Add Unit Testing, Fix Short Curcuits, Other fixes

[aidangarske]

Fixed

F-3001, F-2950, F-2967, F-2508, F-2512, F-2998, F-2999, F-3000, F-2962, F-2963, F-2964, F-2965, F-3003,
F-3006, F-3007, F-3008, F-3004, F-3005, F-2969, F-3016, F-2503, F-2973, F-2974, F-2993, F-2994, F-2995, 
F-2996, F-2997, F-2979, F-2980, F-2532, F-2533, F-2164, F-3009, F-3010, F-3011, F-3012, F-3013,  F-3014, F-3015

By design not fixed

F-2948, F-3002, F-2949

[Copilot]

Pull request overview

This PR tightens TPM2 serialization/parsing correctness and security checks (constant-time comparisons, IV validation, session preservation) and adds unit tests covering several previously untested/buggy paths.

Changes:

• Add/extend TPM structure support and packet (de)serialization for keyed-hash XOR scheme, ECSCHNORR/SM2 signatures, and sensitive-area parsing.
• Harden wrapper/fwTPM logic (session[0] preservation for SPDM flows, IV validation in EncryptDecryptBlock, improved hash digest sizing for SHA3/SM3, constant-time compare paths).
• Add unit tests for new serialization paths and wrapper boundary/argument validation behaviors.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
wolftpm/tpm2_packet.h	Exposes additional packet helpers for unit testing (keyedhash scheme, signature, sensitive).
wolftpm/tpm2.h	Adds TPMS_SCHEME_XOR and keyedhash union support for TPM_ALG_XOR scheme details.
tests/unit_tests.c	Adds unit tests for keyedhash XOR serialization, ECSCHNORR/SM2 signature serialization, sensitive roundtrip parsing, and wrapper boundary/arg checks.
src/tpm2_wrap.c	Preserves session[0] across SPDM platform-auth operations; improves secret export constant-time behavior; validates IV handling; zeroes sensitive stack copies on error paths.
src/tpm2_util.c	Extends TPM2_GetHashDigestSize to cover SM3_256 and SHA3 digests.
src/tpm2_param_enc.c	Removes verbose debug printing of key material (reduces sensitive logging exposure).
src/tpm2_packet.c	Fixes keyedhash scheme (HMAC vs XOR) serialization; adds TPM2_Packet_ParseSensitive; extends signature (de)serialization for ECSCHNORR/SM2.
src/tpm2_crypto.c	Updates HMAC verification to avoid early short-circuit before constant-time comparison.
src/tpm2.c	Updates response HMAC verification block to avoid short-circuiting the constant-compare call (but still early-returns on size mismatch).
src/fwtpm/fwtpm_crypto.c	Updates fwTPM integrity/HMAC checks to avoid short-circuiting constant-compare (introduces a verified OOB-read risk on malformed inputs).
src/fwtpm/fwtpm_command.c	Updates multiple policy/HMAC comparisons to avoid early short-circuits and reduce timing leakage.
hal/tpm_io_zephyr.c	Improves Zephyr SPI transport build error text and guidance.
examples/wrap/wrap_test.c	Updates example to provide an IV for EncryptDecrypt calls.
examples/pcr/policy_sign.c	Uses constant-time fixed-width export for ECC signature components (r/s).
examples/bench/bench.c	Updates bench to provide/reset an IV for EncryptDecrypt calls.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.