Route the single-block RFC 5649 key wrap/unwrap through the ECB crypto callback when HAVE_AES_ECB and ForceZero the temporary key-material buffer.

Author: night1rider

wolfcrypt/src/aes.c

@@ -16543,9 +16543,17 @@ int wc_AesKeyWrap_Pad_ex(Aes* aes, const byte* in, word32 inSz, byte* out,
         XMEMCPY(tmp, aiv, KEYWRAP_BLOCK_SIZE);
         XMEMCPY(tmp + KEYWRAP_BLOCK_SIZE, out + KEYWRAP_BLOCK_SIZE,
                 KEYWRAP_BLOCK_SIZE);
+#ifdef HAVE_AES_ECB
+        /* Route through wc_AesEcbEncrypt so an ECB crypto callback can service
+         * the block (matches AesKeyWrapRaw); it saves its own registers. */
+        ret = wc_AesEcbEncrypt(aes, out, tmp, WC_AES_BLOCK_SIZE);
+#else
         VECTOR_REGISTERS_PUSH;
         ret = wc_AesEncryptDirect(aes, out, tmp);
         VECTOR_REGISTERS_POP;
+#endif
+        /* tmp held AIV | plaintext key material */
+        ForceZero(tmp, sizeof(tmp));
     }
     else {
         /* run the RFC 3394 loop with the AIV as the initial value */
@@ -16631,13 +16639,21 @@ int wc_AesKeyUnWrap_Pad_ex(Aes* aes, const byte* in, word32 inSz, byte* out,
     if (n == 1) {
         /* single block: AIV|P[1] = DEC(K, C[0]|C[1]) */
         byte tmp[WC_AES_BLOCK_SIZE];
+#ifdef HAVE_AES_ECB
+        /* Route through wc_AesEcbDecrypt so an ECB crypto callback can service
+         * the block (matches AesKeyUnWrapRaw); it saves its own registers. */
+        ret = wc_AesEcbDecrypt(aes, tmp, in, WC_AES_BLOCK_SIZE);
+#else
         VECTOR_REGISTERS_PUSH;
         ret = wc_AesDecryptDirect(aes, tmp, in);
         VECTOR_REGISTERS_POP;
+#endif
         if (ret == 0) {
             XMEMCPY(a, tmp, KEYWRAP_BLOCK_SIZE);
             XMEMCPY(out, tmp + KEYWRAP_BLOCK_SIZE, KEYWRAP_BLOCK_SIZE);
         }
+        /* tmp held AIV | plaintext key material */
+        ForceZero(tmp, sizeof(tmp));
     }
     else {
         /* recover A and padded plaintext via the RFC 3394 loop (no check) */