[aidangarske]

F-10400 - 957fa22 - Key encryption and decryption now take additional authenticated data built from the object policy (version, class, key type, keygen mechanism, local flag and operation flags). Records stored in the older format still load and are re-encrypted with the policy data on the next store or logout.

[Copilot]

🟡 Changes recommended

Object lifetime and persistence paths currently permit use-after-free, unbounded secret retention, and inconsistent policy/ciphertext records.

6 open findings

• Policy metadata and ciphertext updates are not atomic · New
• Object pointer can be freed before caller use · New
• Retired private objects leak unbounded secret memory · New
• Logout does not persist legacy record upgrades · New
• Unavailable feature is incorrectly reported as a passing test · New
• Unavailable feature is incorrectly reported as a passing test · New

What changed in this PR

Binds encrypted token keys to their stored policy and strengthens storage decoding, login, logout, and PIN-state handling.

Changes:

• Adds policy AAD to stored-key encryption with legacy-format migration.
• Hardens decoding, object cleanup, locking, and PIN lockout behavior.
• Adds storage integrity and concurrency regression tests.

File	Description
wolfpkcs11/​internal.h	Declares new lockout and debug helpers.
src/​internal.c	Implements policy binding, decoding safeguards, and lifecycle changes.
src/​crypto.c	Maps rejected policy updates to PKCS#11 errors.
src/​slot.c	Applies lockout accounting to PIN changes.
tests/​login_pin_state_test.c	Tests login, logout, PIN, and concurrency invariants.
tests/​object_store_decode_test.c	Tests malformed stored-record handling.
tests/​object_policy_integrity_test.c	Tests authenticated policy and legacy migration.
tests/​include.am	Registers the new test programs.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Frauschi]

One blocker: the store-failure rollback in WP11_Slot_SetUserPin re-encrypts objects that were never decoded and destroys their stored key data. There's also a deadlock in the store batch locking, plus some locking and durability issues, inline.

[Frauschi]

Thanks, the blocker is fixed: undecoded records are left alone in both the forward pass and the rollback, and the new public-session and SO tests fail on the previous head. The rest of the comments are addressed too. One locking gap left inline.

Not from this PR, since master does the same, but worth a follow-up issue: a successful C_SetPIN from an RW public session still loses every stored key that wasn't decoded yet. Those records keep their old-key ciphertext and get stored next to the new seed, so after logging in with the new PIN they can't be found. C_SetPIN has the old PIN, so it could decode them first.

[Frauschi]

@aidangarske please fix merge conflicts after #226.

The merge-base changed after approval.