Validate KDF and TLS derive parameters and derived key state

[aidangarske]

F-4687 - 10d946f - WP11_KDF_Derive now rejects HKDF salt and info lengths that do not fit in 32 bits.

F-4804 - 00a5d9c - The NSS extended master secret derive now rejects a session hash length that does not fit in 32 bits.

F-4274 - 58bd287 - CKM_DH_PKCS_DERIVE now rejects a peer public value longer than WP11_MAX_DH_KEY_SZ, and the macro moves to wolfpkcs11/internal.h.

F-5077 - 837ca4c - CKM_AES_CBC_ENCRYPT_DATA now rejects a data length that does not fit in 32 bits.

F-10389 - 37fdc66 - CKM_TLS12_KEY_AND_MAC_DERIVE now requires each MAC, key and IV size to be a multiple of 8 bits.

F-10381 - 9723108 - A single WP11_DERIVE_SECRET_KEY macro now guards the C_DeriveKey locals and helpers for ECC, DH, HKDF, AES-CBC and PRF.

F-11518 - a12c83b - TLS key and MAC derive now requires non-NULL client and server randoms, and the NSS extended master secret derive requires a non-NULL session hash.

F-4066 - 686b6aa - CKM_TLS12_MASTER_KEY_DERIVE now returns CKR_MECHANISM_PARAM_INVALID for any version other than 3.3.

F-13245 - 799862c - C_DeriveKey now returns CKR_ATTRIBUTE_VALUE_INVALID when CKA_VALUE_LEN is larger than the derived secret, and DH secrets are left padded up to the smaller of the parameter length and the prime length.

F-3636 - c834de9 - TLS key material keys now take their ALWAYS_SENSITIVE and NEVER_EXTRACTABLE history from the base key through SetDerivedStates.

F-4074 - d43a3c7 - SetKeyExtract now sets the MAC attributes before AddObject, frees the object on failure, and maps a SymmKeyLen failure to CKR_FUNCTION_FAILED.

F-8644 - 32108ba - WP11_KDF_Derive now requires the HKDF salt key to be a generic secret, AES or HKDF secret key with key data, and C_DeriveKey passes CKR_MECHANISM_PARAM_INVALID through.

[Copilot]

🟡 Changes recommended

TLS multi-key derivation can bypass the new oversized CKA_VALUE_LEN validation, and several unavailable test configurations incorrectly report success.

4 open findings

• Reject oversized key lengths in TLS extraction path · New
• Return SKIP when ECC support is unavailable · New
• Return SKIP when no derive tests are available · New
• Return SKIP when file-backed store is unavailable · New

What changed in this PR

Hardens PKCS#11 derivation, persistence, session lifecycle, and metadata behavior while expanding regression coverage.

Changes:

• Validates KDF, DH, AES-CBC, and TLS derivation parameters and derived-key state.
• Improves token persistence, login state, operation cleanup, and mechanism reporting.
• Adds extensive derive, storage, concurrency, and lifecycle tests.

File	Description
.github/​workflows/​unit-test.yml	Adds TPM-debug and no-environment CI coverage.
wolfpkcs11/​pkcs11.h	Defines operation-cancellation failure status.
wolfpkcs11/​internal.h	Adds size limits and internal lifecycle helpers.
src/​crypto.c	Hardens derivation and operation lifecycle handling.
src/​internal.c	Implements storage, session, and derive safeguards.
src/​slot.c	Corrects token information and mechanism reporting.
src/​wolfpkcs11.c	Improves initialization, finalization, and field padding.
tests/​include.am	Registers the new test executables.
tests/​pkcs11test.c	Updates expectations for corrected behavior.
tests/​pkcs11mtt.c	Updates multithreaded cancellation expectations.
tests/​ec_derive_test.c	Tests ECDH validation and derived state.
tests/​kdf_tls_derive_test.c	Tests KDF and TLS derivation behavior.
tests/​token_store_test.c	Tests transactional token persistence.
tests/​object_store_decode_test.c	Tests malformed stored-object rejection.
tests/​login_pin_state_test.c	Tests login, PIN, and concurrency invariants.
tests/​info_mech_table_test.c	Tests metadata and mechanism consistency.
tests/​object_policy_integrity_test.c	Tests persisted object policy integrity.
tests/​session_op_lifecycle_test.c	Tests operation cleanup and cancellation.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Frauschi]

One comment on the DH padding, inline.

[Frauschi]

Thanks, the DH padding fix and the stripped-peer test look good.

The merge-base changed after approval.