PKCS11 AES-GCM/key-wrap fixes, TPM bounds check, and zeroization tests#198

Merged

LinuxJedi merged 13 commits into

wolfSSL:masterfrom

julek-wolfssl:fenrir/20260619-3

Jun 22, 2026

Commits on Jun 22, 2026

Inherit CKA_TOKEN from source object in C_CopyObject (F-4534)
julek-wolfssl
committed
Fix multi-part CKM_AES_GCM encrypt to match single-shot (F-4068)
julek-wolfssl
committed
Implement RFC 5649 for CKM_AES_KEY_WRAP_PAD (F-6060)
julek-wolfssl
committed
Add white-box test for ML-KEM shared-secret zeroization (F-6056)
julek-wolfssl
committed
Add white-box test for token-key zeroization on logout (F-5524)
julek-wolfssl
committed
Bounds-check TPM key blob in WP11_Object_DecodeTpmKey (F-3839)
julek-wolfssl
committed
Use streaming AES-GCM for multi-part encrypt (F-4068)
julek-wolfssl
committed
Cover unwrap rejection paths in key-wrap-pad test (F-6060)
julek-wolfssl
committed
Cover empty-input rejection in key-wrap-pad test (F-6060)
julek-wolfssl
committed
Report exact size on AES key-wrap-pad unwrap buffer too small (F-6060)
julek-wolfssl
committed
Bound TPM public area size without an unused buffer (F-3839)
julek-wolfssl
committed
Keep allocator tracking correct on realloc failure (F-6056)
julek-wolfssl
committed
Use FIPS-compliant user PIN in new tests
julek-wolfssl
committed