Add SE05x lifecycle, policy, SCP03, and attestation APIs

[LinuxJedi]

Description

Extend the SE05x port with application-facing APIs for:

• owned and externally supplied session lifecycle, configuration access, and serialization
• policy-aware ECC/RSA key insertion and persistent on-chip key generation
• binary object insertion, object attributes, and explicit object deletion
• runtime Platform SCP03 credentials, deterministic HKDF-SHA256 key derivation, and authenticated key rotation
• nonce-bound object attestation retrieval and host verification

The SCP03 path keeps DEK wrapping in host software, uses aligned AES staging buffers, validates PUT KEY responses, and avoids in-place APDU padding overflow. Provisioning retains middleware chunking and curve-creation behavior for large binary, RSA, and ECC objects.

The RSA attestation component path is also gated consistently with wc_RsaFlattenPublicKey() so WOLFSSL_RSA_VERIFY_ONLY builds do not retain an unresolved reference.

Testing

• ./configure --disable-shared && make -j2 && make -j2 check
  • 5 passed, 5 skipped, 0 failed
• Platform-SCP03 SE050 simulator focused test
  • runtime credential setup and deterministic derivation
  • explicit and seed-based key rotation
  • lifecycle, session access, and locking
  • chunked binary and ECC/RSA policy insertion
  • ECC and RSA policy-aware on-chip generation, binding, and deletion
• Configured SE05x WOLFSSL_RSA_VERIFY_ONLY object build
  • confirmed no undefined wc_RsaFlattenPublicKey reference
• git diff --check

Checklist

• added targeted simulator coverage
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

🟡 Changes recommended

The updated SE05x binary-object read path can call middleware keystore init with a NULL session pointer (crash risk) and should be corrected before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR extends the NXP SE05x (SE050) wolfCrypt port with new application-facing APIs covering session lifecycle/config access, policy-aware object/key provisioning and on-chip key generation, Platform SCP03 runtime credentials + deterministic derivation + destructive rotation, and nonce-bound object attestation with host-side verification.

Changes:

• Add public SE05x session/config access + locking helpers, plus new policy/attestation/SCP03 API surface in the SE05x port header and implementation.
• Update wolfCrypt global init/cleanup to preserve an already-configured SE05x session and to close wolfSSL-owned sessions safely.
• Document new build flags and API usage (policies, runtime SCP03, attestation) in the SE05x port README and enable the hw mutex by default for threaded SE05x builds.

File summaries

File	Description
wolfssl/wolfcrypt/settings.h	Enables the wolfCrypt hardware mutex by default for threaded SE05x builds so SE05x locking/serialization is effective.
wolfssl/wolfcrypt/port/nxp/se050_port.h	Adds public policy flags, SCP03 key struct, attestation result type, and new SE05x APIs (config/session/lock/close, policy provisioning, SCP03, attestation).
wolfcrypt/src/wc_port.c	Preserves pre-configured SE05x sessions during wolfCrypt_Init() and closes wolfSSL-owned SE05x sessions during wolfCrypt_Cleanup().
wolfcrypt/src/port/nxp/se050_port.c	Implements the new SE05x APIs: runtime SCP03 init/derive/rotate, policy handling, object attribute read, attestation retrieval and verification, and persistent key generation/insertion variants.
wolfcrypt/src/port/nxp/README_SE050.md	Updates tested middleware version and documents new flags/APIs for policies, runtime SCP03, session access/locking, and attestation verification.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11377

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 7
7 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Findings addressed, re-review would trigger a new scan.