[rthellend]

Security hardening: authenticated AES, salted TPM sessions, owner-hierarchy SRK

This PR fixes security issues found during an internal review, along with follow-up fixes from code review. It contains breaking changes (see below).

Changes

1. Authenticated AES encryption. AES keys no longer encrypt data directly with unauthenticated AES-CFB. Each message gets a random data key, wrapped by the TPM key, and the message is sealed in software with AES-GCM. The header is authenticated as additional data. This removes ciphertext malleability and the TPM's ~1KB message size limit.

2. DecrypterOpts enforcement. RSA Decrypt passes the OAEP hash and label to the TPM instead of ignoring them. Options other than OAEP, such as PKCS#1 v1.5, are rejected. The MGF hash must match the label hash, and the TPM requires non-empty labels to end with a null byte.

3. Salted HMAC sessions. Commands previously used plain password sessions. Commands that use keys now run in HMAC sessions salted with the SRK: auth values never cross the bus in cleartext, secret parameters are encrypted, and responses are authenticated. Key operations reuse two long-lived sessions, one encrypting command and response and one encrypting only the command (for TPM2_Sign), instead of starting a salted session for every command. TPM2_Load uses the SRK's empty auth value. The private area is already encrypted by the SRK, the loaded object's name is checked, and every later command on the key is covered by an SRK-salted session.

4. Owner hierarchy. Keys are created under an SRK in the owner (storage) hierarchy instead of the endorsement hierarchy, so TPM2_Clear invalidates them. WithOwnerAuth sets the owner passphrase. Serialized keys record the name of the SRK they were created under, and loading them on a TPM with a different SRK fails with ErrWrongTPM.

5. Import rejection. Keys must have FixedTPM, FixedParent, SensitiveDataOrigin and UserWithAuth set. Keys imported or created with known sensitive data are rejected with ErrInvalidKey.

6. Single-purpose keys. New WithSigningOnly() and WithDecryptionOnly() options restrict RSA keys to one use, enforced by both the library (ErrKeyUsage) and the TPM. Decryption-only keys are fixed to RSA-OAEP with SHA-256. ECC keys are always signing-only.

7. Signing. Sign rejects SHA-1 and digests whose length doesn't match the hash. RSA-PSS supports SHA-256, SHA-384 and SHA-512 with PSSSaltLengthEqualsHash, PSSSaltLengthAuto or a salt as long as the hash, which crypto/tls needs. The signature is checked after signing so that a TPM using a different salt length can't produce signatures that fail to verify.

8. Robustness.

   • The SRK and sessions stay loaded for the life of the TPM. If the TPM loses them (for example after a TPM restart, or because another user of a shared TPM flushed handles), they're recreated and the operation is retried once. If a command or response is lost, or a response fails its HMAC check, the sessions are reset so they can't drift out of step with the TPM.
   • On /dev/tpm0 (no resource manager), objects and sessions left behind by a previous process are flushed at startup. TPMs shared through WithTPM are left alone.
   • WithECC(nil) returns ErrInvalidCurve instead of panicking.

9. Hygiene. Marshal returns a copy of the serialized key. Go 1.26+ is required and dependencies are updated. The README and package doc describe the security properties.

Known limitation

The SRK is trusted on first use: it isn't checked against the endorsement key certificate. A device impersonating the TPM when a key is created could capture that key's auth value and parameters. After a key is created, a different device can't use it or complete the sessions that protect it.

Breaking changes

• Serialized key format changed and now includes the SRK name. Keys from previous releases can't be loaded.
• Hierarchy: keys are created under the owner hierarchy. WithEndorsementAuth was removed; use WithOwnerAuth.
• AES ciphertext format changed to versioned AES-GCM. Ciphertexts from previous releases can't be decrypted.
• ECC keys are signing-only and can't be used for decryption.
• Sign rejects SHA-1.
• Go 1.26+ is required.

Testing

Tests run against the go-tpm-tools simulator. They cover bus confidentiality (no auth values or payloads visible on the bus), rejection of known-sensitive keys, key usage restrictions, keys bound to the right TPM and SRK, keys invalidated by TPM2_Clear, RSA-PSS with each hash and salt length, session reuse, and recovery after all handles are flushed outside the library.

🤖 Generated with Claude Code