Add DES CBC decryption for wrapped key imports

[keithfong94]

Context

Add Cipher.DecryptCBC for DES/3DES with an explicit IV, input validation, and no padding removal. This supports G+D PRK imports without changing existing ECB operations or KCV calculations. Prepare version 1.15.0.

Checked double- and triple-length 3DES against independent Python cryptography/OpenSSL vectors with zero and nonzero IVs. Full tests and go vet pass. Fixtures contain synthetic keys only.

Checklist

• Change meets or does not compromise the Baseline Security Requirements

[keithfong94]

/request-review

[platon-github-app-production]

Success 🎉 The review request was sent to the following:

• plastic-issuance-service-owners: request was sent to #spend-adoption-dev

If you see something that doesn't look right, follow this doc to improve our slack channel mapping. Thank you!

[Copilot]

🟡 Changes recommended

Add single-DES CBC coverage and the standard Apache 2.0 headers.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds explicit-IV, unpadded CBC decryption for DES and 3DES, with documentation and version updates.

Changes:

• Implements DecryptCBC with input validation.
• Adds CBC vectors and invalid-input tests.
• Updates README and version to 1.15.0.

File summaries

File	Summary
VERSION.txt	Bumps version to 1.15.0.
README.md	Documents DES CBC support.
des/des_cbc_cipher.go	Adds CBC decryption implementation.
des/des_cbc_cipher_test.go	Adds CBC vectors and validation tests.

Review details

Suppressed comments (1)

des/des_cbc_cipher.go:10

• The new API is documented as supporting both DES and 3DES, but the tests only construct a 3DES cipher. A regression affecting CreateFromDESKeyBytes/CreateFromDESKeyString would therefore leave the newly supported single-DES CBC path unverified; add at least one independent single-DES CBC vector (the invalid-input cases can be shared).

func (c *Cipher) DecryptCBC(cipherBytes, iv []byte) ([]byte, error) {

• Files reviewed: 4/4 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wise-github-bot-app]

The approval(s) from conanak99 do(es)n't fullfill the approvers requirements because:

• We couldn't find the GitHub username of conanak99 in WorkDay (after adding your name, it can take up to 1h to sync the information). Read More