Repository navigation
fwtpm: reject ML-DSA signing with no private seed - #643
Merged
Merged
Conversation
SignSequenceComplete and SignDigest signed with obj->privKey without checking that a private seed was loaded. For a public-only ML-DSA or Hash-ML-DSA key from TPM2_LoadExternal they returned success with a signature from the all-zero seed, which does not verify against the key's public area. Return TPM_RC_KEY when privKeySize is not MAX_MLDSA_PRIV_SEED_SIZE, matching FwSignAttestMldsa. For sequences the check is in Complete, where the key is used: the object at keyHandle can differ from the one given to Start while keeping the same Name.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
🟢 Approval recommended
The targeted guards preserve valid-key behavior and cleanup, with regression coverage and no unresolved findings.
No open issues 🎉
What changed in this PR
Prevents firmware TPM signing with public-only ML-DSA keys, matching existing attestation validation.
Changes:
- Rejects missing private seeds with
TPM_RC_KEYin both signing paths. - Adds regression coverage using public-only keys loaded through
TPM2_LoadExternal.
| File | Description |
|---|---|
| tests/fwtpm_unit_tests.c | Tests public-only key rejection for sequence and digest signing. |
| src/fwtpm/fwtpm_command.c | Validates private seed size before signing. |
Review effort: Balanced
Member
|
Okay to test. Contributor agreement on file |
aidangarske
reviewed
Oct 21, 2026
aidangarske
left a comment
aidangarske
left a comment
Member
There was a problem hiding this comment.
Thanks @deadcaf3! This looks good. Seed check is the right call and matches FwSignAttestMldsa and it covers the entry points that actually reach the ML-DSA signer. It needs ML-DSA build guards though. Specifics inline.
dgarske
approved these changes
Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SignSequenceCompleteandSignDigestnever checked that an ML-DSA key has a private seed. For a public-only key fromTPM2_LoadExternalthey returned success with a signature from the all-zero seed.Both now return
TPM_RC_KEYwhen no seed is loaded, matchingFwSignAttestMldsa. The sequence check is in Complete, where the key is actually used.Test:
test_fwtpm_mldsa_sign_public_only_returns_keyfails before the fix and passes after.