bug: Enrollment database stored unencrypted on disk #26

New issue

Closed

opened 2026-07-29 10:59:15 +02:00 by elegos · 0 comments

elegos commented

2026-07-29 10:59:15 +02:00

Owner

Bug

crates/linux-hello-daemon/src/db.rs:18 opens the SQLite enrollment DB in plaintext. The code is marked // TODO(EPIC-02-integration) — the AES-256-GCM encryption with a TPM-sealed key was designed in EPIC-02 but never wired into the daemon.

Impact

The security guarantee of ARCHITECTURE.md §8 ("DB encrypted with TPM-sealed key; useless without the specific machine") is not met. Biometric templates and PIN hashes are readable by any process with filesystem access.

Fix

Wire in linux-hello-tpm::EnrollmentDb::open (which does unseal + AES-GCM decrypt) in place of the current plaintext rusqlite::Connection::open call in db.rs.

## Bug `crates/linux-hello-daemon/src/db.rs:18` opens the SQLite enrollment DB in plaintext. The code is marked `// TODO(EPIC-02-integration)` — the AES-256-GCM encryption with a TPM-sealed key was designed in EPIC-02 but never wired into the daemon. ## Impact The security guarantee of ARCHITECTURE.md §8 ("DB encrypted with TPM-sealed key; useless without the specific machine") is not met. Biometric templates and PIN hashes are readable by any process with filesystem access. ## Fix Wire in `linux-hello-tpm::EnrollmentDb::open` (which does unseal + AES-GCM decrypt) in place of the current plaintext `rusqlite::Connection::open` call in `db.rs`.

elegos added this to the Foundation project

2026-07-29 10:59:36 +02:00

elegos removed this from the Foundation project

2026-07-29 10:59:42 +02:00

elegos added this to the Foundation project

2026-07-29 11:00:01 +02:00

elegos

2026-07-29 11:15:01 +02:00