fix: cleanup plaintext on gcmsiv/aessiv tag mismatch

src/aes.ts

@@ -1138,7 +1138,7 @@ export const gcmsiv: TRet<
         // RFC 8452 §5: plaintext is unauthenticated here and MUST NOT be
         // returned until the expected-tag check completes successfully.
         if (!equalBytes(tag, expectedTag)) {
-          clean(...toClean);
+          clean(plaintext, ...toClean);
           throw new Error('invalid polyval tag');
         }
         // Cleanup
@@ -1971,6 +1971,7 @@ export const aessiv: TRet<
         if (equalBytes(t, v)) {
           return p as TRet<Uint8Array>;
         } else {
+          clean(p);
           throw new Error('invalid siv tag');
         }
       },

test/aes.test.ts

@@ -173,6 +173,17 @@ export function test(
         throws(() => gcmsiv(new Uint8Array(32), new Uint8Array(11), new Uint8Array(12))); // nonce
         throws(() => gcmsiv(new Uint8Array(33), new Uint8Array(12), new Uint8Array(12))); // key
       });
+      should('cleanup plaintext on tag mismatch', () => {
+        const key = new Uint8Array(32);
+        key[0] = 1;
+        const nonce = new Uint8Array(12);
+        const cipher = gcmsiv(key, nonce);
+        const plaintext = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]);
+        const ct = cipher.encrypt(plaintext);
+        // Corrupt the tag (last 16 bytes)
+        ct[ct.length - 1] ^= 1;
+        throws(() => gcmsiv(key, nonce).decrypt(ct), /invalid polyval tag/);
+      });
     });
 
     describe('Wycheproof', () => {

test/siv.test.ts

@@ -130,6 +130,15 @@ export function test(
         const aadArray = ['not bytes'];
         throws(() => siv(key, ...aadArray));
       });
+      should('cleanup plaintext on tag mismatch', () => {
+        const key = hexToBytes('fffefdfcfbfaf9f8f7f6f5f4f3f2f1f0f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff');
+        const ad = hexToBytes('101112131415161718191a1b1c1d1e1f2021222324252627');
+        const plaintext = hexToBytes('112233445566778899aabbccddee');
+        const ct = siv(key, ad).encrypt(plaintext);
+        // Corrupt the SIV tag (first 16 bytes)
+        ct[0] ^= 1;
+        throws(() => siv(key, ad).decrypt(ct), /invalid siv tag/);
+      });
     });
 
     describe('Wycheproof', () => {