Issues

• Host tools do not build with libsodium 1.0.18 (Debian, Ubuntu 24.04, EPEL)

  zombocoder/OpenHSM#11 · Filter by author themoriarti opened on Oct 26, 2026

• host/openbao/Dockerfile builds OpenBao main, which no longer has a built-in pkcs11 seal

  zombocoder/OpenHSM#10 · Filter by author themoriarti opened on Oct 26, 2026

• PKCS#11 module does not recover after a daemon restart or session loss

  zombocoder/OpenHSM#9 · Filter by author themoriarti opened on Oct 26, 2026

• Host tools default to PIN 123456 and spend retries when --pin is omitted

  zombocoder/OpenHSM#8 · Filter by author themoriarti opened on Oct 26, 2026

• openhsm-daemon: one blocking client, no timeouts, no recovery after USB re-enumeration

  zombocoder/OpenHSM#7 · Filter by author themoriarti opened on Oct 26, 2026

• No way to back up a device key: one device is a single point of loss for sealed data

  zombocoder/OpenHSM#6 · Filter by author themoriarti opened on Oct 26, 2026

• KEK root derives from the readable UID: evaluate SAES/DHUK as a secret root

  zombocoder/OpenHSM#5 · Filter by author themoriarti opened on Oct 26, 2026

• Session table fills after 4 unclosed sessions and locks the device until power cycle

  zombocoder/OpenHSM#4 · Filter by author themoriarti opened on Oct 26, 2026

• Host transport silently falls back to plaintext when the handshake fails

  zombocoder/OpenHSM#3 · Filter by author themoriarti opened on Oct 26, 2026

• Device accepts the PIN and gated commands in plaintext, with one global login

  zombocoder/OpenHSM#2 · Filter by author themoriarti opened on Oct 26, 2026

• Unauthenticated session handshake allows a man in the middle over openhsm-daemon

  zombocoder/OpenHSM#1 · Filter by author themoriarti opened on Oct 26, 2026