Add check for EPHEMERAL flag in 3 CacheKey functions

[padelsbach]

Stumbled upon a missing check for the ephemeral flag in wh_Client_MlDsaMakeCacheKey, wh_Client_Ed25519MakeCacheKey and wh_Client_MlKemMakeCacheKey. Tests added.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #533

Scan targets checked: wolfhsm-crypto-bugs, wolfhsm-src
Coverage: 4 of 7 in-scope changed file(s) opened by the reviewer; not opened: test-refactor/client-server/wh_test_crypto_curve25519.c, test-refactor/client-server/wh_test_crypto_ed25519.c, test-refactor/client-server/wh_test_crypto_mlkem.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[Copilot]

Copilot review overview

🟡 Changes recommended

The public API documentation and stated PR scope do not reflect all newly enforced restrictions.

Review effort: Balanced
Findings: 2

Open (2)

• Undocumented Curve25519 API behavior change · New
• Document EPHEMERAL flag rejection in public API · New

What changed in this PR

Adds client-side rejection of ephemeral flags for cache-only key generation and regression tests.

Changes:

• Rejects WH_NVM_FLAGS_EPHEMERAL across four cache-key APIs.
• Adds legacy and refactored test coverage.
• Registers the new ML-KEM test suite.

File	Description
src/​wh_client_crypto.c	Adds ephemeral-flag validation.
test/​wh_test_crypto.c	Extends legacy argument tests.
test-refactor/​wh_test_list.c	Registers ML-KEM tests.
test-refactor/​client-server/​wh_test_crypto_mlkem.c	Adds ML-KEM regression test.
test-refactor/​client-server/​wh_test_crypto_mldsa.c	Adds ML-DSA regression test.
test-refactor/​client-server/​wh_test_crypto_ed25519.c	Adds Ed25519 regression test.
test-refactor/​client-server/​wh_test_crypto_curve25519.c	Adds Curve25519 regression test.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.