Support ML-KEM credential activation and ML-DSA quotes in fwTPM

[aidangarske]

• fwTPM ActivateCredential rejected ML-KEM decrypt keys with TPM_RC_KEY, and attestation signing with Quote/Certify/NV_Certify/GetTime had no ML-DSA path so
  the PQ flow in issue Question about ML-KEM ActivateCredential and Pure ML-DSA Quote support in fwTPM #589 failed
• ActivateCredential now accepts a restricted ML-KEM Storage Key, and attestation signs TPMS_ATTEST with Pure and Hash-ML-DSA per FIPS 204
• ML-DSA schemes carry no wire hashAlg TCG v185 errata, so pcrDigest/nvDigest use the key nameAlg and the scheme parses/serializes as TPMS_EMPTY;
  credential protection is derived from the key nameAlg and AES size so standard SHA-384/AES-256 ML-KEM EKs work
• Added fwTPM unit tests for all four attestation commands plus the ML-KEM credential round trip, and extended examples/pqc/pqc_mssim_e2e.c to drive the full
  client flow against fwtpm_server

[Copilot]

🟡 Changes recommended

A newly added unit-test TPMS_ATTEST walker can perform out-of-bounds reads on truncated/malformed buffers, which should be hardened to fail via assertions rather than risking undefined behavior.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR extends fwTPM’s post-quantum (v1.85) support to unblock PQ attestation flows by enabling ML-KEM ActivateCredential and adding ML-DSA / Hash-ML-DSA signing for attestation commands, along with new unit tests and an end-to-end mssim example.

Changes:

• Allow restricted ML-KEM Storage Keys for MakeCredential/ActivateCredential and derive credential integrity/encryption using the key’s nameAlg and declared AES-CFB key size.
• Add ML-DSA and Hash-ML-DSA attestation signing paths (Quote/Certify/GetTime/NV_Certify) and handle ML-DSA scheme serialization/parsing as TPMS_EMPTY.
• Add fwTPM unit tests covering ML-KEM credential round-trip and ML-DSA attestation signing/verification; extend the PQ mssim E2E example to exercise the full client flow.

File summaries

File	Description
wolftpm/fwtpm/fwtpm_crypto.h	Updates credential wrap/unwrap APIs to carry nameAlg for variable-hash integrity.
src/fwtpm/fwtpm_crypto.c	Adds ML-DSA/Hash-ML-DSA attestation signing and variable-hash credential integrity.
src/fwtpm/fwtpm_command.c	Enforces storage-key attributes for credential commands; ML-DSA-specific digest selection for Quote/NV_Certify.
src/tpm2_packet.c	Serializes ML-DSA schemes as TPMS_EMPTY (no trailing hashAlg).
tests/fwtpm_unit_tests.c	Adds unit tests for ML-KEM credential activation and ML-DSA/Hash-ML-DSA attestation flows.
examples/pqc/pqc_mssim_e2e.c	Extends PQ E2E example to drive ML-KEM credential activation and ML-DSA quote via the client API.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.