Clear ML-DSA key generation outputs on failure

Zeroize the pk and sk output buffers on the keypair_internal error
paths, so a caller that ignores the return value cannot mistake a
partially written or PCT-failed key pair for a valid one. Clear with
mld_zeroize so scrubbing of secret key material is not optimized out.

Fold the keypair_internal error paths into a single cleanup.

Per API-CONVENTIONS.md, an output buffer must be left either unchanged
or fully zeroized on error. keypair_internal may have partially written
its outputs before failing, so it zeroizes them; the randomized
mld_sign_keypair wrapper needs no zeroization of its own, as it leaves
the outputs untouched when randomness or allocation fails before
keypair_internal runs.

Co-authored-by: Joe Doyle <joseph.doyle@trailofbits.com>
Co-authored-by: Codex <codex@openai.com>
Signed-off-by: Matthias J. Kannwischer <matthias@zerorisc.com>

Author: 3 people

mldsa/src/sign.c

@@ -391,14 +391,21 @@ int mld_sign_keypair_internal(uint8_t pk[MLDSA_CRYPTO_PUBLICKEYBYTES],
   MLD_FREE(inbuf, uint8_t, MLDSA_SEEDBYTES + 2, context);
   MLD_FREE(seedbuf, uint8_t, 2 * MLDSA_SEEDBYTES + MLDSA_CRHBYTES, context);
 
+  /* Pairwise Consistency Test (PCT) @[FIPS140_3_IG, p.87] */
+  /* Do this after freeing all temporaries. */
+  if (ret == 0)
+  {
+    ret = mld_check_pct(pk, sk, context);
+  }
+
   if (ret != 0)
   {
-    return ret;
+    /* Clear caller outputs on failure. */
+    mld_zeroize(pk, MLDSA_CRYPTO_PUBLICKEYBYTES);
+    mld_zeroize(sk, MLDSA_CRYPTO_SECRETKEYBYTES);
   }
 
-  /* Pairwise Consistency Test (PCT) @[FIPS140_3_IG, p.87] */
-  /* Do this after freeing all temporaries. */
-  return mld_check_pct(pk, sk, context);
+  return ret;
 }
 
 #if !defined(MLD_CONFIG_CORE_API_ONLY)