SE050Sim: always enforce symmetric key read policy

[LinuxJedi]

Motivation

Testing on real SE050C hardware (applet 3.1.1, JCOP4) showed that ReadObject on a symmetric key object created without POLICY_OBJ_ALLOW_READ is refused with SW 0x6986 on every applet generation, not just applet >= 7.2 as PR #10 assumed. The simulator only enforced this in SE050_SIM_STRICT_ECDH=1 mode, so plain CI runs missed a real regression: the wolfSSL se050_applet72_ecdh branch switched its ECDH derive target to an HMACKey object unconditionally, which passed the lenient simulator but fails with 0x6986 on applet 3.x silicon (pre-7.2 middleware cannot grant a read policy on symmetric objects at all).

Changes

• The HMACKey read-policy check moves out of strict mode and is enforced unconditionally, matching observed hardware behavior on both applet 3.1.1 and 7.2 parts.
• handle_read loses its strict parameter again; SE050_SIM_STRICT_ECDH now gates only the ECDH InObject target contract, and its doc comment says so explicitly.
• Binary (file) objects remain readable with no policy attached - that is what the pre-7.2 wolfSSL derive flow relies on, also confirmed on hardware.
• Tests updated: the lenient-mode-allows-read test is inverted (read without policy now always denied), and a new test pins Binary objects staying readable.

Validation

• cargo test: 36 lib + 14 integration tests pass.
• Docker wolfCrypt-vs-simulator, both legs run without SE050_SIM_STRICT_ECDH:
  • wolfSSL se050_applet72_ecdh tip (HMACKey + read policy on >= 7.2 builds, Binary flow otherwise): full suite passes.
  • the branch's earlier pre-policy commit: ECC fails with 0x6986 at the shared-secret readback - the exact failure previously only visible on real hardware, now caught by a plain CI run.
• Hardware cross-check: real SE050C (applet 3.1.1) denies the same read the simulator now denies, and passes with the wolfSSL branch tip.

The wolfSSL branch CI pin (SIMULATORS_REF) should be bumped to this PR's head once merged.

[Copilot]

Pull request overview

This PR updates the SE050 simulator to match observed SE050C hardware behavior by enforcing the symmetric-key (HMACKey) ReadObject policy check unconditionally (not only under SE050_SIM_STRICT_ECDH), while keeping strict mode focused on the ECDH InObject target contract.

Changes:

• Make ReadObject deny HMACKey reads unless POLICY_OBJ_ALLOW_READ is present, regardless of strict mode.
• Simplify handle_read by removing the strict parameter and updating dispatch accordingly.
• Update and extend tests to reflect the new always-enforced behavior and to pin Binary object readability.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
SE050Sim/se050-sim/src/handlers/object_mgmt.rs	Removes strict-mode gating for HMACKey ReadObject policy enforcement and updates tests.
SE050Sim/se050-sim/src/handlers/ec.rs	Clarifies that SE050_SIM_STRICT_ECDH only controls the ECDH InObject target contract, not read policy.
SE050Sim/se050-sim/src/dispatch.rs	Updates dispatch to call the new handle_read signature without a strict flag.

Comments suppressed due to low confidence (1)

SE050Sim/se050-sim/src/handlers/object_mgmt.rs:244

• This comment says the applet refuses to export a “symmetric key object”, but the check below is specific to HMACKey. Tightening the wording avoids implying that AESKey reads are also guarded here.

                    // The applet refuses to export a symmetric key object

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.