Rust wrapper: copy aead keys directly into return struct

[holtrop-wolfssl]

Description

Rust wrapper: copy aead keys directly into return struct

Fixes F-11286.

Testing

How did you test?

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

🟡 Changes recommended

The new code still introduces an avoidable extra stack copy of the key via a temporary buffer, and it can be simplified to copy directly into the struct field to better align with the stated security goal.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the Rust wolfcrypt wrapper’s AEAD KeyInit::new() implementations to reduce residual key material on the stack by explicitly zeroizing the temporary key buffer after initializing the AEAD struct (Fixes F-11286).

Changes:

• Zeroize the temporary [u8; N] key buffer (k) after constructing AEAD key-holding structs.
• Apply the same pattern across ChaCha20-Poly1305/XChaCha20-Poly1305 and AES-{CCM,GCM} AEAD wrappers.

File summaries

File	Description
wrapper/rust/wolfssl-wolfcrypt/src/chacha20_poly1305.rs	Zeroizes temporary AEAD key buffer during KeyInit::new() for ChaCha20-Poly1305 and XChaCha20-Poly1305 wrappers.
wrapper/rust/wolfssl-wolfcrypt/src/aes.rs	Zeroizes temporary AEAD key buffer during KeyInit::new() for AES-CCM and AES-GCM wrappers.

Review details

Suppressed comments (6)

wrapper/rust/wolfssl-wolfcrypt/src/chacha20_poly1305.rs:536

• The temporary stack buffer k holds a full copy of the AEAD key; even though it’s zeroized, you can avoid creating the extra key copy entirely by writing directly into the struct field.

    fn new(key: &aead::Key<Self>) -> Self {
        let mut k = [0u8; 32];
        k.copy_from_slice(key.as_ref());
        let out = XChaCha20Poly1305Aead { key: k };
        k.zeroize();
        out
    }

wrapper/rust/wolfssl-wolfcrypt/src/aes.rs:586

• This creates a second stack copy of the key in k. You can avoid the extra copy (and the need to zeroize it) by copying directly into the struct’s key field.

    fn new(key: &aead::Key<Self>) -> Self {
        let mut k = [0u8; 24];
        k.copy_from_slice(key.as_ref());
        let out = Aes192Ccm { key: k };
        k.zeroize();
        out
    }

wrapper/rust/wolfssl-wolfcrypt/src/aes.rs:640

• This creates a second stack copy of the key in k. You can avoid the extra copy (and the need to zeroize it) by copying directly into the struct’s key field.

    fn new(key: &aead::Key<Self>) -> Self {
        let mut k = [0u8; 32];
        k.copy_from_slice(key.as_ref());
        let out = Aes256Ccm { key: k };
        k.zeroize();
        out
    }

wrapper/rust/wolfssl-wolfcrypt/src/aes.rs:1862

• This creates a second stack copy of the key in k. You can avoid the extra copy (and the need to zeroize it) by copying directly into the struct’s key field.

    fn new(key: &aead::Key<Self>) -> Self {
        let mut k = [0u8; 32];
        k.copy_from_slice(key.as_ref());
        let out = Aes256Gcm { key: k };
        k.zeroize();
        out
    }

wrapper/rust/wolfssl-wolfcrypt/src/aes.rs:1754

• This creates a second stack copy of the key in k. You can avoid the extra copy (and the need to zeroize it) by copying directly into the struct’s key field.

    fn new(key: &aead::Key<Self>) -> Self {
        let mut k = [0u8; 16];
        k.copy_from_slice(key.as_ref());
        let out = Aes128Gcm { key: k };
        k.zeroize();
        out
    }

wrapper/rust/wolfssl-wolfcrypt/src/aes.rs:1808

• This creates a second stack copy of the key in k. You can avoid the extra copy (and the need to zeroize it) by copying directly into the struct’s key field.

    fn new(key: &aead::Key<Self>) -> Self {
        let mut k = [0u8; 24];
        k.copy_from_slice(key.as_ref());
        let out = Aes192Gcm { key: k };
        k.zeroize();
        out
    }

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[holtrop-wolfssl]

retest this please (ERROR: PRB-fips-ready-config #14766 was deleted)

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11380

Scan targets checked: wolfcrypt-rs-bugs, wolfcrypt-rs-src

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.