PKCS11 key attribute secure-default and access-control hardening#196

Merged

LinuxJedi merged 14 commits into

wolfSSL:masterfrom

julek-wolfssl:fenrir/20260619

Jun 22, 2026

Commits on Jun 19, 2026

F-3835: enforce CKA_PRIVATE access control under empty user PIN
julek-wolfssl
committed
F-4063: apply CKA_SENSITIVE/CKA_EXTRACTABLE secure defaults in NSS builds
julek-wolfssl
committed
F-4064: enforce CKA_DERIVE in C_DeriveKey for NSS builds
julek-wolfssl
committed
F-4533: derived keys inherit CKA_SENSITIVE/CKA_EXTRACTABLE from base key
julek-wolfssl
committed
F-5519: default secret keys to CKA_EXTRACTABLE=CK_FALSE
julek-wolfssl
committed
F-5520: make RSA private-key usage opt-in
julek-wolfssl
committed
Ignore add_cert_file and nss_pkcs12_pbe_example build artifacts
julek-wolfssl
committed
F-3835: drop WOLFPKCS11_LEGACY_EMPTY_PIN_PRIVATE_ACCESS escape hatch
julek-wolfssl
committed
F-4533: drop redundant nested block in C_DeriveKey
julek-wolfssl
committed
Fix no_rsa/no_keygen test builds and CK_RV formatting
julek-wolfssl
committed
Scope key-attribute hardening to non-NSS builds
julek-wolfssl
committed
F-3835: scope CKA_PRIVATE discovery enforcement to non-NSS builds
julek-wolfssl
committed

Commits on Jun 22, 2026