers, and crypto helpers#503

Merged
dgarske merged 43 commits into
wolfSSL:masterfrom
aidangarske:fenrir-fixes-11
May 12, 2026
Merged

Hardening fixes for examples, fwTPM command handlers, and crypto helpers#503
dgarske merged 43 commits into
wolfSSL:masterfrom
aidangarske:fenrir-fixes-11

Conversation

@aidangarske

@aidangarske aidangarske commented May 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Member 
F-3708, F-3709, F-3710, F-3711, F-3712, F-3713, F-3714, F-3715,
F-3716, F-3717, F-3718, F-3719, F-3720, F-3721, F-3722, F-3723,
F-3918, F-3919, F-3920, F-3921, F-3922, F-3923, F-3924, F-3925,
F-3926, F-3927, F-3928, F-3929, F-3930, F-3931

aidangarske added 30 commits May 11, 2026 20:03
@aidangarske
F-3708 - Zero-initialize TBS_CONTEXT_PARAMS2 in TPM2_WinApi_SendCommand
a8947e6
@aidangarske
F-3709 - NULL check wolfTPM2_NewKeyBlob in external_import
fc87b4b
@aidangarske
F-3710 - Use goto exit on TPM2_LoadExternal failure in make_credential
25ccf1c
@aidangarske
F-3711 - Set rc on cert/key buffer load failure in tls_client_notpm
e9d4f58
@aidangarske
F-3918 - Bounds check pcrArray writes in secret_unseal and policy_sign
65e0daa
@aidangarske
F-3919 - Treat swtpm response size as uint32_t and bound below by header
1a91936
@aidangarske
F-3924 - Reject non-aligned size in block modes for EncryptDecryptBlock
660d3e7
@aidangarske
F-3722 - Reject x509sign keyHandle in FwCmd_Sign
22c7b40
@aidangarske
F-3920 - Bitwise AND poll revents to accept POLLIN|POLLHUP
256faf9
@aidangarske
F-3921 - Restore goto exit on TPM2_ObjectChangeAuth failure in native…
6d90662 
…_test
@aidangarske
F-3922 - Clamp -auth length in keygen example
069dd33
@aidangarske
F-3926 - Clamp -ownerauth length in seal_nv example
4e16a16
@aidangarske
F-3927 - Clamp -password length in keyimport example
c13dc57
@aidangarske
F-3925 - Scale AES wrap to key strength in DecodeRsaDer and DecodeEccDer
1c06cba
@aidangarske
F-3716 - ForceZero encKeyBuf and importedAuth in FwCmd_Import
d695c06
@aidangarske
F-3717 - ForceZero authValue in FwCmd_LoadExternal
c4c1fb6
@aidangarske
F-3718 - ForceZero SPDM vdMsg/vdRsp plaintext buffers before release
fc35f9e
@aidangarske
F-3928 - ForceZero dataBuf in FwCmd_NV_Write before release
acefdd2
@aidangarske
F-3720 - Zero in.auth on BAD_FUNC_ARG paths in NVCreateAuthPolicy_ex
1b6fcae
@aidangarske
F-3721 - ForceZero HMAC/hash context in TPM2_KDFa_ex and TPM2_KDFe_ex
558dcc9
@aidangarske
F-3931 - ForceZero GetRandom_Out in wolfTPM2_GetRandom
e7de853
@aidangarske
F-3712 - Branch-free HMAC comparison for FwCmd_Sign ticket
3ebc3a0
@aidangarske
F-3713 - Branch-free HMAC comparison for FwCmd_CertifyCreation ticket
7d57dba
@aidangarske
F-3714 - Use TPM2_ConstantCompare for SPDM responder verify-data HMAC
6faedd7
@aidangarske
F-3715 - Add SHA3 and PQC reverse mappings in TPM2_GetAlgId
694b5cd
@aidangarske
F-3723 - Replace derivedDataOrigin with firmwareLimited and svnLimited
e1f6d66
@aidangarske
F-3923 - Log Zephyr getaddrinfo and per-attempt connect failures
a1e161b
@aidangarske
F-3929 - Unconditional left-pad of ECDH X-coordinate in HPKE encap/decap
8037c0f
@aidangarske
F-3930 - Bound check offsets in ifx_fw_extract extractFW
31b8121
@aidangarske
F-3719 - Add KAT for TPM2_ParamEnc_AESCFB cross-checking KDFa+AES-CFB
8db493a
@aidangarske aidangarske requested review from Copilot and removed request for Copilot May 12, 2026 03:46
Copilot AI review requested due to automatic review settings May 12, 2026 03:52

This comment was marked as resolved.

Sign in to view

@aidangarske aidangarske self-assigned this May 12, 2026
@aidangarske aidangarske requested a review from dgarske May 12, 2026 06:14
@dgarske dgarske self-assigned this May 12, 2026
dgarske
dgarske approved these changes May 12, 2026
View reviewed changes

@dgarske dgarske left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Very nice!

@dgarske dgarske merged commit e9ef727 into wolfSSL:master May 12, 2026
141 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@dgarske dgarske dgarske approved these changes

Assignees

@dgarske dgarske

@aidangarske aidangarske

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@aidangarske @dgarske