SHA-3: fix wrong digest on refused vector claim, v7 gates, build fixes

[kaleb-himes]

Description

Fixes

• Vector-register claim was x86 only. aarch64 FEAT_SHA3, arm32 NEON, and both SHAKE squeeze paths (used by ML-KEM and SLH-DSA) ran unclaimed.
• Sha3Final absorbed the pad before claiming, so a refused claim corrupted the context: the retry returned success with a wrong digest.
• Keccak on x86 picks BMI2 before AVX2. BMI2 needs no vector save in-kernel and is faster here.
• KMAC and cSHAKE (SP 800-185) refused in a validated v7 build. Dev and FIPS-ready still build them.
• Legacy Keccak-256 pad excluded under v7, with the matching vector in test.c guarded the same way.
• Two build breaks: WC_SHA3_NO_ASM never disabled the PowerPC asm, and the v7 source list omitted the riscv64 and ppc64 AES asm, so --enable-fips=v7 --enable-riscv-asm never linked.

Testing

Tested 11 of 11 bench configurations pass. Each payload cell fails on the base without the fix:

| cell                                    | what the base does without the fix             |
|-----------------------------------------|------------------------------------------------|
| floor: fips-ready, fips-v7, c89, macros | passes on both                                 |
| generator drift, 11 port files          | passes on both                                 |
| `WC_SHA3_NO_ASM` + `--enable-ppc64-asm` | `sha3.c:825` implicit decl of `BlockSha3_base` |
| v7 refuses KMAC and cSHAKE              | links KMAC into a validated v7 module          |
| v7 ignores the Keccak-256 flag          | base honours it, non-FIPS control too          |
| refused claim stays retryable           | retry returns 0 with e7dde140, want e4bd866e   |
| Thumb-2 under qemu-arm                  | 43 algorithms, no vector insns in the block    |
| RISC-V hardware, FIPS v7                | 62 algorithms on a BeagleV, base fails to link |

BMI2 vs AVX2 measured on a Core Ultra 9 285K, same tree with only the lane changed: SHA3-256 at 873 vs 701 MiB/s, C block 807.

Self-contained, no dependency on other in-flight branches.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11441

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11441

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11441

Scan targets checked: none
Failed targets: wolfcrypt-src, wolfcrypt-bugs

⚠️ Review incomplete — one or more scan targets failed before findings could be produced. See the Fenrir PR review detail page for logs.

[kaleb-himes]

@wolfSSL-Fenrir-bot review force

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11441

Scan targets checked: none
Failed targets: wolfcrypt-src, wolfcrypt-bugs

⚠️ Review incomplete — one or more scan targets failed before findings could be produced. See the Fenrir PR review detail page for logs.

Dismiss to re-request

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11441

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[wolfSSL-Fenrir-bot]

Claim-failure tests omit Update and SHAKE squeeze paths · Missing edge-case coverage on a function the PR also changed

sha3_256_claim_retry_test() only drives Final; the new claim-failure exits in Sha3Update and both SHAKE squeeze functions remain untested. Unlike known #1978, this is refusal/retry coverage, not alignment.

Related earlier finding on this pull request (similar but distinct): Both concern missing forced claim-refusal/retry coverage in SHA-3 tests, but the historical issue targets finalization in sha3_256_kat_test while this candidate targets Sha3Update and SHAKE squeeze operations in sha3_256_claim_retry_test. The faulting operations and required test additions differ, so one patch would not fix both.

Suggested fix: Extend the helper to force and verify refusal plus retry for SHA-3 Update and both SHAKE SqueezeBlocks paths.