WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity

F-12114: pkcs11: wipe the PIN even when no session was established 

pkcs11_pin is pre-populated from the compile-time credential
(ENCRYPT_PKCS11_PIN), so the RAM copy exists from image load, not
from a successful C_Login. pkcs11_crypto_deinit() only wiped it
inside the encrypt_initialized branch, so on a target where init
never completed the credential stayed in retained memory after the
pre-handoff path ran.

Move pkcs11_pin_wipe() out of the branch: the token interaction
(C_CloseSession) stays conditional on an established session, the
credential wipe is unconditional. deinit only runs on the terminal
pre-handoff paths, so this cannot break the init retry in
wolfBoot_initialize_encryption, which runs at decryption time,
well before handoff.

test_pkcs11_deinit_no_session now re-populates the pin and asserts
every byte is zero after deinit without init (plus no C_CloseSession
and repeat-call safety). Pre-fix it failed with "pkcs11_pin byte 0
not wiped" (1/2); post-fix 2/2.

Verification: unit-pkcs11-pin-zeroize 2/2, full unit suite green,
sim build green, cstyle clean on changed hunks.
pull/880/head
Daniele Lacamera 2026-09-02 10:16:35 +02:00
parent b548341e9b
commit 1c57f8c06b
2 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/libwolfboot.c
View File

@ -2605,8 +2605,11 @@ void pkcs11_crypto_deinit(void)
if (encrypt_initialized) {
pkcs11_function_list->C_CloseSession(pkcs11_session);
encrypt_initialized = 0;
pkcs11_pin_wipe();
}
/* pkcs11_pin is pre-populated from the compile-time credential,
* so wipe it even when no session was ever established: the
* pre-handoff paths must not leave it in retained memory. */
pkcs11_pin_wipe();
}
#endif

10
tools/unit-tests/unit-pkcs11-pin-zeroize.c
View File

@ -201,17 +201,25 @@ START_TEST(test_pkcs11_pin_wiped_on_deinit){
END_TEST
/* deinit without an established session must not touch the token
* (no C_CloseSession) and is safe to call repeatedly. */
* (no C_CloseSession), is safe to call repeatedly, and still wipes
* the pre-populated credential copy. */
START_TEST(test_pkcs11_deinit_no_session)
{
size_t i;
reset_stub_state();
encrypt_initialized = 0;
memcpy(pkcs11_pin, ENCRYPT_PKCS11_PIN, sizeof(ENCRYPT_PKCS11_PIN));
pkcs11_crypto_deinit();
pkcs11_crypto_deinit();
ck_assert_int_eq(encrypt_initialized, 0);
ck_assert_int_eq(stub_close_session_calls, 0);
for (i = 0; i < sizeof(pkcs11_pin); i++) {
ck_assert_msg(pkcs11_pin[i] == 0,
"pkcs11_pin byte %zu not wiped", i);
}
}
END_TEST