wolfHSM Hardening Fixes - #425

Open

aidangarske wants to merge 13 commits into

wolfSSL:mainfrom

aidangarske:fenrir-high-zeroize-bounds

Commits on Aug 4, 2026

F-6031 - Zeroize SHE plaintext key in client comm buffer after send
aidangarske
committed
6001982
F-5475 - Zeroize prior credential material before storing new value
aidangarske
committed
f104bd7
F-5141 - Bound config file path copy to prevent stack overflow
aidangarske
committed
6715e38
F-5142 - Bound whnvmtool config path copy to prevent stack overflow
aidangarske
committed
2d7cd43
F-5139 - Add O_EXCL to SHM create to close name TOCTOU
aidangarske
committed
95d36ec
F-4235 - Propagate VERIFY_ACERT_DMA error into response before serialize
aidangarske
committed
8722532
F-6029 - Zeroize plaintext key in KeyWrap request comm buffer
aidangarske
committed
a42f510
F-6030 - Zeroize unwrapped plaintext key in export response buffer
aidangarske
committed
400c531
F-5473 - Zeroize imported key bytes in client cache request buffer
aidangarske
committed
56d914a
F-5474 - Zeroize exported key bytes in client response buffer
aidangarske
committed
b70f5ee
F-6207 - Subtract response header from HKDF and CMAC-KDF output bound
aidangarske
committed
ba089ff
F-4978 - Bound AES-GCM response output and tag to comm buffer
aidangarske
committed
e3f6c6b
Add configurable client communication buffer zeroization
aidangarske
committed
4df8529