tests/fwtpm_unit_tests.c:
- Extend BuildCreatePrimaryCmd to emit MLKEM-768, MLDSA-65, and
Hash-MLDSA-65/SHA-256 TPMT_PUBLIC templates per Part 2 Table 232.
- test_fwtpm_create_primary_mlkem: sanity-check MLKEM keygen path.
- test_fwtpm_create_primary_mldsa: sanity-check MLDSA keygen path.
- test_fwtpm_mlkem_roundtrip: CreatePrimary MLKEM-768 → Encapsulate →
Decapsulate, asserts both shared secrets are 32 bytes and identical.
Proves Phase 3 KDFa derivation + Phase 4 encap/decap crypto + wire
format for TPM2B_SHARED_SECRET and TPM2B_KEM_CIPHERTEXT.
- test_fwtpm_mldsa_digest_roundtrip: CreatePrimary Hash-MLDSA-65 →
SignDigest → VerifyDigestSignature, asserts TPM_ST_DIGEST_VERIFIED
ticket. Proves Phase 5 digest handlers and Bug M-4 metadata format.
- test_fwtpm_mldsa_sequence_roundtrip: CreatePrimary Pure MLDSA-65 →
SignSequenceStart → SignSequenceComplete → VerifySequenceStart →
SequenceUpdate → VerifySequenceComplete, asserts TPM_ST_MESSAGE_
VERIFIED. Proves Phase 5 sign path, Phase 5b one-shot semantics and
message accumulator, and Bug M-1 Pure-MLDSA wire format.
Wired into main(); all five tests pass on --enable-v185.
src/fwtpm/fwtpm_crypto.c, wolftpm/fwtpm/fwtpm_crypto.h:
- Fix: FwSignMldsaMessage and FwSignMldsaHash now take a WC_RNG*.
wolfCrypt wc_dilithium_sign_ctx_msg / sign_ctx_hash require a
non-NULL RNG to source the 32-byte value for hedged signing
(FIPS 204 Algorithm 2 step 7). The Phase 5 code passed NULL and
returned BAD_FUNC_ARG at runtime. Both hedged and deterministic
signing are FIPS 204 compliant; wolfCrypt's non-_with_seed API
chose hedged, matching normal TPM side-channel practice.
src/fwtpm/fwtpm_command.c:
- Pass &ctx->rng to the two updated sign helpers from FwCmd_SignDigest
and FwCmd_SignSequenceComplete.
- Add TPM2B_MLDSA_SIGNATURE type with proper 4627-byte buffer for ML-DSA-87
signatures instead of reusing TPM2B_MAX_BUFFER (1024 bytes)
- Add bounds checking and byte skipping for MLDSA/MLKEM public key parsing
in TPM2_Packet_ParsePublic to prevent buffer overflow
- Add bounds checking for ML-DSA signature parsing in
TPM2_Packet_ParseSignature with proper wire size tracking
- Add bounds checking to Encapsulate/Decapsulate response parsing
(sharedSecret and ciphertext buffers)
- Add negative size validation for contextSz, digestSz, dataSz parameters
in wrapper functions: wolfTPM2_SignSequenceStart, wolfTPM2_SignSequenceComplete,
wolfTPM2_VerifySequenceStart, wolfTPM2_VerifySequenceComplete,
wolfTPM2_SignDigest, wolfTPM2_VerifyDigestSignature
- Fix misleading MAX_SIGNATURE_CTX_SIZE comment - this is for domain
separation context (255 bytes), not signature size
- Change TPMT_PUBLIC size check from assertion to warning for embedded
systems compatibility
- configure.ac: switch wolfCrypt link probe to AC_LINK_IFELSE with real
headers so CC=g++ builds don't fail on name-mangling; gate fwTPM/swTPM
autodetect on ENABLED_WOLFCRYPT=yes (fwTPM requires wolfCrypt)
- wolftpm/fwtpm/fwtpm.h: hoist FWTPM_NV_HAL_S and FWTPM_CLOCK_HAL_S out
of the FWTPM_CTX nested scope so C++ consumers can reference them
- src/fwtpm/fwtpm_command.c, fwtpm_crypto.c: add explicit TPMI_ALG_HASH
and enum wc_HashType casts to silence strict C++ warnings; drop stale
KEYEDHASH hashAlg initializer
- src/tpm2_wrap.c: move rc = TPM_RC_SUCCESS into the correct #else branch
so Linux/winapi paths propagate TPM2_Startup errors
- examples/endorsement/get_ek_certs.c: drop redundant indexType default
- examples/endorsement/verify_ek_cert.c: initialize curveName on the
WOLFTPM2_NO_WOLFCRYPT/no-ECC path
- examples/native/native_test.c: stop masking TPM2_ZGen_2Phase and
TPM2_EC_Ephemeral 'command unavailable' as success
- tests/fwtpm_unit_tests.c: use cmdSz (not hardcoded 14) on FlushContext
- CI: add no-examples and st33ktpm2-i2c compile-only matrix entries to
make-test-swtpm; add release-checks workflow (CC=g++ + scan-build)
Use unshare --user --net to isolate fwtpm_check.sh TCP ports in CI, eliminating flaky port conflicts on shared runners. Add macOS CI with socket transport tests. Add Windows socket portability (Winsock2) and build-only CI via CMake.
- Restore userWithAuth attribute in seal example (intentional for
password-based unsealing)
- Restore chained if (rc == TPM_RC_SUCCESS) pattern and the
release-build authSz mismatch check in TPM2_CommandProcess
- Restore TPM2_Packet_AppendSymmetric call in TPM2_Duplicate
- Update ParamEncDec_Dispatch test to use fwtpm raw-pointer
TPM2_ParamEnc_AESCFB signature
Add portable firmware TPM 2.0 implementation (fwTPM) built on wolfCrypt.
Implements 105/113 TPM 2.0 v1.38 commands (93%) as a standalone server
with socket and TIS transports, NV storage, and full CI/fuzz coverage.
- src/tpm2_wrap.c: wolfTPM2_Init auto-SPDM path now calls vendor-specific
wolfTPM2_SpdmConnectNuvoton/Nations (which sets TIS I/O, mode, and the
host ephemeral key pair for mutual auth). Previous refactor to the
generic wolfTPM2_SpdmConnect dropped that setup, so FINISH failed with
WOLFSPDM_E_PEER_ERROR whenever the TPM was in SPDM-only-locked mode.
- src/tpm2_spdm.c: wolfSPDM_ParseVendorDefined returns payload dataLen
(>=0) on success per spdm_tcg.c:72 convention. wolfTPM2_SPDM_SecuredExchange
was treating any non-zero return as an error, so the first TPM command
over SPDM (10-byte Startup response) bubbled up as rc=0xa.
- tests/unit_tests.c: Add test_tpm_alg_supported() helper that queries
TPM_CAP_ALGS and skip test_wolfTPM2_EccSignVerifyDig iterations when the
hash isn't supported. Nuvoton NPCT75x lacks SHA512 and returns
TPM_RC_SIZE parameter 1 (not TPM_RC_HASH), so the prior post-hoc skip
couldn't catch it.
- .github/workflows/hw-spdm-test.yml: New workflow targeting a self-hosted
Raspberry Pi runner. Runs examples/spdm/spdm_test.sh against real Nuvoton
hardware. Fork-PR gated. Health check soft-fails with a warning if the
Pi is unhealthy so merging isn't blocked on a flaky runner. Nations
matrix entry scaffolded (commented) for when the NS350 is wired.
- scripts/hw-runner-health-check.sh: Pre-flight that verifies /dev/spidev,
/dev/gpiochip, and gpiod are present+accessible before the build.
F-2959 - https://fenrir.wolfssl.com/finding/2959 - Add unit test for wolfTPM2_SetAuthHandleName policyAuth branch verifying auth placed at authDigestSz offset
* Updated copyright
* Fixed minor cast warning.
* Fixed minor scan-build warnings.
* Cleanup print public and fix possible print of uninitialized field.
* Added key generation example with parameter encryption
* Fixes and cleanups for KDFa
* Added KDFa unit test (passes)
* Added AES CFB support
* Fix for nonceTPM
* Added support for encrypted RSA salt and salted-unbounded session
* Removed unsalted-unbounded specific code for authValueKDF from KDFa
* Add innerWrap support
* Add missing wolfcrypt header for AES CFB
* Fixes for casting when calling KDFa for AES CFB parameter encryption
* Add outerWrap support
Signed-off-by: Dimitar Tomov <dimi@wolfssl.com>
Aidan Garske
David Garske
Aidan Garske
Paul Adelsbach
aidan garske
Eric Blankenhorn
John Bland
Anthony Hu
Elms
Dimitar Tomov
Dimitar Tomov
Chris Conlon