Reject repeated wc_AsconAEAD128_SetAD calls

[miyazakh]

Summary(f7399)

wc_AsconAEAD128_SetKey() and wc_AsconAEAD128_SetNonce() reject a second call with BAD_STATE_E, but wc_AsconAEAD128_SetAD() did not. SetAD is not a plain field setter: it runs the key/nonce absorption permutation, XORs the key into the state, absorbs the AD blocks, and applies domain separation. Calling it twice re-runs that sequence on the already-advanced state, and both calls return 0. A caller that split associated data across two buffers would get a tag that authenticates under no conforming Ascon implementation, with no error reported anywhere.

Associated data must be supplied in a single call. This adds the missing if (a->adSet) return BAD_STATE_E; guard, matching the two sibling functions.

Changes

• wolfcrypt/src/ascon.c: return BAD_STATE_E from wc_AsconAEAD128_SetAD() when the associated data has already been set.
• doc/dox_comments/header_files/ascon.h: document the new return case.
• tests/api/test_ascon.c: assert the repeat call is rejected.
• ChangeLog.md: add entry under Fixes.

Testing

• ./configure --enable-ascon --enable-experimental && make
• ./wolfcrypt/test/testwolfcrypt — ASCON AEAD test passes
• ./tests/unit.test ascon group (tests 377-381) — all pass

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

This PR hardens the Ascon AEAD128 API by rejecting repeated calls to wc_AsconAEAD128_SetAD(), aligning its state-machine behavior with wc_AsconAEAD128_SetKey() and wc_AsconAEAD128_SetNonce() to prevent producing non-conformant authentication tags without error.

Changes:

• Add an adSet one-shot guard to wc_AsconAEAD128_SetAD() returning BAD_STATE_E on repeat calls.
• Update API tests to assert a repeated SetAD call is rejected.
• Update Doxygen documentation and add a ChangeLog entry describing the behavior change/fix.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
wolfcrypt/src/ascon.c	Adds a state guard to reject repeated associated-data absorption.
tests/api/test_ascon.c	Extends decision-coverage tests to verify the new BAD_STATE_E behavior on repeat SetAD.
doc/dox_comments/header_files/ascon.h	Documents the new BAD_STATE_E return case for repeated SetAD.
ChangeLog.md	Records the fix and its impact for release notes.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11314

Scan targets checked: wolfcrypt-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

[wolfSSL-Bot]

Can one of the admins verify this patch?

[miyazakh]

retest this please

[julek-wolfssl]

@miyazakh please fix merge conflicts

[miyazakh]

retest this please

[philljj]

This looks and tests fine, but the changelog.md has a merge conflict.