Test SPAKE2+ rounds with a verifier key pair and with empty identities

Two end-to-end rows for behavior mandated by the PSA PAKE spec:

* The verifier may hold the full key pair (w0||w1) instead of the
  registration record (w0||L); the public part is derived internally.
* Identities that are never set default to zero-length strings, which
  RFC 9383 encodes with zero length prefixes in the transcript.

Requires the set_role server-key-pair fix and the empty-identity
relaxation in psa_pake_complete_inputs (SPAKE2+ chain, issue 9347
follow-ups): these rows fail until those fixes are present, and were
verified against a local replica of them. The setup helpers gain a
set_identities parameter for the empty-identity case.

Signed-off-by: Sigvart Hovland <sigvart.m@gmail.com>

Author: sigvartmh

tests/suites/test_suite_psa_crypto_pake.data

@@ -395,8 +395,6 @@ PSA PAKE: SPAKE2+ Verifier key-share format P-521 HMAC
 depends_on:PSA_WANT_ALG_SPAKE2P_HMAC:PSA_WANT_ECC_SECP_R1_521:PSA_WANT_ALG_SHA_512
 spake2p_verifier_key_share_format:PSA_ALG_SPAKE2P_HMAC(PSA_ALG_SHA_512):521:133:"009c79bcd7656716314fca5a6e2c5cda7ef86131399438e012a043051e863f60b5aeb3c101731e1505e721580f48535a9b0456b231b9266ae6fff49ee90d25f72f5f040135072d0fa36f9e80031294cef5c3c35b882a0efa2c66570d64a49f8bec6c66435bf65bb7c7b2a3e7dece491e02b4d567e7087dbc32fe0fae8af417dcb50be6d704012a194588b690e6d3db492656f72ddea01fc1c7fcec0f5d34a5af0102939f6fdeae39c20cff74fcdb7f09855f0fc9520d20b0520b0b096b8d42c7c3d68b4a66f751"
 
-PSA PAKE: SPAKE2+ Verifier key-share Matter KAT (RFC 9383 Appendix C P-256)
-spake2p_verifier_key_share_psa_kat:"5350414b45322b2d503235362d5348413235362d484b44462d5348413235362d484d41432d534841323536205465737420566563746f7273":"bb8e1bbcf3c48f62c08db243652ae55d3e5586053fca77102994f23ad95491b304eb7c9db3d9a9eb1f8adab81b5794c1f13ae3e225efbe91ea487425854c7fc00f00bfedcbd09b2400142d40a14f2064ef31dfaa903b91d1faea7093d835966efd":"717a72348a182085109c8d3917d6c43d59b224dc6a7fc4f0483232fa6516d8b3":"04c0f65da0d11927bdf5d560c69e1d7d939a05b0e88291887d679fcadea75810fb5cc1ca7494db39e82ff2f50665255d76173e09986ab46742c798a9a68437b048"
 # Invalid peer key-share rows: the base share is the RFC 9383 Appendix C
 # P-256 shareP; each row corrupts it in a different way.
 
@@ -528,6 +526,21 @@ spake2p_rounds:PSA_ALG_SPAKE2P_MATTER:256:"bb8e1bbcf3c48f62c08db243652ae55d3e558
 PSA PAKE: SPAKE2+ rounds wrong password (mismatched w0/w1) Matter P-256
 depends_on:PSA_WANT_ALG_SPAKE2P_MATTER:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
 spake2p_rounds_wrong_password:PSA_ALG_SPAKE2P_MATTER:256:"bb8e1bbcf3c48f62c08db243652ae55d3e5586053fca77102994f23ad95491b37e945f34d78785b8a3ef44d0df5a1a97d6b3b460409a345ca7830387a74b1dbb":"bb8e1bbcf3c48f62c08db243652ae55d3e5586053fca77102994f23ad95491b304eb7c9db3d9a9eb1f8adab81b5794c1f13ae3e225efbe91ea487425854c7fc00f00bfedcbd09b2400142d40a14f2064ef31dfaa903b91d1faea7093d835966efd"
+
+# The verifier normally holds the registration record (w0||L), but the PSA
+# spec also allows it to hold the full key pair (w0||w1): the public part is
+# derived internally (L = w1*G). Requires server-side key-pair support in
+# psa_pake_set_role()/the driver.
+PSA PAKE: SPAKE2+ rounds, verifier holds key pair (w0||w1) HMAC P-256
+depends_on:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
+spake2p_rounds:PSA_ALG_SPAKE2P_HMAC(PSA_ALG_SHA_256):256:"bb8e1bbcf3c48f62c08db243652ae55d3e5586053fca77102994f23ad95491b37e945f34d78785b8a3ef44d0df5a1a97d6b3b460409a345ca7830387a74b1dba":"bb8e1bbcf3c48f62c08db243652ae55d3e5586053fca77102994f23ad95491b37e945f34d78785b8a3ef44d0df5a1a97d6b3b460409a345ca7830387a74b1dba":1
+
+# No identities: both default to the zero-length string (PSA spec / RFC 9383).
+# Requires zero-length identity support in psa_pake_complete_inputs().
+PSA PAKE: SPAKE2+ rounds, no identities set (default empty) HMAC P-256
+depends_on:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
+spake2p_rounds_empty_identities:PSA_ALG_SPAKE2P_HMAC(PSA_ALG_SHA_256):256:"bb8e1bbcf3c48f62c08db243652ae55d3e5586053fca77102994f23ad95491b37e945f34d78785b8a3ef44d0df5a1a97d6b3b460409a345ca7830387a74b1dba":"bb8e1bbcf3c48f62c08db243652ae55d3e5586053fca77102994f23ad95491b304eb7c9db3d9a9eb1f8adab81b5794c1f13ae3e225efbe91ea487425854c7fc00f00bfedcbd09b2400142d40a14f2064ef31dfaa903b91d1faea7093d835966efd"
+
 PSA PAKE: SPAKE2+ get_shared_key before confirmation is a state error HMAC P-256
 depends_on:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
 spake2p_get_shared_key_before_confirmation:PSA_ALG_SPAKE2P_HMAC(PSA_ALG_SHA_256):256:"bb8e1bbcf3c48f62c08db243652ae55d3e5586053fca77102994f23ad95491b37e945f34d78785b8a3ef44d0df5a1a97d6b3b460409a345ca7830387a74b1dba":"bb8e1bbcf3c48f62c08db243652ae55d3e5586053fca77102994f23ad95491b304eb7c9db3d9a9eb1f8adab81b5794c1f13ae3e225efbe91ea487425854c7fc00f00bfedcbd09b2400142d40a14f2064ef31dfaa903b91d1faea7093d835966efd"