Zeroize TLS 1.3 key schedule secrets at their last use

[gasbytes]

Description

Wipe the whole preMasterSecret buffer at the handshake secret's last use, since preMasterSz no longer describes its contents once the extract happens in place.
Zeroize the early secret and the PSK it was extracted from at the end of the DeriveHandshakeSecret.

Testing

Added regression tests for both fixes (test_tls13_hs_secret_zeroized_psk_ke, test_tls13_hs_secret_zeroized_sha384, test_tls13_early_secret_zeroized, test_tls13_psk_key_zeroized).

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

🟢 Approval recommended

The zeroization changes are consistent with buffer sizing/allocation in the codebase and are covered by targeted regression tests that validate the intended memory-clearing behavior.

Pull request overview

This PR hardens wolfSSL’s TLS 1.3 key schedule handling by ensuring sensitive key-schedule material is zeroized at its last use, preventing handshake/early secrets from lingering in buffers after in-place HKDF operations.

Changes:

• Zeroize the TLS 1.3 early secret (arrays->secret) and the PSK buffer (arrays->psk_key) at the end of DeriveHandshakeSecret() when derivation succeeds.
• Wipe the entire preMasterSecret buffer (ENCRYPT_LEN) at the last use sites (after deriving the master secret), since preMasterSz may no longer reflect what’s stored after in-place extract.
• Add and register regression tests that confirm these buffers are fully cleared after a successful handshake in the relevant scenarios.

File summaries

File	Description
tests/api/test_tls13.h	Registers new TLS 1.3 regression tests in the API test declaration list.
tests/api/test_tls13.c	Adds regression tests asserting preMasterSecret, secret, and psk_key buffers are zeroized after handshakes.
src/tls13.c	Implements zeroization of early secret/PSK after handshake secret derivation and wipes full preMasterSecret buffer at last use.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +64 B (+0.0%, 783,844 B / 1,048,576 B, total: 75% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +64 B (+0.0%, 302,152 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +64 B (+0.0%, 303,112 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +64 B (+0.0%, 242,703 B / 262,144 B, total: 93% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[philljj]

merge conflict in tests/

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11407

⚠️ An internal error occurred during the automated review. This error has been logged. Please contact the Fenrir team if you need assistance.

Error: CalledProcessError