ML-KEM: wipe ephemeral seeds and harden invalid-pk test

src/libsodium/crypto_kem/mlkem768/ref/kem_mlkem768_ref.c

@@ -722,9 +722,13 @@ int
 mlkem768_ref_keypair(unsigned char *pk, unsigned char *sk)
 {
     unsigned char seed[crypto_kem_mlkem768_SEEDBYTES];
+    int           ret;
 
     randombytes_buf(seed, crypto_kem_mlkem768_SEEDBYTES);
-    return mlkem768_ref_seed_keypair(pk, sk, seed);
+    ret = mlkem768_ref_seed_keypair(pk, sk, seed);
+    sodium_memzero(seed, sizeof seed);
+
+    return ret;
 }
 
 int
@@ -758,9 +762,13 @@ int
 mlkem768_ref_enc(unsigned char *ct, unsigned char *ss, const unsigned char *pk)
 {
     unsigned char seed[32];
+    int           ret;
 
     randombytes_buf(seed, 32);
-    return mlkem768_ref_enc_deterministic(ct, ss, pk, seed);
+    ret = mlkem768_ref_enc_deterministic(ct, ss, pk, seed);
+    sodium_memzero(seed, sizeof seed);
+
+    return ret;
 }
 
 int

test/default/kem_mlkem768.c

@@ -336,7 +336,6 @@ tv_wycheproof_modulus_overflow(void)
     unsigned char ss[crypto_kem_mlkem768_SHAREDSECRETBYTES];
     unsigned char m[32];
     size_t        i;
-    int           ret;
 
     memset(m, 0x42, 32);
 
@@ -344,13 +343,12 @@ tv_wycheproof_modulus_overflow(void)
     for (i = 0; i < sizeof wycheproof_invalid_ek / sizeof wycheproof_invalid_ek[0]; i++) {
         sodium_hex2bin(ek, sizeof ek, wycheproof_invalid_ek[i],
                        strlen(wycheproof_invalid_ek[i]), NULL, NULL, NULL);
-        ret = crypto_kem_mlkem768_enc_deterministic(ct, ss, ek, m);
-        if (ret != 0) {
-            printf("ok (rejected invalid ek)\n");
+        if (crypto_kem_mlkem768_enc_deterministic(ct, ss, ek, m) == 0) {
+            printf("FAILED (accepted invalid ek %u)\n", (unsigned int) i);
             return;
         }
     }
-    printf("accepted (no validation)\n");
+    printf("ok (rejected all invalid ek values)\n");
 }
 
 int

test/default/kem_mlkem768.exp

@@ -11,4 +11,4 @@ tv_kem_mlkem768: ok
 NIST KAT vector 1: ok
 NIST KAT vector 2: ok
 Wycheproof decapsulation (tcId 1): ok
-Wycheproof modulus overflow: ok (rejected invalid ek)
+Wycheproof modulus overflow: ok (rejected all invalid ek values)