PQC test fails in spdm-emu when sync to latest libspdm

[Li-Aaron]

Problem Statement

When sync to latest libspdm in spdm-emu (DMTF/spdm-emu#447)
There is segment fault in spdm_responder_emu during generate CERTIFICATE response. (https://github.com/DMTF/spdm-emu/actions/runs/19886254234/job/56994032221?pr=449)

Detail

Created several test PRs to isolate the change causing this failure:

PR	libspdm version	result
DMTF/spdm-emu#450	no commit synced, libspdm @93dc9af)	vs2019 openssl build fails, other passed
DMTF/spdm-emu#448	sync to 00cb395	vs2019 openssl build fails, other passed
DMTF/spdm-emu#449	sync to 703651f	same failure with sync to latest

This should be the commit introduce the issue: 703651f

[Li-Aaron]

Debug in local environment (VS2019)

the exception happens in libcrypto-3-x64.dll when responder generate CHALLENGE_AUTH response

Call stack

Exception

To Reproduce

Build spdm-emu

git clone https://github.com/DMTF/spdm-emu
cd spdm-emu
git submodule update --init --recursive
cd libspdm
git checkout 703651f5c0c815e11fa794f2a7e7ed2556a572ed
git submodule update --recursive
cd ..
mkdir build
cd build
cmake -G"NMake Makefiles" -DARCH=x64 -DTOOLCHAIN=VS2019 -DTARGET=Debug -DCRYPTO=openssl ..
nmake copy_sample_key
nmake
xcopy out\openssllib.out\openssl-install\bin\libcrypto-3-x64.dll bin\

Run spdm_responder_emu and spdm_requester_emu in different console

cd build\bin
spdm_responder_emu --pqc_first TRUE

cd build\bin
spdm_requester_emu --pqc_first TRUE

[jyao1]

@coder-sageres, could you please take a look?

[Li-Aaron]

Root Cause

in libspdm_mldsa_get_private_key_from_pem()

libspdm/os_stub/cryptlib_openssl/pem/pem_pqc.c

Line 85 in 703651f

*dsa_context = pkey;

in libspdm_mldsa_sign()

libspdm/os_stub/cryptlib_openssl/pk/mldsa_ext.c

Lines 143 to 144 in 703651f

	ctxobj = (libspdm_key_context *)dsa_context;
	switch (libspdm_mldsa_type_name_to_nid(EVP_PKEY_get0_type_name(ctxobj->evp_pkey))) {

The commit introduced libspdm_key_context to wrap the original cryptographic context. However, not all PQC-related functions have been updated to use this new wrapper consistently.

More examples

in libspdm_slhdsa_get_private_key_from_pem()

libspdm/os_stub/cryptlib_openssl/pem/pem_pqc.c

Line 175 in 703651f

*dsa_context = pkey;

Suggestion

A comprehensive audit of all cryptographic context generation and usage points is needed to ensure consistent implementation of the libspdm_key_context wrapper across all PQC-related functions.

[jyao1]

I filed #3445, to enhance unit test.

[Li-Aaron]

Note: For EMU Windows build, change DMTF/spdm-emu@66c7cf5 is required