Fix v185 spec compliance authenticate object context blobs on ContextSave/Load

[aidangarske]

F-9205

[Copilot]

Pull request overview

This PR strengthens fwTPM ContextSave/ContextLoad spec compliance by authenticating object context blobs (not just session contexts) and adding domain separation so object/session blobs cannot be cross-verified.

Changes:

• Add a context “type” tag bound into the context-blob HMAC (session vs object) to enforce domain separation.
• Wrap/unwrap object context blobs using the existing encrypt-then-MAC scheme so forged plaintext object blobs fail integrity checks.
• Add unit tests covering forged-object rejection, object roundtrip, and domain separation behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
wolftpm/fwtpm/fwtpm_crypto.h	Extends context wrap/unwrap API with a context-type parameter and defines type tags.
src/fwtpm/fwtpm_crypto.c	Binds ctxType into the HMAC for wrapped context blobs.
src/fwtpm/fwtpm_command.c	Updates ContextSave/Load to wrap object blobs and enforce type-specific unwrap behavior.
tests/fwtpm_unit_tests.c	Adds tests for forged-object blob rejection, object context roundtrip, and domain separation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.