[jackctj117]

Zeroization of SSPs inside the FIPS v7 module for ISO/IEC 19790:2012 7.9.7: the Level 1 zeroization methods ([09.28], [09.29]) and the Level 2 rules for temporary SSPs ([09.30] to [09.32]). Every wipe is ForceZero; none is built out by a define. Scope is the v7 service list; see the end for what is left out on purpose.

By area

• Hashes (sha.c, sha256.c, sha512.c, sha3.c, hmac.c): the per-block scratch of the C transforms lives in the context and is wiped once at Free (per-block and per-Final wipes cost 8 to 13 percent and were dropped). Free, a failed Copy and the GetHash copies wipe the whole context; WOLFSSL_HASH_KEEP messages and SMALL_STACK_CACHE schedules are wiped before they are freed. HMAC wipes its key padding temporaries and the object.
• AES (aes.c, cmac.c): temporary key schedules, GHASH scratch through a caller-owned GcmScratch, keystream blocks, XTS tweaks and key-wrap intermediates. GCM and CCM decrypt output is wiped on authentication or primitive failure, the raw GHASH is wiped if E(J0) fails, a failed re-key clears the GCM state, and a stream whose primitive failed is invalidated. One-shot CMAC objects are wiped before free.
• RSA (rsa.c): private components at Free and after a failed import or keygen, OAEP and padding temporaries, and the output of a failed encrypt or decrypt.
• ECC and ECDSA (ecc.c): scalar copies, ladder temporaries and deterministic k; a rejected private import wipes k and clears the key type.
• EdDSA (ed25519.c, ed448.c): scalar and nonce temporaries; the persistent hash is freed on failure.
• ML-KEM (wc_mlkem.c, wc_mlkem_poly.c): the hash and PRF objects are wiped at every KeyGen, Encaps and Decaps exit (FIPS 203 3.3), with m, r, K', the implicit-rejection flag and the ciphertext of a failed encapsulation.
• ML-DSA, SLH-DSA, LMS, XMSS: polynomial and seed temporaries; SLH-DSA copies aliased seed inputs before wiping the old key, clears its flags on failure and clears its reusable F output; the LMS and XMSS verify-path hash helpers wipe their state.
• KDFs (kdf.c, pwdbased.c): SSH KDF, SRTP KDF, PBKDF2 and HKDF temporaries. The SSH KDF no longer re-initialises its hash inside the loop, which orphaned the cached schedule under SMALL_STACK_CACHE.
• RNG (random.c, rng_bank.c): a failed instantiate is uninstantiated, the stir accumulator is wiped under a CONSUMING claim, seed buffers are wiped before they are freed, the NoiseSrc health scratch and the no-malloc DRBG state are wiped at Free.
• misc.c: volatile fallback for ForceZero on compilers without the inline-asm barrier.

Out of scope on purpose, per the v7 service list: crypto callback and async paths, WC_C_DYNAMIC_FALLBACK, non-blocking contexts, SAKKE, DH, X25519/X448 and the fe/ge math files, PBKDF1, PKCS#12 PBKDF, scrypt, TLS 1.0 PRF, X9.63 KDF, ECIES, and the LMS/XMSS private-key paths. The SHA-3 block function signature change is carried through the fallback and FrodoKEM call sites so non-FIPS builds keep compiling. The SP backends and the assembly backends are a separate change and follow in a sister PR.

Performance: RSA-2048, ECDHE and ECDSA P-256/384/521 and ML-KEM-768 are within 1 percent of master on arm64.

ABI note

The per-block scratch of the software hashes now lives in the context so it can be wiped once at Free instead of once per block or per Final. That changes public struct sizes:

struct	change
wc_Sha	gains W[16]
wc_Sha256	gains Wbuf[64] (WC_SHA256_W_IN_CTX), except kernel builds (WC_SHA2_NO_SMALL_STACK) and small-stack builds with malloc, which keep it on the stack or heap
wc_Sha3	gains scratch[WC_SHA3_SCRATCH_W] (5, 30 or 80 lanes by configuration)
SlhDsaKey	gains sha2Digest[32] at the end under WOLFSSL_SLHDSA_SHA2

Everything that embeds these grows with them: Hmac, wc_HashAlg and the OpenSSL compatibility holders. On the reviewer's 64-bit default build that was wc_Sha 104 to 168 bytes, wc_Sha256 120 to 376, wc_Sha3 416 to 656, Hmac 784 to 1024, wc_HashAlg 432 to 672; exact sizes depend on target and options. WC_SHA3_BLOCK_FN also takes a scratch argument when WC_SHA3_SCRATCH_W is defined.

Applications that embed these structs or link the shared library must be rebuilt against the new headers. Whether the release bumps the soname is a release decision. The layout conditions follow WOLFSSL_SMALL_STACK and WOLFSSL_SMALL_STACK_CACHE, so ecc.c now includes the hash, RNG and AES headers before its local override of those macros.

[Copilot]

🟡 Changes recommended

Unresolved zeroization gaps remain, along with a critical SHA-3 build-compatibility issue.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This pull request expands secure zeroization across wolfCrypt cryptographic implementations to support ISO/IEC 19790 compliance.

Changes:

• Clears sensitive keys, hashes, seeds, signatures, and temporary buffers.
• Adds cleanup across classical, elliptic-curve, post-quantum, hashing, RNG, and KDF code.
• Extends zeroizing cleanup to architecture-specific arithmetic implementations.

File summaries

File	Changes
wolfcrypt/src/wolfentropy.c	Zeroizes entropy samples and conditioning state.
wolfcrypt/src/wc_xmss.c	Clears XMSS state, seeds, and private material.
wolfcrypt/src/wc_xmss_impl.c	Clears XMSS hash intermediates.
wolfcrypt/src/wc_slhdsa.c	Clears SLH-DSA signing and key-generation state.
wolfcrypt/src/wc_mlkem.c	Clears ML-KEM key-generation failure state.
wolfcrypt/src/wc_mldsa.c	Clears ML-DSA signing and private state.
wolfcrypt/src/wc_lms_impl.c	Clears LMS hash and derived-seed buffers.
wolfcrypt/src/sp_x86_64.c	Zeroizes x86-64 arithmetic temporaries.
wolfcrypt/src/sp_riscv64.c	Zeroizes RISC-V arithmetic temporaries.
wolfcrypt/src/sp_cortexm.c	Zeroizes Cortex-M arithmetic temporaries.
wolfcrypt/src/sp_c64.c	Zeroizes generic 64-bit arithmetic temporaries.
wolfcrypt/src/sp_c32.c	Zeroizes generic 32-bit arithmetic temporaries.
wolfcrypt/src/sp_armthumb.c	Zeroizes ARM Thumb arithmetic temporaries.
wolfcrypt/src/sp_arm64.c	Zeroizes ARM64 arithmetic temporaries.
wolfcrypt/src/sp_arm32.c	Zeroizes ARM arithmetic temporaries.
wolfcrypt/src/sha512.c	Clears SHA-512 temporary state.
wolfcrypt/src/sha3.c	Clears SHA-3 state and buffers.
wolfcrypt/src/sha256.c	Clears SHA-256 temporary state.
wolfcrypt/src/sha.c	Clears hash temporary state.
wolfcrypt/src/rsa.c	Clears RSA temporary values.
wolfcrypt/src/random.c	Clears DRBG and temporary state.
wolfcrypt/src/pwdbased.c	Clears password-based derivation temporaries.
wolfcrypt/src/kdf.c	Clears derived-key temporary buffers.
wolfcrypt/src/hmac.c	Clears HMAC temporary state.
wolfcrypt/src/ed448.c	Clears Ed448 signing intermediates.
wolfcrypt/src/ed25519.c	Clears Ed25519 signing intermediates.
wolfcrypt/src/ecc.c	Clears ECC signing and scalar temporaries.
wolfcrypt/src/dh.c	Clears DH private and temporary state.
wolfcrypt/src/curve448.c	Clears Curve448 private material.
wolfcrypt/src/curve25519.c	Clears Curve25519 private material.
wolfcrypt/src/cmac.c	Clears CMAC state before release.
wolfcrypt/src/aes.c	Clears AES temporary state and intermediates.

Review details

Suppressed comments (16)

wolfcrypt/src/aes.c:18629

• This wrapper now clears its tweak buffer, but AesXtsEncryptUpdate_sw still leaves its local buf/ciphertext-stealing buffers uncleared when AES fails (and after normal return). Those buffers contain plaintext or key-derived intermediate data, so the inner helper needs success and error cleanup as well.

    ForceZero(tweak_block, sizeof(tweak_block));

wolfcrypt/src/aes.c:19177

• Clearing tweak_block here does not clear the local buf and tmp2 intermediates in AesXtsDecryptUpdate_sw. AES failures and the bounds-error return leave ciphertext/plaintext-derived values on the stack; add cleanup in that helper for each exit path.

    ForceZero(tweak_block, sizeof(tweak_block));

wolfcrypt/src/cmac.c:681

• wc_AesCmacVerify_ex uses local a for the computed tag, but wiping the Cmac object here does not touch that buffer. On successful comparison, mismatch, or generation error, the derived tag remains on the stack; add a cleanup of a on every exit after it is declared.

    ForceZero(cmac, sizeof(Cmac));
    XFREE(cmac, NULL, DYNAMIC_TYPE_CMAC);

wolfcrypt/src/curve25519.c:712

• This handles a public-generation failure, but wc_curve25519_make_priv() can partially fill key->k and return an RNG error before this block is entered. Because the function then returns with privSet clear, the partial scalar is left in the key object. Wipe key->k on every nonzero private-generation result, not only after public derivation fails.

            ForceZero(key->k, sizeof(key->k));
            key->privSet = 0;
        }

wolfcrypt/src/curve25519.c:805

• The normal key-generation path has the same gap as the nonblocking path: wc_curve25519_make_priv() may leave partial RNG output in key->k, then the function returns before this public-generation cleanup. Clear the scalar when private generation fails as well.

                /* Public half failed: drop the scalar too
                 * (ISO/IEC 19790:2012 7.9.7). */
                ForceZero(key->k, sizeof(key->k));
                key->privSet = 0;

wolfcrypt/src/curve448.c:296

• This clears the scalar only when public derivation fails. wc_RNG_GenerateBlock() can partially fill key->k before returning an error, and that path bypasses this block, leaving failed key material in the object. Wipe key->k for RNG failures too before returning.

            ForceZero(key->k, sizeof(key->k));
            XMEMSET(key->p, 0, sizeof(key->p));
            /* A zeroised SSP shall not be reusable
             * (ISO/IEC 19790:2012 7.9.7 [09.29]). */
            key->privSet = 0;

wolfcrypt/src/dh.c:1515

• GeneratePrivateDh186() can fill part of priv and then return an error from mp_to_unsigned_bin() after setting *privSz, but this flag is set only when the call returns success. The new cleanup therefore skips a partially written private key on that path; track possible output (or wipe on every nonzero return using the output capacity) before returning.

    privWritten = (ret == 0);

wolfcrypt/src/dh.c:1528

• The new private-key wipe is limited to wc_DhGenerateKeyPair_Sync. The Intel async path generates priv before bignum conversion and hardware submission, then returns directly on failures without clearing it or resetting *privSz; a failed asynchronous key pair can therefore expose the generated private value. Apply the same failure cleanup to that path before its return.

    if (privWritten && (ret != 0)) {
        /* A failed pair is not handed back (ISO/IEC 19790:2012 7.9.7). */
        ForceZero(priv, *privSz);
        *privSz = 0;

wolfcrypt/src/ecc.c:7904

• The cleanup at this point only runs on the normal software path. Deterministic signing has already populated key->sign_k, but the allocation/initialization failures in the earlier bignum setup and the Intel/Cavium async branch return before reaching this line, leaving the nonce allocated in the key. Route those exits through a common cleanup label (while preserving the pending-operation case) so every completed error consumes sign_k.

   ecc_sign_k_forcezero(key);

wolfcrypt/src/ed25519.c:485

• The PCT cleanup clears the generated key, but ed25519_pairwise_consistency_test() also leaves its RNG-generated digest message on the stack on success and every failure path. Since this temporary random material is created solely for the consistency test, clear it before returning from the PCT as well.

        ForceZero(key->k, ED25519_PRV_KEY_SIZE);
        ForceZero(key->p, ED25519_PUB_KEY_SIZE);

wolfcrypt/src/ed448.c:417

• The PCT cleanup clears the generated key, but ed448_pairwise_consistency_test() also leaves its RNG-generated digest message on the stack on success and every failure path. Clear that temporary random material before the PCT returns.

            ForceZero(key->k, ED448_PRV_KEY_SIZE);
            ForceZero(key->p, ED448_PUB_KEY_SIZE);

wolfcrypt/src/wc_lms_impl.c:485

• wc_Sha256HashBlock() stages the input block in sha256->buffer on the byte-reversing path and does not clear it. The LMS caller passes blocks containing SEED/WOTS material, so clearing only the local digest output still leaves secret input in the hash object after this helper returns.

    /* Prefix is x_q[i] or a child SEED (ISO/IEC 19790:2012 7.9.7). */
    ForceZero(output, sizeof(output));

wolfcrypt/src/wc_lms_impl.c:550

• In the 64-to-120-byte path above, the secret suffix and padding are written into sha256->buffer and wc_Sha256HashBlock() leaves that buffer populated. The new output wipe does not remove this residual seed material; clear the SHA-256 buffer here as well.

    /* Prefix is x_q[i] or a child SEED (ISO/IEC 19790:2012 7.9.7). */
    ForceZero(output, sizeof(output));

wolfcrypt/src/wc_lms_impl.c:596

• This manual finalizer constructs the padded block directly in sha256->buffer, and wc_Sha256HashBlock() does not reset or wipe that field. Consequently, secret LMS prefixes can remain in the hash object after the finalizer returns; wipe the buffer on both success and error paths.

    /* Prefix is x_q[i] or a child SEED (ISO/IEC 19790:2012 7.9.7). */
    ForceZero(output, sizeof(output));

wolfcrypt/src/wc_slhdsa.c:7368

• On a hypertree-signing failure, the code clears only the FORS prefix. slhdsakey_ht_sign can have already written part of the suffix, and the caller has also written the initial randomness prefix, so those regions can retain partial signature/WOTS intermediates after an error. Clear the entire produced signature buffer on failure, with the outer caller handling its prefix length correctly.

    if (ret != 0) {
        /* Unreleased FORS secrets may be in sig
         * (ISO/IEC 19790:2012 7.9.7). */
        ForceZero(sigFors, key->params->k * (1 + key->params->a) * n);

wolfcrypt/src/wc_slhdsa.c:7240

• After callback unavailability, the software fallback stages all three seeds in key->sk and slhdsakey_compute_root() can return an error. The callback-only wipe above is not reached on that path, so failed software generation leaves private seeds marked in the key object; clear them and invalidate the key before returning the fallback error.

            /* fall-through when unavailable */
            ret = 0;

• Files reviewed: 32/32 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m0plus

• FLASH: .text +152 B (+0.2%, 70,611 B / 262,144 B, total: 27% used)

gcc-arm-cortex-m3

• FLASH: .text +380 B (+0.3%, 131,149 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4

• FLASH: .text +704 B (+0.3%, 210,652 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m4-baremetal

• FLASH: .text +256 B (+0.4%, 73,271 B / 262,144 B, total: 28% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .text +1,664 B (+0.9%, 184,255 B / 262,144 B, total: 70% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +320 B (+0.2%, 194,648 B / 1,048,576 B, total: 19% used)

gcc-arm-cortex-m4-min-ecc

• FLASH: .text +256 B (+0.4%, 67,929 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +2,048 B (+0.3%, 798,188 B / 1,048,576 B, total: 76% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +1,792 B (+0.8%, 225,344 B / 262,144 B, total: 86% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +2,176 B (+0.7%, 313,892 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +1,536 B (+0.4%, 344,664 B / 1,048,576 B, total: 33% used)

gcc-arm-cortex-m4-sp-math

• FLASH: .text +256 B (+0.4%, 67,929 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +384 B (+0.3%, 131,921 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +1,664 B (+0.7%, 250,894 B / 262,144 B, total: 96% used)

gcc-arm-cortex-m7

• FLASH: .text +704 B (+0.3%, 210,652 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +2,112 B (+0.7%, 314,788 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +1,600 B (+0.6%, 250,894 B / 262,144 B, total: 96% used)

stm32-sim-stm32h753

• FLASH: .text +1,472 B (+0.7%, 207,192 B / 2,097,152 B, total: 10% used)

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,424 B (+0.5%, 283,872 B / 67,108,864 B, total: 0% used)

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[JacobBarthelmeh]

Changes look good. Performance is under review.