[dgarske]

Description

The v1.85 ECC DHKEM path behind TPM2_Encapsulate / TPM2_Decapsulate (RFC 9180) calls wc_HKDF_Extract and wc_HKDF_Expand, but it was compiled whenever ML-KEM and HAVE_ECC were enabled. A user_settings.h build with ML-KEM and ECC but without HAVE_HKDF hit an implicit declaration and then an undefined reference at link. configure builds did not see it because wolfSSL turns HKDF on for TLS 1.3, which is enabled by default.

Fix

• wolftpm/fwtpm/fwtpm.h - new FWTPM_HAVE_DHKEM, set when WOLFTPM_MLKEM, HAVE_ECC and HAVE_HKDF are all defined. ML-KEM belongs in the condition because the DHKEM implementations sit inside the ML-KEM region and the only commands that reach them are gated on it, so the capability has to match that gate.
• src/fwtpm/fwtpm_crypto.c - the DHKEM helpers and FwEncapsulateEcdhDhkem / FwDecapsulateEcdhDhkem build under FWTPM_HAVE_DHKEM instead of HAVE_ECC.
• src/fwtpm/fwtpm_command.c - Encapsulate and Decapsulate dispatch an ECC key to DHKEM only under FWTPM_HAVE_DHKEM; otherwise the key is rejected with TPM_RC_KEY.
• tests/fwtpm_unit_tests.c - the DHKEM roundtrip tests are guarded on FWTPM_HAVE_DHKEM, and a new test covers the other side: without it, an ECC key that still passes the Part 2 Sec.10.3.13 template checks is rejected by both commands.

ML-KEM itself is unaffected; only ECC KEM keys depend on HKDF.

Testing

• fwtpm_unit.test against a wolfSSL built without HKDF (--disable-tls13 --disable-hkdf, which also needs --enable-rsapss, since dropping TLS 1.3 drops RSA-PSS and fwTPM requires it): the new rejection test and the ML-KEM roundtrip both pass.
• fwtpm_unit.test against a wolfSSL with HKDF: the P-256, P-384 and P-521 DHKEM roundtrips still pass.
• A new fwtpm-v185-no-hkdf CI row builds that configuration and runs the handler tests, which nothing covered before.
• The STM32H5 fwTPM port (wolftpm-examples) built with ML-DSA + ML-KEM and without HAVE_HKDF now builds cleanly.

[embhorn]

Skoll Multi-Scan Review

Modes: review + review-security

Overall recommendation: COMMENT
Findings: 2 total — 2 posted, 0 skipped
2 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [Medium] [review] DHKEM capability remains set when ML-KEM is disabled — wolftpm/fwtpm/fwtpm.h:57
• [Medium] [review] Test ECC rejection in the no-HKDF build — tests/fwtpm_unit_tests.c:19480-19482

Review generated by Skoll

[Copilot]

🟡 Changes recommended

The new workflow entry disables TLS 1.3 but runs the full test suite, whose unguarded TLS 1.3 cases cause the job to fail independently of the DHKEM fix.

1 open issue

• Avoid TLS 1.3 cases in the TLS 1.3-disabled test job · New

What changed in this PR

This PR fixes fwTPM builds with ECC and ML-KEM enabled but HKDF disabled by gating ECC DHKEM support on its required features.

Changes:

• Adds FWTPM_HAVE_DHKEM and applies it to DHKEM implementation and command dispatch.
• Returns TPM_RC_KEY for ECC encapsulation and decapsulation when DHKEM is unavailable.
• Guards DHKEM roundtrip tests and adds no-HKDF regression coverage and a CI configuration.

File	Description
wolftpm/​fwtpm/​fwtpm.h	Defines DHKEM availability from ML-KEM, ECC, and HKDF support.
tests/​fwtpm_unit_tests.c	Guards roundtrip tests and tests rejection without HKDF.
src/​fwtpm/​fwtpm_crypto.c	Compiles DHKEM helpers only when supported.
src/​fwtpm/​fwtpm_command.c	Gates ECC DHKEM dispatch and rejects unsupported keys.
.github/​workflows/​fwtpm-test.yml	Adds a v1.85 CI configuration without HKDF or TLS 1.3.

_{Review effort: Balanced}