mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-08-22 03:23:27 +02:00
Andrew Hutchings
50bb36d3bc
Real SE050 hardware (applet 3.1.1, JCOP4) refuses ReadObject on a symmetric key object created without a read policy just like applet 7.2 does, and pre-7.2 middleware has no way to grant that policy: sss_policy_common_u can_Read maps to POLICY_OBJ_ALLOW_READ only for SSS_HAVE_SE05X_VER_GTE_07_02 builds and the symmetric key policy union has no read flag at all. Switching the derive target to an HMACKey object unconditionally therefore broke ECDH offload on applet 3.x parts with SW 0x6986 at the shared secret export. Restrict the HMACKey target and its attached read policy to SSS_HAVE_SE05X_VER_GTE_07_02 builds and restore the original Binary object flow otherwise: no pre-created target, erase before derive, and the middleware creates the object when storing the derived secret. Binary objects are readable without an attached policy. Verified on SE050C (applet 3.1.1) hardware: the ECC and CURVE25519 wolfCrypt tests fail with SW 0x6986 without this change and pass with it, matching master behavior on the same part. The applet 7.2 path is unchanged.