fenrir fixes

[bigbrett]

• F-11419: SHE LOAD_KEY accepted any slot as the authorizing key (e.g. a client-loaded RAM key could overwrite MASTER_ECU_KEY). Changed to now enforce the AUTOSAR SHE update-authorization matrix (Table 4.5), documented in docs/src/5-Features.md.
• F-10226: SHA-2 client wrappers left hash state mutated when the server returned an error, so wolfCrypt's software fallback silently produced a wrong digest. State is now snapshotted on entry and restored on any failure (mirrors the existing SHA-3 handling). Note that this behavior is dumb HOWEVER is required for correctness as long as silent software fallback exists.
• F-11394: a failed NVM write during key revocation left the cache marked revoked+committed, so a retry returned success while the NVM record stayed unrevoked. Revocation is now persisted from a temp copy and the cache mutated only on NVM success.
• F-11393: wh_Server_Init dropped the DMA memCopyCb supplied through whServerConfig. Fixed, it is now installed (under WOLFHSM_CFG_DMA_CUSTOM_CLIENT_COPY).
• F-10219: the SHE PRNG seed's auto-cached copy was not evicted after persisting a new seed, so _ExtendSeed re-read a stale seed. Fixed so the cache entry is now evicted after the NVM write.

[Copilot]

Pull request overview

This PR tightens and documents SHE key-update authorization behavior, improves keystore/NVM consistency, and hardens several client/server crypto edge cases while expanding test coverage for the updated rules.

Changes:

• Enforce AUTOSAR SHE Table 4.5 key-update authorization matrix server-side and add tests validating allowed/denied pairings.
• Improve key/seed consistency by evicting stale cached entries after persisting updates and by persisting revocations before mutating cache state.
• Harden client crypto helpers (SHA state rollback on error; ML-DSA public export buffer sizing) and document the SHE authorization policy.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
test/wh_test_she.c	Adds SHE LOAD_KEY authorization-matrix test coverage (reject/allow cases).
test-refactor/client-server/wh_test_she.c	Mirrors authorization-matrix tests and fixes an oversized-auth test to align with new policy checks.
src/wh_server.c	Wires optional DMA custom client-copy callback from config into server DMA context.
src/wh_server_she.c	Adds explicit LOAD_KEY authorization-matrix enforcement; evicts cached PRNG seed after updates.
src/wh_server_keystore.c	Reorders key revocation to persist to NVM before mutating cache/commit state.
src/wh_client_crypto.c	Restores SHA state on client-side errors for software fallback; increases ML-DSA export public buffer size.
docs/src/5-Features.md	Documents SHE memory update authorization policy and wolfHSM’s SECRET_KEY authorization extension.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #518

Scan targets checked: wolfhsm-core-bugs, wolfhsm-crypto-bugs, wolfhsm-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[padelsbach]

If the NVM write fails, looks like the revoked copy is dropped and the entry lives on unrevoked. Is that what you're going for?

Alternatively, should we mark the entry as uncommitted/dirty and then do the write?

[padelsbach]

Should WOLFHSM_CFG_DMA_CUSTOM_CLIENT_COPY exist in a test case, or even a Makefile?

[padelsbach]

According to a quick coverage run, the two SHE fixes here aren't covered with the new tests. Could we add those?