From 9b689fc82f9f760230d450f99af748568ad35440 Mon Sep 17 00:00:00 2001 From: Local Dev Date: Sun, 4 Oct 2026 03:39:14 +0200 Subject: [PATCH] Vault PIN: tie it to the TPM and never store it unsealed Theseus's own quick-unlock PIN had the same limit as Aegis's: once the DPAPI seal is opened (as the user, or from a disk image plus the Windows password) the 6-digit PIN falls to an offline search. The PIN is now also the authorization value of a Platform Crypto Provider TPM key whose secret is mixed into the wrapping key, so the chip's lockout bounds guessing; lib/tpm-pin.cjs is the same module Aegis uses. set() now refuses when there is no real OS keystore (Linux basic_text included) instead of writing the blob in the clear, an unsealed record from an older build is deleted, and Settings says what the PIN actually protects against on this machine. --- lib/tpm-pin.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/tpm-pin.js b/lib/tpm-pin.js index 185d529..a6b2af2 100644 --- a/lib/tpm-pin.js +++ b/lib/tpm-pin.js @@ -19,7 +19,7 @@ // by -EncodedCommand; the PIN and secrets travel only on stdin/stdout, never // on the command line. // -// Shared with TheseusNavigator/lib/tpm-pin.cjs (same code) — keep them equal. +// Shared with TheseusNavigator/lib/tpm-pin.cjs (same code apart from this line) — keep them equal. "use strict"; const { spawn } = require("node:child_process");