Harden fwTPM command processing

docs/fwtpm/overview.md

@@ -341,7 +341,7 @@ The eight Version 185 PQC commands (`TPM2_Encapsulate`, `TPM2_Decapsulate`, `TPM
 
 Implemented counts assume RSA, ECC, AES, and all feature groups, with SPDM, PQC (except in the Version 185 row), and the vendor test command disabled. Enabling `WOLFTPM_SPDM` adds `PolicyTransportSPDM` (one more implemented code). The Version 185 row includes the eight PQC commands.
 
-Known limitations: `TPM2_SelfTest` is a minimal smoke test and `TPM2_IncrementalSelfTest` is a stub, as noted above, and `SU_STATE` resume is not supported (see the lifecycle section). The command coverage above should not be read as full conformance with the TCG specification.
+Known limitations: `TPM2_SelfTest` is a minimal smoke test and `TPM2_IncrementalSelfTest` is a stub, as noted above, `SU_STATE` resume is not supported (see the lifecycle section), `TPM2_PolicySecret` rejects nonzero expiration because expiring policy tickets are not supported, and `TPM2_DictionaryAttackParameters` limits `newMaxTries` to 65535. The command coverage above should not be read as full conformance with the TCG specification.
 
 ## Startup and Shutdown Lifecycle
 

examples/bench/bench.c

@@ -251,7 +251,8 @@ static int bench_sym_aes(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* storageKey,
         XMEMSET(iv, 0, sizeof(iv));
         rc = wolfTPM2_EncryptDecrypt(dev, &aesKey, in, out, inOutSz, iv,
             sizeof(iv), isDecrypt);
-        if (bench_unsupported(rc)) {
+        if (bench_unsupported(rc) ||
+                (rc & RC_MAX_FMT1) == TPM_RC_MODE) {
             printf("%-16s Skipped (not supported)\n", desc);
             rc = 0;
             goto exit;

src/fwtpm/fwtpm.c

@@ -104,6 +104,12 @@ int FWTPM_Init(FWTPM_CTX* ctx)
         }
     }
 
+    /* Timed authorization tickets are valid only within this time epoch. */
+    if (rc == 0) {
+        rc = wc_RNG_GenerateBlock(&ctx->rng, ctx->timeEpoch,
+            sizeof(ctx->timeEpoch));
+    }
+
 #ifndef FWTPM_NO_CONTEXT
     /* Generate per-boot context protection key (volatile only) for
      * ContextSave/ContextLoad HMAC + AES-CFB session blob protection. */