pico-hsm

chaosrebel/pico-hsm

Fork 0

mirror of https://github.com/polhenarejos/pico-hsm.git synced 2026-08-28 15:47:39 +01:00

Commit Graph

Select branches

Hide Pull Requests

development

master

#10

#102

#108

#124

#124

#127

#128

#128

#130

#130

#131

#134

#135

#136

#137

#137

#138

#139

#2

#40

#43

#52

nightly-development

nightly-master

v1.0

v1.10

v1.12

v1.2

v1.4

v1.6

v1.8

v2.0

v2.2

v2.4

v2.6

v3.0

v3.2

v3.4

v3.6

v3.6-eddsa1

v4.0

v4.0-eddsa1

v4.2

v4.2-eddsa1

v5.0

v5.0-eddsa1

v5.2

v5.4

v5.4-eddsa1

v5.6

v6.0

v6.0-eddsa1

v6.2

v6.4

v6.6

88380473ae Merge pull request #138 from jobordu/fix/devaut-buffer-reset master nightly-master nightly-development Pol HenarejosandGitHub 2026-08-20 18:26:57 +02:00
49616b4ee5 Fix initialization when no TERMCA is available Pol Henarejos 2026-08-20 18:00:16 +02:00
1abe1d717c Simplify comment for output buffer reset Pol HenarejosandGitHub 2026-08-20 18:17:50 +02:00
53ca1ebe37 Pico Keys SDK 9 Pol Henarejos 2026-08-20 17:58:04 +02:00
bea2cd224a Do not delete func files Pol Henarejos 2026-08-20 17:12:11 +02:00
df9b45e833 fix(hsm): reset the output buffer before building C.DevAut open-swe[bot] 2026-08-06 08:09:20 -04:00
1ad8444136 Migrate HSM output APIs to stateful byte buffers Pol Henarejos 2026-07-27 11:42:28 +02:00
20705d73c5 Use byte-array spans across HSM command handling Pol Henarejos 2026-07-27 03:13:26 +02:00
d2f6b72602 Use SDK container store for HSM key objects Pol Henarejos 2026-07-26 20:47:16 +02:00
a7095270b8 Expose container objects through legacy file interfaces Pol Henarejos 2026-07-18 01:15:20 +02:00
d2ebbb2a44 Enforce HSM object policy when opening v1 private key material Pol Henarejos 2026-07-17 23:16:32 +02:00
f77a07b927 Map HSM authentication state to object-policy facts Pol Henarejos 2026-07-17 22:31:20 +02:00
2f9227664c Use the SDK object crypto provider with the existing MKEK Pol Henarejos 2026-07-17 19:49:59 +02:00
3c7741922d Document protected object records and ID allocation Pol Henarejos 2026-07-17 18:23:46 +02:00
4c8a6b972d Document one-object container format implementation Pol Henarejos 2026-07-17 18:03:23 +02:00
b83b5577ef Route HSM v1 key objects through opaque storage handles Pol Henarejos 2026-07-17 16:00:47 +02:00
37c51fc9f3 Add migration-free HSM object compatibility layer Pol Henarejos 2026-07-17 14:58:51 +02:00
bfe73eaae0 Fix build Pol Henarejos 2026-07-16 22:20:37 +02:00
c377f3db86 Support multi-sector flash files with 32-bit lengths and cache draining Pol Henarejos 2026-07-16 21:34:48 +02:00
5a54eef920 Expand dynamic file index to 2048 entries Pol Henarejos 2026-07-16 20:37:52 +02:00
a8ec85a508 Put list onto a function with prefix. Pol Henarejos 2026-07-16 20:26:33 +02:00
a2fea57c8f Fix domain mutation before auth. Pol Henarejos 2026-07-16 10:47:32 +02:00
201a806d75 Add masked mkek. Pol Henarejos 2026-07-16 10:47:12 +02:00
7da850f91a New key objects use a self-identifying AEAD record. Keep accepting the legacy CFB layout so firmware upgrades do not invalidate deployed keys. Pol Henarejos 2026-07-16 01:46:33 +02:00
050f449b1b Reduce latency without unneeded mutex take and release. Pol Henarejos 2026-07-16 01:37:45 +02:00
a2e1e1082c Check no re-login in test not auth. Pol Henarejos 2026-07-16 01:37:15 +02:00
b46db209b2 Generate master seed requires user auth. Pol Henarejos 2026-07-16 01:07:50 +02:00
0ab33f47db Add general authentication reject test. Pol Henarejos 2026-07-16 01:02:06 +02:00
cb8065e6be Check length equals mkek size + iv. Pol Henarejos 2026-07-16 01:01:56 +02:00
9d45e24302 Add sanity check Pol Henarejos 2026-07-16 01:01:43 +02:00
d80b1f5d65 Fix memcmp for puk_store Pol Henarejos 2026-07-16 01:01:34 +02:00
45067c3d67 RP2350 secure-boot key indices are restricted to slots 0..5 before OTP address/bit calculations. Pol Henarejos 2026-07-16 01:01:24 +02:00
2f17785039 RSA/EC private-key loaders reject oversized or empty blobs before fixed-buffer copies. Pol Henarejos 2026-07-16 00:56:42 +02:00
e9b12c6ccd GENERAL AUTHENTICATE rejects truncated/inconsistent envelopes before TLV parsing. Pol Henarejos 2026-07-16 00:56:32 +02:00
3e4f73870a Reject AES if no IV is provided. Pol Henarejos 2026-07-16 00:46:47 +02:00
1c9ec5cf05 CHANGE PIN length validation before subtraction/KDF reads. Pol Henarejos 2026-07-16 00:14:20 +02:00
ad244cc46c Fail-closed physical presence for HSM button mode and rescue operations. Pol Henarejos 2026-07-16 00:13:57 +02:00
7b36d47132 Fix PKA test requiring login Pol Henarejos 2026-07-15 23:03:23 +02:00
205ce7a1bb Fix key domain deletion. Pol Henarejos 2026-07-15 23:03:12 +02:00
df771e9d38 Fix PKA auth check. Pol Henarejos 2026-07-15 23:02:17 +02:00
d52595d210 Fix long challenge requests. Pol Henarejos 2026-07-15 22:54:25 +02:00
953a7933e9 Decrement counter. Pol Henarejos 2026-07-15 22:52:24 +02:00
0f664f5d18 Clears PKA challenge state, selected PKA state, HD private context, and secure-lock mask on unload/reselection. Pol Henarejos 2026-07-15 22:51:55 +02:00
d74caff4b1 Rolls back generated AES keys if metadata storage fails. Pol Henarejos 2026-07-15 22:50:44 +02:00
0f566c6722 Fixed durable counter persistence and enforced counters for symmetric crypto, EC derivation, and XKEK derivation. Pol Henarejos 2026-07-15 22:50:31 +02:00
71d5b751f4 PKA enrollment verifies the submitted CVC against the selected trusted issuer; replacement also requires authenticated state and HSM_OPT_REPLACE_PKA. Pol Henarejos 2026-07-15 22:50:20 +02:00
34156c348d Key-domain import/reset/delete requires an authenticated PIN session, including zero-data operations. Pol Henarejos 2026-07-15 22:50:10 +02:00
27bffbbe94 UPDATE EF now resolves the target before its ACL check. Pol Henarejos 2026-07-15 22:50:01 +02:00
5a7c36b311 Propagated secure-message wrapping failure as SW_WRONG_LENGTH Pol Henarejos 2026-07-15 22:37:15 +02:00
5a8a27fa83 Refactor and delegate CVC handling to libcvc Pol Henarejos 2026-07-15 02:22:53 +02:00
5bf5ae3d1a Fix serial in CI builds. Pol Henarejos 2026-07-15 02:22:20 +02:00
28706875fe Add libtss to autobuild. Pol Henarejos 2026-07-14 16:30:19 +02:00
f4959f650a Add support for external device id for CI. Pol Henarejos 2026-07-14 16:12:22 +02:00
483496600f Use helpers to generate memory flash file for doing CI/CD. Pol Henarejos 2026-07-14 15:14:25 +02:00
0b1594c5a7 Switch to bookworm test. Pol Henarejos 2026-07-14 12:06:47 +02:00
121d426439 Upgrade Pico Keys SDK. Pol Henarejos 2026-07-14 11:45:02 +02:00
bddad2f837 Harden GitHub workflows Pol Henarejos 2026-06-12 17:34:51 +02:00
83b3273f51 Fix pico build Pol Henarejos 2026-05-02 11:39:37 +02:00
cf6be6c121 Use ecp keypair calc public instead. Pol Henarejos 2026-05-01 21:05:35 +02:00
9865b697de Use dynamic dependence resolver. Pol Henarejos 2026-05-01 19:44:34 +02:00
ded3694c95 Update sc_hsm.c Pol HenarejosandGitHub 2026-05-01 13:23:17 +02:00
cb474f7ad3 Fix build Pol Henarejos 2026-05-01 12:59:46 +02:00
38a7d147b6 Upgrade PicoKeys SDK. Pol Henarejos 2026-05-01 12:54:04 +02:00
251b35dd9c Upgrade to v6.6 v6.6 Pol Henarejos 2026-04-07 19:27:37 +02:00
0eebdd330a Upgrade Pico Keys SDK 8.6 and Mbedtls v3.6.6 Pol Henarejos 2026-04-06 20:16:15 +02:00
2a4ee5d42f Fix includes. Pol Henarejos 2026-04-06 20:16:11 +02:00
d5b0a94ba4 Fix build for cyw43. Pol Henarejos 2026-03-28 20:32:46 +01:00
504bb0fc05 Remove debugs. Pol Henarejos 2026-03-27 17:20:56 +01:00
f1d927d4ef Add regression tests. Pol Henarejos 2026-03-26 19:07:16 +01:00
1b322755a1 Do not include OTP FIDO in the CCID interface if not available. Pol Henarejos 2026-03-20 14:35:32 +01:00
e8a398f508 Update memory layout. Pol Henarejos 2026-03-20 13:31:23 +01:00
5297e368d1 Sometimes sc-hsm-tool returns $?=1 despite it succeeds. Pol Henarejos 2026-02-25 23:26:11 +01:00
7c8b39ff82 Update tests Pol Henarejos 2026-03-20 01:20:46 +01:00
254159d44d Allow access to EE_DEV. Pol Henarejos 2026-03-20 01:19:53 +01:00
75c56bb2c7 Migrate PIN and MKEK to new system. Pol Henarejos 2026-03-20 01:19:35 +01:00
1f96fe619b Fix bounds on update ef. Pol Henarejos 2026-03-18 17:42:25 +01:00
3af776ec26 Removed unused functions in extras. Pol Henarejos 2026-03-18 16:57:49 +01:00
54cba3efdf Remove session pin. Pol Henarejos 2026-03-18 16:40:08 +01:00
1ced9f6267 Check bounds on update ef. Pol Henarejos 2026-03-18 16:04:20 +01:00
c14a12d9d1 Set ACL for all registers. Pol Henarejos 2026-03-18 16:03:39 +01:00
bbbf28cb42 Fix ACL for static files. Pol Henarejos 2026-03-18 14:26:43 +01:00
db9d6ef2f5 Do not allow reading private objects if not authenticated. Pol Henarejos 2026-03-18 13:21:14 +01:00
983a5b7d10 Fix secp521r1 test with newer OpenSSL versions. Pol Henarejos 2026-03-18 13:19:20 +01:00
839fb431c4 Add strict build. Pol Henarejos 2026-03-09 11:02:47 +01:00
50cf1f355a Merge branch 'master' into development development Pol Henarejos 2026-03-07 17:55:10 +01:00
cc0e4e43ca Fix MLKEM build. Pol Henarejos 2026-03-07 17:54:59 +01:00
7a12177745 Update memory layout. Pol Henarejos 2026-03-07 17:52:56 +01:00
879daefc0a Fix MLKEM build. Pol Henarejos 2026-03-07 17:42:26 +01:00
553eecf496 Merge branch 'master' into development Pol Henarejos 2026-03-07 17:25:11 +01:00
2874353804 Merge pull request #127 from ajkrj/patch-1 Pol HenarejosandGitHub 2026-03-07 17:24:01 +01:00
64c4afb5d9 Small typos Pol Henarejos 2026-03-07 17:19:20 +01:00
aae66e7db3 Fix link with mbedtls in openssl backend. Pol Henarejos 2026-03-07 17:16:40 +01:00
2d25ed9939 Fix strict non-prototype declaration warn. Pol Henarejos 2026-03-07 17:12:49 +01:00
36a6594cdc Update Pico Keys SDK. Pol Henarejos 2026-03-07 13:46:21 +01:00
508904bdeb Sometimes sc-hsm-tool returns $?=1 despite it succeeds. Pol Henarejos 2026-02-25 23:26:11 +01:00
ac3f139feb Do not link here with mbedtls. Pol Henarejos 2026-02-25 23:25:44 +01:00
5d827234a9 Increase buffers for emulation. Pol Henarejos 2026-02-25 23:25:22 +01:00
98123046e5 Revert "Enable pytests" Pol Henarejos 2026-02-25 20:25:08 +01:00
f96b189eb0 Fix parsing 521 key for openssl>3. Pol Henarejos 2026-02-25 20:17:02 +01:00
bd47ba479e Update memory layout for tests. Pol Henarejos 2026-02-25 20:16:41 +01:00

1 2 3 4 5 ...