1 files changed, 33 insertions, 0 deletions
diff --git a/tools/tests/test_gen_fixture_wrap.py b/tools/tests/test_gen_fixture_wrap.py
new file mode 100644
index 0000000..1c72e66
--- /dev/null
+++ b/tools/tests/test_gen_fixture_wrap.py
@@ -0,0 +1,33 @@
+# Author:  cirakg & claude ai
+# Summary: Tests that the fixture PIN wrap generator matches the constants in source/app/Fixtures.mc and RFC 5869.
+from __future__ import annotations
+
+import re
+import shutil
+from pathlib import Path
+
+import gen_fixture_wrap
+import pytest
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+def fixture_constant(name: str) -> str:
+    text = (ROOT / "source" / "app" / "Fixtures.mc").read_text(encoding="utf-8")
+    match = re.search(rf'const {name} = "([0-9a-f]+)"', text)
+    assert match, f"{name} not found in Fixtures.mc"
+    return match.group(1)
+
+
+def test_hkdf_matches_rfc5869_case_3() -> None:
+    # RFC 5869 A.3: empty salt and info.
+    okm = gen_fixture_wrap.hkdf(bytes([0x0B] * 22), b"", 42)
+    assert okm.hex() == (
+        "8da4e775a563c18f715f802a063c5a31b8a11f5c5ee1879ec3454e5f3c738d2d9d201395faa4b61a96c8"  # RFC 5869 A.3
+    )
+
+
+@pytest.mark.skipif(shutil.which("openssl") is None, reason="needs openssl for AES")
+def test_generated_wrap_matches_the_fixture() -> None:
+    assert gen_fixture_wrap.fixture_wrap().hex() == fixture_constant("FIXTURE_WRAP")
+    assert gen_fixture_wrap.MASTER_KEY.hex() == fixture_constant("FIXTURE_MASTER_KEY")