Fenrir fixes

[Frauschi]

Summary

This PR addresses a set of Fenrir-reported issues across wolfCrypt and the TLS layer. Each fix is accompanied by a regression test where applicable.

Fixes

Cipher key-state validation

• F-5378 — wc_Arc4Process() now refuses to run unless a key was configured via wc_Arc4SetKey(), preventing ARC4 from silently copying plaintext to ciphertext with an all-zero keystream. preventing DES3 operations from running with uninitialized or zeroed key material.

Sensitive-memory zeroization

• F-5437 — eccToPKCS8() now zeroizes the temporary buffer holding the plaintext ECC private key on every exit path via a consolidated goto exit cleanup.
• F-5438 — ML-DSA key generation and signing now ForceZero() the private vectors (s1, s2, t, y, …) before freeing, while skipping the public matrix A that need not be cleared.

Post-quantum / hardware ports

• F-4443 — Fixed wolfSSL_liboqsGetRandomData() to advance the output buffer between chunks and guard against size_t→word32 truncation, avoiding overwritten output and a potential infinite loop on large requests.
• F-4441 / F-4442 — Corrected the Cavium Nitrox port to write the result count into the right struct field in NitroxCheckRequests() and to pass the output-length argument with the expected Uint16* type in the RSA decrypt/verify paths, using a dedicated Uint16 temporary so the ntohs() conversion stays correct on big-endian hosts.

TLS supported_groups / ec_point_formats handling

• F-4891 — Hardened supported_groups parsing so an empty named-group list is rejected as malformed and an all-unsupported-groups list still records a (now empty) restriction instead of being treated as absent.
• F-4892 — The TLS 1.2 server now enforces RFC 8422 §5.1.2 by aborting with an illegal_parameter alert when the client's ec_point_formats extension omits the uncompressed format and an ECC cipher suite is actually negotiated; the check runs after suite selection (ssl->specs.kea) so a client that negotiates a non-ECC suite is not rejected.

Testing

Added regression tests for ARC4, DES3, supported_groups parsing, and the ec_point_formats enforcement — covering both the abort path when an ECC suite is negotiated (driven through a full handshake via memio) and the complementary case where a non-ECC (DHE_RSA) suite is negotiated and the handshake proceeds.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m3

• FLASH: .text -4 B (-0.0%, 120,901 B / 262,144 B, total: 46% used)

gcc-arm-cortex-m4

• FLASH: .text +192 B (+0.1%, 198,382 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +128 B (+0.1%, 179,416 B / 1,048,576 B, total: 17% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +256 B (+0.0%, 765,932 B / 1,048,576 B, total: 73% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +64 B (+0.0%, 276,952 B / 1,048,576 B, total: 26% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +128 B (+0.0%, 322,232 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +64 B (+0.0%, 234,208 B / 262,144 B, total: 89% used)

gcc-arm-cortex-m7

• FLASH: .text +128 B (+0.1%, 198,318 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +64 B (+0.0%, 277,528 B / 1,048,576 B, total: 26% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753