Documents a precondition in the signle-DES API

[miyazakh]

Summary

• Documents a precondition gap in the single-DES API: Des has no keySet state (unlike Des3), so wc_Des_CbcEncrypt, wc_Des_CbcDecrypt, and wc_Des_EcbEncrypt do not verify that wc_Des_SetKey() was called first, and will silently operate on undefined key material if it wasn't.
• Adds \note blocks to wc_Des_SetKey, wc_Des_CbcEncrypt, wc_Des_CbcDecrypt, and wc_Des_EcbEncrypt in doc/dox_comments/header_files/des3.h stating this precondition.
• Fixes a \sa wc_Des_SetKe typo (missing y) on wc_Des_EcbEncrypt.

Why doc-only

A code fix would need a keySet-style guard added consistently across every wc_Des_CbcEncrypt/Decrypt and wc_Des3_CbcEncrypt/Decrypt implementation in des3.c (~6 backend variants: generic software, STM32 CubeMX, Freescale MMCAU, ColdFire SEC, etc.), several of which also lack the check for Des3 today. It would also touch the file's FIPS-boundary code segment (des3.c is placed in .fipsA$d/.fipsB$d for HAVE_FIPS_VERSION 2/3). Given this is a low-severity, API-misuse-only issue (caller must skip wc_Des_SetKey() entirely to hit it) and is consistent with existing accepted-risk precedent for the same class of issue in Camellia and RC2, this PR only documents the precondition rather than reworking every backend.

Scope

Single file: doc/dox_comments/header_files/des3.h. No functional/code changes.

Testing

Documentation-only change; no build or test impact.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

Documents an important precondition for the single-DES APIs in wolfCrypt: callers must invoke wc_Des_SetKey() before using DES CBC/ECB operations, because Des lacks the keySet guard present in Des3 and the DES operations won’t verify initialization.

Changes:

• Add Doxygen \note blocks describing the “must call wc_Des_SetKey() first” precondition for DES CBC encrypt/decrypt and DES ECB encrypt.
• Add a Doxygen \note to wc_Des_SetKey() explaining the lack of keySet state for Des (vs Des3) and the resulting undefined-key-material risk on misuse.
• Fix a Doxygen \sa typo (wc_Des_SetKe → wc_Des_SetKey).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Bot]

Can one of the admins verify this patch?

[miyazakh]

retest this please

[miyazakh]

retest this please

[miyazakh]

retest this please