WolfSSL
/
wolfTPM
mirror of https://github.com/wolfSSL/wolfTPM.git
1
0
Fork 0
Code Issues Releases Wiki Activity
2,649 Commits
4 Branches
34 Tags
47 MiB
Commit Graph

745 Commits (master)

Author SHA1 Message Date
David Garske 88aa7edf6c Build the fwTPM without wolfSSL RSA-PSS support 2026-11-02 14:18:32 -08:00
Eric Blankenhorn 2ec9d7972e Fix from review 2026-10-27 13:29:30 -05:00
Eric Blankenhorn c5a655311e fwtpm: size RSASSA DigestInfo buffers for SHA-512, check Sign digest size 
FwSignDigestAndAppend and FwVerifySignatureCore sized their PKCS#1
v1.5 DigestInfo buffers as WC_MAX_DIGEST_SIZE + MAX_ENCODED_DIG_ASN_SZ,
which leaves out the outer SEQUENCE and the AlgorithmIdentifier. A
SHA-512 DigestInfo is 83 bytes. Size both buffers with
MAX_DER_DIGEST_SZ, the constant wolfCrypt uses for this encoding.

- Reject TPM2_Sign with TPM_RC_SIZE when the digest size does not
  match the resolved scheme hashAlg (Part 3 Sec.20.2.1), matching
  FwCmd_SignDigest.
- examples/pcr/policy_sign: size the DigestInfo buffer with
  WOLFTPM_MAX_DER_DIGEST_SZ, since older wolfSSL does not export
  MAX_DER_DIGEST_SZ.
- tests: add RSASSA-SHA512 Sign/VerifySignature and Sign digest-size
  mismatch tests, run the SignDigest RSA roundtrip with SHA-512 too,
  and move BuildRsa2048SignPrimary out of the WOLFTPM_V185 block so
  builds without v1.85 can use it.
 2026-10-27 11:03:49 -05:00
David Garske 17097f4771 nv: support owner/platform hierarchy auth in NV read/write wrappers 2026-10-23 12:07:57 -07:00
David Garske 1976facacc Size RSA 4096 buffers and reject truncated public names 2026-10-20 20:03:48 -07:00
Aidan Garske 579c9a1c2c
Merge pull request #628 from dgarske/infineon_submodule 
Infineon OPTIGA SLB9678 support over the TCG SPDM binding
 2026-10-20 10:56:29 -07:00
David Garske 5b60a8320c Add Infineon SLB9678 SPDM support on the wolfSPDM submodule 2026-10-20 10:22:25 -07:00
Aidan Garske b3669f5309 Fail TLS client setup errors and gate client tests on NO_PUBASPRIV 2026-10-20 09:55:52 -07:00
Aidan Garske 9aa35469a7 Fix TLS example server cleanup 2026-10-16 14:12:12 -07:00
Aidan Garske a4de8c1ebe F-15819 - Reject unsupported cipher modes 2026-10-16 11:47:18 -07:00
Aidan Garske d5bf86b372 F-15796 - Clear native ECDH shared points 2026-10-16 09:15:55 -07:00
Aidan Garske 45fb4141df F-15795 - Clear ECDH benchmark secrets 2026-10-15 15:48:12 -07:00
Aidan Garske 173c28cda7 F-15794 - Clear ML-KEM benchmark secrets 2026-10-15 15:48:12 -07:00
Aidan Garske f16457a97a F-15793 - Clear ML-KEM decapsulation secrets 2026-10-15 15:48:12 -07:00
Aidan Garske dff204b071 F-15731 - Correct EK hex dump width comments 2026-10-15 15:48:12 -07:00
Aidan Garske e8266ff59b F-15717 - Preserve key-blob save failures 2026-10-15 15:48:12 -07:00
Aidan Garske 7696bc473a F-15716 - Forward external-import I/O context 2026-10-15 15:48:12 -07:00
Aidan Garske 59be9ff7d0 F-14221 - Validate complete EK certificate signatures 2026-10-15 15:48:12 -07:00
Aidan Garske 98cfb4511e F-14213 - Reject unreadable credential files 2026-10-15 15:48:12 -07:00
Aidan Garske 21afc61eb4 F-14212 - Unload EK hash sequences on failure 2026-10-15 15:48:12 -07:00
Aidan Garske d4af6d9659 F-14421 - Use blinded ECC shared secret 2026-10-14 13:26:16 -07:00
Aidan Garske bcff8b8783 Allow opt-in weak Hash-ML-DSA pre-hashes 2026-10-13 11:56:01 -07:00
Aidan Garske accf6abc47 Reject Hash-ML-DSA keys whose pre-hash is weaker than the parameter set 2026-10-12 12:43:13 -07:00
David Garske 1e67ba45c9 socket: make the swtpm transport and fwTPM server work on Windows 2026-10-05 20:23:34 -07:00
David Garske a9cdc73c5f
Merge pull request #614 from aidangarske/fix/optional-sha1-examples 
Skip unsupported SHA-1 and add PQC smoke examples
 2026-09-29 09:48:55 -07:00
Aidan Garske ea7cb59f5d Cover no-SHA-1 examples and benchmark in CI 2026-09-28 15:18:26 -07:00
Aidan Garske afebe8d546 Clarify SealSQ PQC builds and examples 2026-09-28 15:07:43 -07:00
Aidan Garske 52ea3319c7 Skip unsupported SHA-1 and add PQC smoke examples 2026-09-28 14:15:56 -07:00
David Garske f8942fb998 Add a fixed-iteration benchmark mode with per-iteration spread 2026-09-23 09:34:57 -07:00
David Garske a5a7ac48ab Add PCR bank allocation wrapper, example and tests 2026-09-23 09:34:57 -07:00
David Garske 428c4c29d1 Skip example paths for features the TPM does not implement 2026-09-23 09:33:53 -07:00
David Garske 235a4d976e Reject oversized signatures before TPM2_VerifySignature 2026-09-23 09:33:53 -07:00
Aidan Garske 64f2db9fcb Add SPDM-bound NV policy examples 
Add an NV binding example and extend the SPDM control flow to exercise PSK- and certificate-authenticated policy sessions. Document and automate the end-to-end policy checks.
 2026-09-15 12:24:05 -07:00
Aidan Garske a89169ef05 Include SPDM, PQC, test and CMake files in the source distribution 2026-09-14 13:28:18 -07:00
David Garske a2c3103e6e
Merge pull request #604 from aidangarske/fenrir-fixes-9172-13499 
Harden wolfTPM examples fwTPM and SPDM error handling and secret zeroization
 2026-09-11 09:31:34 -07:00
Aidan Garske 0d3f2f756a F-13463 - Clear ECC r and s on all policy signing paths 2026-09-10 13:09:23 -07:00
Aidan Garske 3adb0f5e4a F-13457 - Return an error for incomplete firmware update arguments 2026-09-10 13:09:23 -07:00
Aidan Garske 27d1bf5f9f F-10763 - Return an error on a GPIO config vendor mismatch 2026-09-10 13:09:23 -07:00
Aidan Garske 7d4d39780d F-13461 - Return success from the capabilities example handle listing 2026-09-10 13:09:23 -07:00
Aidan Garske 94963636ac F-11901 - Fail make credential when the AK name cannot be read 2026-09-10 13:09:23 -07:00
Aidan Garske e3cbe8ee1d F-11903 - Reject a negative get random length argument 2026-09-10 13:09:23 -07:00
Aidan Garske b58bee5952 F-9182 - Free PKCS7 state on error paths in the sign verify examples 2026-09-10 13:09:23 -07:00
Aidan Garske c425242730 F-9180 - Mask to the format-one field when checking hash bench errors 2026-09-10 13:09:23 -07:00
Aidan Garske 995b0879bc F-9175 - Return the flush result for an explicit handle 2026-09-10 13:09:23 -07:00
Aidan Garske 7792efb8ec F-9174 - Unload the TPM hash sequence object on failure paths 2026-09-10 13:09:23 -07:00
Aidan Garske 91326022d0 F-9173 - Return an error status from pcr policy argument validation 2026-09-10 13:09:23 -07:00
Aidan Garske 319d689108 F-9172 - Use XSTRNCMP to parse the -digest option in pcr policy 2026-09-10 13:09:23 -07:00
Aidan Garske 863f0f900b Restrict unsealed output file permissions 2026-09-10 12:54:14 -07:00
Aidan Garske 0df6f5253a Fix TLS and no-wolfCrypt CI failures 2026-09-10 09:22:04 -07:00
Aidan Garske 2f4b959ebb F-13528 - Honor peer certificate verification result in TLS examples 2026-09-09 15:31:02 -07:00