[stenslae]

Description

• tmp.m1 and tmp.m2 are now wiped with mp_forcezero instead of mp_free. They hold secrets such as w, r and (a + z_T)^-1.
• The RSK point (rsk.rsk) and the temporary points tmp.p1–tmp.p3 are wiped with wc_ecc_forcezero_point before they are freed.
• The whole SakkeKey struct is zeroed with ForceZero at the end of the function, which covers inline digits, data and hash state.
• Added test coverage to confirm zeroization

Testing

Built --enable-all-crypto --enable-heapmath and passed test suite with updated tests.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[stenslae]

@claude review

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,592 B (+0.6%, 284,040 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟡 Changes recommended

The zeroization tests fail on supported allocator and math configurations and lack coverage for the newly added RSK and temporary-point digit wipes.

3 open issues

• Exclude allocator-bypassing builds from heap-hook checks · New
• Initialize unused temporary before checking its zeroization · New
• Test zeroization of RSK and temporary point storage · New

What changed in this PR

This PR strengthens SAKKE key cleanup in wolfCrypt by wiping secret-bearing storage before release and adding zeroization checks.

Changes:

• Securely wipe temporary integers, the receiver secret key point, and temporary points.
• Zero the entire SakkeKey structure after cleanup.
• Add and register a test for structure zeroization and temporary heap-digit wiping.

File	Description
wolfcrypt/​src/​sakke.c	Wipes secret-bearing storage during wc_FreeSakkeKey.
tests/​api/​test_sakke.h	Declares and registers the zeroization test.
tests/​api/​test_sakke.c	Adds zeroization assertions and allocator hooks for heap-digit checks.

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12000

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-bugs
Not reviewed (no scan target covers them): tests/api/test_sakke.h
Coverage: 1 of 2 in-scope changed file(s) opened by the reviewer; not opened: tests/api/test_sakke.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[claude]

I reviewed this PR and didn't find any bugs. It changes key-teardown code in a crypto primitive, and the new test swaps out the global allocators, so a maintainer should still look at it.

What was reviewed:

• wc_FreeSakkeKey in wolfcrypt/src/sakke.c: mp_forcezero (heap math) wipes the used digits and then frees them, so it does everything mp_free did. The ForceZero over the whole struct runs after wc_ecc_free, and since it also clears mpInit and the pointers, freeing the same key twice is still safe.
• wc_ecc_forcezero_point is a public API that is always available, and the KMS and client SAKKE APIs the test calls are always defined, so the test needs no extra guards.
• The allocator hooks in test_wc_Sakke_FreeZeroizes pass every call through to the previously installed allocators and put them back at the end. The digit buffers it watches cover only the used digits, which matches what mp_forcezero wipes.

Extended reasoning...

The change hardens wc_FreeSakkeKey in wolfcrypt/src/sakke.c so it wipes the temporaries, the RSK and the scratch points, then zeroes the whole SakkeKey struct. It also adds a 172-line API test that installs wrapper allocators to check that the digit buffers are wiped when freed. The security-sensitive area is handling of secret key material in a crypto primitive. No bugs were found. I deferred instead of approving because the change touches crypto teardown code and the test changes global allocator state.

[stenslae]

@claude review

[Copilot]

🟡 Changes recommended

The new mp_iszero call causes tests/unit.test to fail to link in shared-library SAKKE builds using USE_FAST_MATH and hidden-symbol visibility without WOLFSSL_PUBLIC_MP.

1 open issue

• Avoid private mp_iszero in shared-library SAKKE test · New

3 resolved since last review

• Test zeroization of RSK and temporary point storage
• Initialize unused temporary before checking its zeroization
• Exclude allocator-bypassing builds from heap-hook checks

_{Review effort: Balanced}

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12000

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-bugs
Not reviewed (no scan target covers them): tests/api/test_sakke.h
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Max