mbedtls_cipher functions return 0 in invalid scenarios

[gilles-peskine-arm]

If you call mbedtls_cipher_update_ad or mbedtls_cipher_write_tag or mbedtls_cipher_check_tag on a non-AEAD algorithm, they return 0. This looks wrong: surely it's an application error, and it's easily detectable, so we should return MBEDTLS_ERR_CIPHER_INVALID_CONTEXT or MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA?

Our unit tests indiscriminately call these functions on non-AEAD algorithms though. Is this just a test bug or is this deliberate? The documentation doesn't say anything explicit.

Similar pattern with mbedtls_cipher_set_iv on ECB.

Since the unit tests validate the current behavior, if we change it, we should probably not change LTS branches.

Note: moot if we remove cipher.h as a public API.

[gilles-peskine-arm]

For mbedtls_cipher_set_iv, this is documented behavior:

Some ciphers do not use IVs nor nonce. For these ciphers, this function has no effect.

Also:

[iv_len] is discarded by ciphers with fixed-size IV.

This is unfortunate, but we can't change such documented behavior in a minor release. So it has to wait until 4.0, but by that time the mbedtls_cipher interface will be deprecated in favor of PSA anyway.

[gilles-peskine-arm]

Moot since we're removing cipher.h as a public API (#8451).