Module runtime_sealing 

Local hardware protector verification and recreation for runtime recovery.

These operations neither access VMGS nor make GET/SKR callouts. The caller supplies the active DEK and is responsible for persisting a replacement protector. Hardware-derived keys are freshly obtained on every operation; they must not be cached across migration, even when the SVN is unchanged.

Runtime recovery must use a resident RuntimeTcbFloor, initialized from trusted local hardware or restored through authenticated, VM-bound, fresh servicing state before worker events are accepted. The stateless helpers below do not enforce a runtime TCB floor.

Structs

Error

A local runtime sealing failure, as distinct from a stale or invalid protector. No error contains the DEK, hardware secret, or derived keys.

RuntimeTcbFloor

A resident TCB floor originating exclusively from trusted local hardware.

SavedRuntimeTcbFloor

An accepted runtime floor transferred through trusted servicing state.

Enums

SavedRuntimeTcbFloorSvn

Raw SVN and its exact comparison domain, without keys or a hardware report.

Functions

create_protector

Seal the unchanged active DEK into a new v3 protector using a fresh local report’s SVN and the configured policy. This does not rotate the DEK.

protector_matches

Check whether the stored protector authenticates and unseals to the active DEK on the current hardware, using its stored policy and SVN.