Force-zero wc_AesSivDecrypt*() output buffer on authentication failure

[holtrop-wolfssl]

Description

Force-zero wc_AesSivDecrypt*() output buffer on authentication failure

Fixes F-5394

Testing

How did you test?

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

This PR updates AES-SIV decryption to wipe (ForceZero) the caller-provided plaintext output buffer when authentication fails, preventing accidental plaintext disclosure after an AES_SIV_AUTH_E return.

Changes:

• In AesSivCipher() (AES-SIV decrypt path), zeroize out on authentication/verification failure.
• Ensure SIV comparison is only performed when S2V computation succeeded (ret == 0).
• Add a negative test intended to assert output buffer zeroization on auth failure.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
wolfcrypt/src/aes.c	Zeroizes AES-SIV decrypt output buffer on verification failure; avoids overwriting earlier errors by guarding SIV compare with ret == 0.
wolfcrypt/test/test.c	Adds a negative test for AES-SIV auth failure intended to verify output buffer is wiped.

Comments suppressed due to low confidence (1)

wolfcrypt/test/test.c:74812

• The new negative test intends to verify that plaintext output is force-zeroed on authentication failure, but it uses testVectors[0], whose plaintextSz is 0 (empty plaintext). As a result, the loop never checks any output bytes and the test will pass even if the decrypt function does not wipe the output buffer. Use a vector with non-zero plaintextSz (e.g., index 2 in this table) so the zeroization assertion is meaningful.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753