Repository navigation

Security hardening: authenticated AES, salted TPM sessions, owner-hierarchy SRK - #4

Merged

rthellend merged 12 commits into

mainfrom

Oct 7, 2026

Merged

Security hardening: authenticated AES, salted TPM sessions, owner-hierarchy SRK#4
rthellend merged 12 commits into
mainfrom
security-fixes

Commits on Oct 7, 2026
- Use authenticated encryption with AES keys
  
  rthellend
  and
  claude
  committed
  1e4670d
- Honor DecrypterOpts in RSA Decrypt
  
  rthellend
  and
  claude
  committed
  d54ff81
- Create keys under the owner (storage) hierarchy
  
  rthellend
  and
  claude
  committed
  f4c139e
- Protect TPM commands with salted HMAC sessions
  
  rthellend
  and
  claude
  committed
  a25fb62
- Reject keys not generated inside the TPM
  
  rthellend
  and
  claude
  committed
  e7d4281
- Add WithSigningOnly and WithDecryptionOnly key options
  
  rthellend
  and
  claude
  committed
  fa8c827
- Reject SHA-1 and mismatched digest lengths in Sign
  
  rthellend
  and
  claude
  committed
  3496804
- Only flush leftover transient objects on /dev/tpm0
  
  rthellend
  and
  claude
  committed
  45dc17a
- Return a copy of the serialized key from Marshal
  
  rthellend
  and
  claude
  committed
  c3a3838
- Update go and go deps
  
  rthellend
  and
  claude
  committed
  0ceb4df
- Document security properties and refresh README example
  
  rthellend
  and
  claude
  committed
  2a1e8b3
- Fix issues found in code review
  
  rthellend
  and
  claude
  committed
  3341f61