Core engineering and protocols for Hardware-Enforced Sealed Storage.
Sealed storage is a foundational capability of Trusted Platform Modules: an application can seal a sensitive secret (such as a database encryption key or private TLS certificate) against specific Platform Configuration Register (PCR) values. The TPM hardware guarantees that the secret can only be unsealed and decrypted if the platform is currently executing the exact, unmodified boot sequence.
TPMVault extends sealed storage to use FIPS 203 ML-KEM. Secret keys are encrypted using a public key tied to the TPM's storage hierarchy; during unsealing, the TPM evaluates SHAKE-256 PCR digests and authorization trees before executing the ML-KEM decapsulation routine to release the cleartext secret into secure memory.