Tighten unwrap, key pair generation and encapsulation checks

[aidangarske]

F-4271 - 5af17b9 - C_UnwrapKey now returns CKR_WRAPPED_KEY_LEN_RANGE for a wrapped key length that does not fit in 32 bits, before allocating either work buffer.

F-8658 - c9c4c4d - C_UnwrapKey now returns the CKR_WRAPPED_KEY codes for AES and RSA decrypt failures, and the RSA path rejects a blob that is not the modulus size before allocating.

F-13246 - 07db9a1 - C_GenerateKeyPair now sets the initial states for both keys before calling AddObject.

F-10390 - 94a7d59 - C_GenerateKeyPair now performs the common label copy before adding the public key and checks the result, returning CKR_DEVICE_MEMORY or CKR_FUNCTION_FAILED on failure.

F-6659 - 317bb77 - The CKM_HKDF_KEY_GEN case in C_GenerateKey is now guarded by WOLFPKCS11_HKDF and returns CKR_MECHANISM_INVALID when HKDF keys are compiled out.

F-4635 - 848f4d4 - C_DecapsulateKey now returns CKR_ARGUMENTS_BAD for an ML-KEM ciphertext length that does not fit in 32 bits.

F-6960 - 6163dcc - C_EncapsulateKey and C_DecapsulateKey now call CheckPrivateLogin so a user login is required when the new secret is private, including when CKA_PRIVATE is left at its default.

F-11519 - 97bb7d3 - GetRsaExponentValue now accumulates in an unsigned long, and WP11_Rsa_GenerateKeyPair rejects an exponent above LONG_MAX.

Merge order for this stack (each PR is stacked on the previous one):

• 1. Fix login lockout, logout and PIN cache state handling #227 Fix login lockout, logout and PIN cache state handling
• 2. Validate stored object records and scrub key buffers on errors #228 Validate stored object records and scrub key buffers on errors
• 3. Bind stored object policy to the encrypted key data #229 Bind stored object policy to the encrypted key data
• 4. Release session operation state on replace, error and cancel #230 Release session operation state on replace, error and cancel
• 5. Fix info field padding, mechanism flags and API docs #231 Fix info field padding, mechanism flags and API docs
• 6. Report token store failures and keep stored state consistent #232 Report token store failures and keep stored state consistent
• 7. Stage TPM store records in memory until commit #244 Stage TPM store records in memory until commit
• 8. Tighten ECDH derive input checks and derived key state #233 Tighten ECDH derive input checks and derived key state
• 9. Validate KDF and TLS derive parameters and derived key state #234 Validate KDF and TLS derive parameters and derived key state
• 10. Validate attribute templates before changing objects #235 Validate attribute templates before changing objects
• 11. Make key material and certificate values fixed after creation #236 Make key material and certificate values fixed after creation
• 12. Require key and certificate values at create and fix attribute getters #237 Require key and certificate values at create and fix attribute getters
• 13. Fix AES and OAEP parameter checks and output lengths #238 Fix AES and OAEP parameter checks and output lengths
• 14. Reject AES encrypt and decrypt lengths that do not fit in 32 bits #239 Reject AES encrypt and decrypt lengths that do not fit in 32 bits
• 15. Fix sign, verify and MAC parameter checks #240 Fix sign, verify and MAC parameter checks
• 16. Fix digest, sign and verify length handling #241 Fix digest, sign and verify length handling
• 17. Zeroize transient MAC, AES and RNG buffers #242 Zeroize transient MAC, AES and RNG buffers
• 18. Tighten unwrap, key pair generation and encapsulation checks #243 Tighten unwrap, key pair generation and encapsulation checks

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Frauschi]

A few comments, inline.

[Frauschi]

Thanks, all addressed.