WolfSSL
/
wolfTPM
mirror of https://github.com/wolfSSL/wolfTPM.git
1
0
Fork 0
Code Issues Releases Wiki Activity
2,338 Commits
1 Branch
34 Tags
29 MiB
Commit Graph

2338 Commits (2b489b66da5f2666025941b6f0d2ebea5ba9559c)

Author SHA1 Message Date
Aidan Garske 2b489b66da Bump version to v4.2.0 and add the 4.2.0 ChangeLog 2026-09-14 11:03:51 -07:00
David Garske 2a726188ea
Merge pull request #608 from aidangarske/fenrir-fixes-14014-14015-14068-14072-14073-14074-14087 
Fix fwTPM SPDM and TPM transport security findings
 2026-09-14 10:19:12 -07:00
Aidan Garske 9d4b182887 F-14074 - Bind the full keyed-hash secret into the public unique value 2026-09-14 10:00:49 -07:00
Aidan Garske 2a8c1e2e2b F-14073 - Reject policy session auth for empty authPolicy entities 2026-09-14 10:00:48 -07:00
Aidan Garske e61b751dd0 F-14072 - Reject Rewrap on a truncated duplicate parameter 2026-09-14 10:00:47 -07:00
Aidan Garske b543f546a2 F-14087 - Clear sensitive request bytes from the shared command buffer 2026-09-14 10:00:46 -07:00
Aidan Garske 0fb80e09ac F-14015 - Fail TPM2_ParsePublic on packet overflow 2026-09-14 10:00:30 -07:00
Aidan Garske a84cb5f31f F-14014 - Normalize a granted TIS locality to TPM_RC_SUCCESS 2026-09-14 10:00:29 -07:00
Aidan Garske 498a8e103a
Merge pull request #606 from dgarske/pqc_no_wolfcrypt_build 
Fix --enable-pqc build with --disable-wolfcrypt
 2026-09-11 12:35:54 -07:00
David Garske 6908d34f57
Merge pull request #605 from aidangarske/coverity-913526-fwtpm-name-deadcode 
Guard fwTPM public name computation on buffer allocation success
 2026-09-11 11:28:48 -07:00
David Garske 01aef89af0 Fix --enable-pqc build with --disable-wolfcrypt 2026-09-11 11:14:06 -07:00
David Garske a2c3103e6e
Merge pull request #604 from aidangarske/fenrir-fixes-9172-13499 
Harden wolfTPM examples fwTPM and SPDM error handling and secret zeroization
 2026-09-11 09:31:34 -07:00
Aidan Garske b571dfba5f Guard fwTPM public name computation on buffer allocation success 2026-09-11 09:17:49 -07:00
David Garske 4ff1972737
Merge pull request #603 from aidangarske/codeql-46-unseal-permissions 
Restrict unsealed output file permissions
 2026-09-10 16:13:34 -07:00
Aidan Garske 1d8ea0cfd2 Advance SPDM receive sequence after auth and harden size checks 2026-09-10 14:05:48 -07:00
Aidan Garske 58d0fa65fb F-9194 - Zeroize the command auth cache on every process command exit 2026-09-10 13:10:33 -07:00
Aidan Garske c33c5036e2 F-11933 - Skip the authorization area in no-auth-handle session commands 2026-09-10 13:10:33 -07:00
Aidan Garske c06f2c2cb8 F-13499 - Run the PolicyTemplate compare without short-circuiting on size 2026-09-10 13:10:33 -07:00
Aidan Garske 6ecdd4ba8b F-13498 - Run policy assertion compares without short-circuiting on size 2026-09-10 13:10:33 -07:00
Aidan Garske 7ce7a67919 F-12713 - Reject malformed PCR_Read selection counts and sizes 2026-09-10 13:10:33 -07:00
Aidan Garske e15f515b66 F-13529 - Guard the EncryptDecrypt input buffer against a NULL allocation 2026-09-10 13:10:32 -07:00
Aidan Garske d679f5bec5 F-13530 - Guard the encrypted salt zeroization against a NULL buffer 2026-09-10 13:10:32 -07:00
Aidan Garske 022fe8409d F-13531 - Guard the object name marshalling on a successful allocation 2026-09-10 13:10:32 -07:00
Aidan Garske ed95d45f64 F-11916 - Use a constant-time compare for the primary key cache lookup 2026-09-10 13:10:32 -07:00
Aidan Garske 651a35f2a5 F-12755 - Zeroize the session start nonce structures on all exits 2026-09-10 13:09:24 -07:00
Aidan Garske facc55c239 F-9193 - Assert the TIS FIFO can hold the maximum command response 2026-09-10 13:09:24 -07:00
Aidan Garske 7f02facf89 F-12707 - Clean up wolfCrypt only when its init succeeded 2026-09-10 13:09:24 -07:00
Aidan Garske efa68e4acf F-11932 - Zeroize the hierarchy authorization stack buffer 2026-09-10 13:09:24 -07:00
Aidan Garske 36a549d773 F-11931 - Zeroize the PCR authorization buffer before freeing 2026-09-10 13:09:24 -07:00
Aidan Garske b8615b3504 F-11930 - Zeroize the NV save marshal buffer before grow frees 2026-09-10 13:09:24 -07:00
Aidan Garske f53b7ecf65 F-10824 - Zeroize the NV journal load buffer before freeing 2026-09-10 13:09:24 -07:00
Aidan Garske b12c95e64a F-11929 - Zeroize the append-only NV replay buffer before freeing 2026-09-10 13:09:24 -07:00
Aidan Garske ae3581982e F-13453 - Preserve an allocation failure before generating the context IV 2026-09-10 13:09:24 -07:00
Aidan Garske 55135d1cd2 F-13452 - Free the wrap HMAC only after it is initialized 2026-09-10 13:09:24 -07:00
Aidan Garske ef6e19e25b F-11934 - Advance the SPDM receive sequence only after authentication 2026-09-10 13:09:24 -07:00
Aidan Garske 60fd8ae1d2 F-9185 - Fail MCTP encryption once the sequence number exceeds 16 bits 2026-09-10 13:09:24 -07:00
Aidan Garske 3ac5feb984 F-13467 - Validate declared PSK exchange field lengths against the request 2026-09-10 13:09:24 -07:00
Aidan Garske 550277ef13 F-9177 - Reset the responder only after the end session ack is encrypted 2026-09-10 13:09:24 -07:00
Aidan Garske 19b33fb29f F-9176 - Provision the responder PSK only after the inner set succeeds 2026-09-10 13:09:24 -07:00
Aidan Garske c8ce45ebdf F-10760 - Size the key exchange buffer check to the encoded request 2026-09-10 13:09:24 -07:00
Aidan Garske 43f34846a5 F-10762 - Reject an oversized vendor payload that wraps the length field 2026-09-10 13:09:24 -07:00
Aidan Garske e86c7573d0 F-9179 - Reject a NULL vendor payload with a nonzero size 2026-09-10 13:09:24 -07:00
Aidan Garske 38850cee43 F-11891 - Correct the SPDM disconnect key wipe comment 2026-09-10 13:09:24 -07:00
Aidan Garske 1be467d96b F-11909 - Reject an empty Nuvoton GET_STATUS response 2026-09-10 13:09:24 -07:00
Aidan Garske cedcd8e592 F-11908 - Reject truncated Nations GET_STATUS payloads 2026-09-10 13:09:24 -07:00
Aidan Garske 4b76ba64a0 F-13532 - Bound the advanced IO SPI size to the frame buffer 2026-09-10 13:09:24 -07:00
Aidan Garske 03446a7169 F-12753 - Wipe the hex render buffer in the Espressif debug helper 2026-09-10 13:09:23 -07:00
Aidan Garske 0d3f2f756a F-13463 - Clear ECC r and s on all policy signing paths 2026-09-10 13:09:23 -07:00
Aidan Garske 3adb0f5e4a F-13457 - Return an error for incomplete firmware update arguments 2026-09-10 13:09:23 -07:00
Aidan Garske 27d1bf5f9f F-10763 - Return an error on a GPIO config vendor mismatch 2026-09-10 13:09:23 -07:00