Currently, pincache_put and pincache_get uses AESWRAP (RFC 3394) with our own padding method.

BTW, there is a comment in the code:

/* FIXME: Replace this by OCB mode and use the cache key as
 * additional data.  */

But OCB is not an option, if we care about FIPS. So, I'd suggest removing this comment.

The code is a bit difficult, the NUL terminated requirement by pincache_get API (only returns a string which is assumed NUL terminated) is actually kept by pincache_put's adding padded zero and its pinbuflen calculation; By this handling, the decrypted pin has always one zero at the end at least, and more zeros if the pin length % 8 != 7. (when pin length % 8 == 0, it has 8 zeros.)

Let us clean up things here.

• Use RFC-5649 AESWRAP with padding (it is implemented by libgcrypt already in 2022)
• Fix pincache_get API so that it also returns pin length in r_pinlen