CVE-2026-32953: Tillitis TKey Information Disclosure Flaw

CVE-2026-32953 Overview

Tillitis TKey Client package is a Go package for a TKey client. Versions 1.2.0 and below contain a critical bug in the tkeyclient Go module which causes 1 out of every 256 User Supplied Secrets (USS) to be silently ignored, producing the same Compound Device Identifier (CDI)—and thus the same key material—as if no USS is provided. This happens because a buffer index error overwrites the USS-enabled boolean with the first byte of the USS digest, so any USS whose hash starts with 0x00 is effectively discarded.

Critical Impact

Approximately 1 in 256 User Supplied Secrets are silently ignored due to a buffer index error, resulting in predictable key material generation that matches the default CDI when no USS is provided. This undermines the cryptographic uniqueness guarantees of the TKey hardware security device.

Affected Products

• Tillitis TKey Client (tkeyclient Go module) versions ≤ 1.2.0
• Applications using the affected tkeyclient module for USS-based key derivation
• TKey hardware security device deployments relying on USS differentiation

Discovery Timeline

• 2026-03-20 - CVE CVE-2026-32953 published to NVD
• 2026-03-20 - Last updated in NVD database

Technical Details for CVE-2026-32953

Vulnerability Analysis

This vulnerability falls under CWE-303 (Incorrect Implementation of Authentication Algorithm). The flaw exists in how the tkeyclient Go module handles the User Supplied Secret (USS) during Compound Device Identifier (CDI) generation for the Tillitis TKey hardware security device.

The TKey is designed to generate unique cryptographic key material by combining device-specific secrets with an optional USS provided by the user. When a USS is supplied, the module should set a boolean flag indicating USS is enabled and then copy the USS digest into the appropriate buffer location. However, a buffer index error causes the first byte of the USS digest to overwrite the USS-enabled boolean flag instead of being written to its intended position.

When a USS hash begins with 0x00 (which occurs approximately 1 in 256 times given uniform hash distribution), this zero byte effectively sets the USS-enabled flag to false. The TKey then computes the CDI as if no USS was provided at all, resulting in the same key material that would be generated without any user secret. This creates a scenario where users believe their secrets are protecting their cryptographic keys when they are actually being silently discarded.

Root Cause

The vulnerability stems from an off-by-one buffer index error in the tkeyclient Go module. When writing the USS digest to the communication buffer, the code incorrectly calculates the starting index, causing the first byte of the digest to land on the memory location reserved for the USS-enabled boolean flag. This implementation mistake transforms the first byte of the cryptographic hash (which should be part of the secret data) into a control flag that determines whether the USS is used at all.

Attack Vector

The attack vector requires physical access to the TKey device and knowledge that a target's USS happens to hash to a value beginning with 0x00. An attacker who understands this vulnerability could:

1. Identify or guess that a victim's USS hashes to a value starting with 0x00
2. Connect to a TKey device configured with that USS
3. Generate key material that matches what would be produced with no USS at all
4. Potentially derive the same cryptographic keys as the victim without knowing the actual USS

The vulnerability is particularly concerning because the user receives no warning or error when their USS is silently ignored, leading to a false sense of security.

The vulnerability exists in the buffer handling code where the USS digest is copied to the device communication buffer. For technical details, see the GitHub Commit Details showing the fix.

Detection Methods for CVE-2026-32953

Indicators of Compromise

• Applications generating identical CDI values for different USS inputs
• Key material that unexpectedly matches default (no-USS) TKey output
• USS values whose SHA-256 or other hash digests begin with 0x00 byte
• Inconsistent cryptographic operations where USS should have differentiated keys

Detection Strategies

• Audit deployed tkeyclient Go module versions to identify installations ≤ 1.2.0
• Implement test vectors that verify USS values with hashes starting with 0x00 produce unique CDIs
• Compare CDI outputs between USS-enabled and USS-disabled configurations to detect unexpected matches
• Review application logs for any cryptographic key derivation anomalies

Monitoring Recommendations

• Monitor for multiple devices or sessions generating identical key material unexpectedly
• Implement runtime checks that validate USS is being correctly processed before cryptographic operations
• Log USS hash prefixes (first byte only) to detect potentially affected secrets without exposing sensitive data
• Alert on any key derivation that produces the same result as the no-USS baseline

How to Mitigate CVE-2026-32953

Immediate Actions Required

• Upgrade the tkeyclient Go module to version 1.3.0 or later immediately
• Audit all USS values currently in use to identify any whose hashes begin with 0x00
• Regenerate keys for any USS that was potentially affected by this vulnerability
• Review any cryptographic material derived using vulnerable versions for potential compromise

Patch Information

The vulnerability has been fixed in tkeyclient version 1.3.0. The patch corrects the buffer index calculation to ensure the USS digest is written to the correct buffer position, preserving the USS-enabled boolean flag. Users should upgrade by updating their Go module dependencies:

• Fixed version: v1.3.0
• Commit: 4954dccf0287657edf8d405057e134cdff9c59e8
• Release: GitHub Release v1.3.0
• Advisory: GitHub Security Advisory GHSA-4w7r-3222-8h6v

Workarounds

• If immediate upgrade is not possible, switch to a USS whose hash does not begin with a zero byte (0x00)
• Test candidate USS values by computing their hash and verifying the first byte is non-zero before deployment
• Implement application-level validation that rejects USS values with hashes starting with 0x00 until the module can be upgraded

# Configuration example
# Update tkeyclient Go module to patched version
go get github.com/tillitis/tkeyclient@v1.3.0
go mod tidy

# Verify the installed version
go list -m github.com/tillitis/tkeyclient
# Expected output: github.com/tillitis/tkeyclient v1.3.0