Zeroize PEM and PKCS8 JNI copies, add wipeable char[] PEM password

[cconlon]

This PR fixes 4 Fenrir issues:

• F-12194: Zeroize the copied private key PEM before JNI release
• F-12195: Zeroize the copied PKCS#8 array in the ASN algorithm ID parser
• F-12196: Add encryptedKeyPemToDer(byte[], char[]) with a wipeable password, NUL and size checks
• F-3766: Drop the retired JCenter repository from the Android IDE config

[Copilot]

🟡 Changes recommended

Java-side password UTF-8 encoding currently allocates before enforcing the native password size constraint, allowing potentially large allocations/OOME despite JNI rejecting oversize passwords.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR hardens the wolfCrypt JNI/JCE wrapper by reducing the lifetime of sensitive key material (PEM/PKCS#8/password) in both Java and JNI, adds a char[]-based encrypted PEM conversion API to allow callers to wipe passwords, and removes the retired JCenter repository from the Android IDE config.

Changes:

• Added WolfCrypt.encryptedKeyPemToDer(byte[], char[]), implemented via UTF-8 password bytes that are zeroed after the native call.
• Updated JNI paths to zeroize JNI copies of PEM and PKCS#8 DER buffers before releasing them, and to validate/zeroize copied password bytes.
• Added JUnit coverage for char[] password behavior (parity with String, NUL rejection, empty/null handling) and removed JCenter from Android IDE metadata.

File summaries

File	Description
src/test/java/com/wolfssl/wolfcrypt/test/WolfCryptTest.java	Adds tests for encryptedKeyPemToDer(byte[], char[]) including parity and input-validation cases.
src/main/java/com/wolfssl/wolfcrypt/WolfCrypt.java	Introduces char[] password API and shared byte[] path with post-call zeroization.
jni/jni_wolfcrypt.c	Switches native wcKeyPemToDer password input to byte[] + adds copy zeroization and NUL/size checks.
jni/jni_asn.c	Zeroizes JNI-copied PKCS#8 DER input before JNI release.
jni/include/com_wolfssl_wolfcrypt_WolfCrypt.h	Updates the generated JNI signature for wcKeyPemToDer.
IDE/Android/.idea/jarRepositories.xml	Removes the retired JCenter repository entry.

Review details

Files not reviewed (2)

• IDE/Android/.idea/jarRepositories.xml: Generated file
• jni/include/com_wolfssl_wolfcrypt_WolfCrypt.h: Generated file

• Files reviewed: 4/6 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #277

Scan targets checked: wolfcrypt-jni-src, wolfcrypt-jni-bugs

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Copilot reviewed 4 out of 6 changed files in this pull request and generated 3 comments.

Files not reviewed (2)

• IDE/Android/.idea/jarRepositories.xml: Generated file
• jni/include/com_wolfssl_wolfcrypt_WolfCrypt.h: Generated file