Zeroize native private key copies before JNI byte array release

[cconlon]

This PR includes 18 Fenrir fixes:

• F-5039 / F-5056: Zeroize native ECC private key copies before JNI release.
• F-5040: Zeroize native Curve25519 private key copies in both private import paths.
• F-5041: Zeroize native Ed25519 private key copies in both private import paths.
• F-5042 / F-5043 / F-5044 / F-5045 / F-5046: Zeroize native DH and RSA private key copies.
• F-5047: Zeroize native 3DES key copy in set key path.
• F-5048: Zeroize native AES-GCM key copy in set key path.
• F-5049: Zeroize native AES-CCM key copy in set key path.
• F-5050 / F-5051 / F-5052: Zeroize native GMAC key copies in set key and one-shot generate and verify paths.
• F-5053 / F-5054 / F-5055: Zeroize native CMAC key copies in set key and one-shot generate and verify paths.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

This PR hardens JNI key-handling by wiping native copies of sensitive key material before releasing JNI byte arrays (using JNI_ABORT to avoid modifying caller-provided Java arrays).

Changes:

• Add getByteArrayIsCopy() and zeroizeByteArrayCopy() helpers to detect/correctly wipe only native JNI copies.
• Update RSA/ECC/Ed25519/Curve25519/DH/3DES JNI paths to zeroize sensitive native copies before releasing arrays.
• Add a Java regression test to ensure raw RSA private-key import does not modify caller arrays.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/test/java/com/wolfssl/wolfcrypt/test/RsaTest.java	Adds a regression test ensuring RSA raw private import doesn’t mutate caller arrays.
jni/jni_rsa.c	Uses isCopy-aware byte access and zeroizes sensitive RSA-related native copies before JNI_ABORT release.
jni/jni_native_struct.c	Introduces isCopy-aware byte getter and a helper to zeroize native copies.
jni/jni_ed25519.c	Zeroizes native copies of Ed25519 private key input buffers before release.
jni/jni_ecc.c	Zeroizes native copies of ECC private key input buffers before release.
jni/jni_dh.c	Zeroizes native copies of DH private/PKCS8 buffers before release (including error paths).
jni/jni_des3.c	Zeroizes native copy of 3DES key material prior to releasing JNI array.
jni/jni_curve25519.c	Zeroizes native copies of Curve25519 private key input buffers before release.
jni/include/wolfcrypt_jni_NativeStruct.h	Exposes new JNI helper function declarations.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.