PKCS11 access-control, session-state, and concurrency hardening#207

Draft

julek-wolfssl wants to merge 14 commits into

wolfSSL:masterfrom

julek-wolfssl:wolfpkcs11-fenrir-security-fixes

Commits on Jul 15, 2026

Log out application when all sessions are closed (F-6492)
julek-wolfssl
committed
Reset AES-CBC streaming state in WP11_Session_SetCbcParams (F-6229)
julek-wolfssl
committed
Require user login to copy an object as CKA_PRIVATE=TRUE (F-5762)
julek-wolfssl
committed
Require SO session to set CKA_TRUSTED (F-5867)
julek-wolfssl
committed
Serialize storeDir writes against C_Finalize free in NSS builds (F-5868)
julek-wolfssl
committed
Serialize storeDir reads against C_Finalize free in NSS builds (F-5150)
julek-wolfssl
committed
Serialize AES-CBC multi-part partialSz updates on a session (F-5764)
julek-wolfssl
committed
Warn when PIN KDF falls back to unsalted SHA-256 (F-6232)
julek-wolfssl
committed
Require explicit opt-in for the MAXQ10xx test provisioning key (F-5074)
julek-wolfssl
committed