Add FDO client-sdk-fidoiot patch for wolfSSL

[stenslae]

Adds client-sdk-fidoiot/, a patch that gives the FDO Client SDK a wolfSSL crypto/TLS backend and optional wolfTPM device attestation. Upstream is archived, so the patch
targets its last code commit, 40e5024 (2025-08-06).

Added:

• wolfSSL backend (-DTLS=wolfssl): ECDSA P-256/P-384 signing and verification, ECDH KEX,
  SHA-2, HMAC, AES-GCM/CCM, the RNG, and curl over wolfSSL TLS.
• wolfTPM option (-DTPM_STACK=wolftpm): device attestation through wolfTPM as an
  alternative to tpm2-tss.
• Unit tests for the wolfSSL backend, plus .github/build_wolfssl_ci.sh to build and run
  the tests across configurations.
• Build tooling: utils/install_wolfssl_curl.sh builds wolfSSL, curl and wolfTPM, and
  GPG-verifies the wolfSSL and curl tarballs. There is also a Dockerfile and a Jenkinsfile.
• Yocto: a clientsdk-wolfssl recipe in utils/meta-intel-sdo.
• Fixes to the existing code:
  • bounds checks on DER signature encoding and on peer-random parsing
  • validation of the peer's point in ECDH
  • correct byte order for the raw device key
  • AES IV rollover handling
  • freeing results from tpm2 NV calls

[Copilot]

🟡 Changes recommended

The testing instructions omit the required wolfTPM installation prerequisite.

1 open finding

• Document wolfTPM prerequisite for the test command · New

What changed in this PR

Documents how to apply, build, test, and integrate the FDO wolfSSL/wolfTPM patch.

Changes:

• Adds build and dependency setup instructions.
• Documents testing, wolfTPM, and Yocto workflows.

File	Description
client-sdk-fidoiot/​README.md	Adds usage and integration documentation.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The wolfTPM and Yocto instructions omit conditions needed for reproducible builds.

2 open findings

• Ensure existing meta-wolfssl checkouts use the pinned revision · New
• Document exporting WOLFTPM_ROOT before configuring · New

1 resolved since last review

• Document wolfTPM prerequisite for the test command

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

The manual wolfTPM instructions use a prefix inconsistent with the documented CMake configuration.

1 open finding

• Align manual install prefix with CMake search path · New

2 resolved since last review

• Ensure existing meta-wolfssl checkouts use the pinned revision
• Document exporting WOLFTPM_ROOT before configuring

🧠 Review effort: Balanced

[Copilot]

🟢 Approval recommended

The documentation is consistent with the accompanying patch tooling and resolves the previously identified setup issues.

0 open findings

1 resolved since last review

• Align manual install prefix with CMake search path

🧠 Review effort: Balanced