[aidangarske]

H22, H23 - https://wolfssl.zendesk.com/agent/tickets/22516

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

Review effort: Lite
Findings: 2 · 2

Open (4)

• ivProvided is only declared under #ifdef HAVE_ARIA, but it is later used unconditionally. This… · New
• ivProvided is only declared under #ifdef HAVE_ARIA, but it is later used unconditionally. This… · New
• This introduces a new ARIA-GCM failure path (missing IV / IV already used) that returns… · New
• Adding authIvUsed changes the size/layout of WOLFSSL_EVP_CIPHER_CTX as exposed in a public… · New

What changed in this PR

This PR tightens ARIA-GCM EVP usage by requiring a fresh IV per message and tracking IV consumption across operations, addressing ticket H22/H23.

Changes:

• Add authIvUsed tracking to EVP cipher contexts for ARIA-GCM flows.
• Enforce “IV must be set and unused” checks in ARIA-GCM encryption paths, failing when violated.
• Add API tests covering “IV required” and “new IV per message” behavior for ARIA-GCM.

File	Description
wolfssl/​openssl/​evp.h	Extends WOLFSSL_EVP_CIPHER_CTX to support ARIA IV sizing and adds authIvUsed state bit.
wolfcrypt/​src/​evp.c	Implements ARIA-GCM IV freshness checks and updates authIvUsed transitions across encrypt operations.
tests/​api/​test_evp_cipher.h	Registers two new ARIA-GCM IV behavior tests.
tests/​api/​test_evp_cipher.c	Adds test coverage for missing-IV failure and per-message IV enforcement for ARIA-GCM.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11594

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 2 of 3 in-scope changed file(s) opened by the reviewer; not opened: tests/api/test_evp_cipher.c

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Lite

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,592 B (+0.6%, 284,040 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

stale fixed review

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11594

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[philljj]

This is pre-existing, but while we're here could you correct this endif comment

    #endif /* HAVE_AESGCM && ((!HAVE_FIPS && !HAVE_SELFTEST) ||
            * HAVE_FIPS_VERSION >= 2 */

comment to match the opening

    #if defined(HAVE_ARIA)

Also, this branch is 795 commits behind master, and it's a good excuse to rebase just to be safe.

[aidangarske]

Fixed the endif comment to HAVE_ARIA and rebased on current master.