ml-dsa: zeroize seed on SigningKey drop#1308
Closed
MavenRain wants to merge 1 commit into
Closed
Conversation
The `SigningKey` (formerly `KeyPair`) held the 32-byte `seed` directly, and `Array<u8, U32>` does not pick up `ZeroizeOnDrop` because `u8` does not impl `ZeroizeOnDrop`. The seed is private key material, so it needs an explicit `Drop` that zeroizes. Adding `Drop` to `SigningKey` broke two call sites that moved `signing_key` out of a `SigningKey` (Rust forbids field moves out of `Drop` types). Both are refactored: `ExpandedSigningKey::from_seed` now contains the FIPS-204 KeyGen_internal logic directly, and `P::from_seed` delegates to it. The pkcs8 `TryFrom<PrivateKeyInfoRef>` for `ExpandedSigningKey` decodes the seed inline and calls `ExpandedSigningKey::from_seed` rather than going through `SigningKey`. Adds a compile-time test asserting `ZeroizeOnDrop` on both `SigningKey<P>` and `ExpandedSigningKey<P>` for each parameter set.
Member
|
Thanks for pointing this out. I'm taking care of it in #1345. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
SigningKey(formerlyKeyPair) held the 32-byteseeddirectly,and
Array<u8, U32>does not pick upZeroizeOnDropbecauseu8does not impl
ZeroizeOnDrop. The seed is private key material, so itneeds an explicit
Dropthat zeroizes.Adding
DroptoSigningKeybroke two call sites that movedsigning_keyout of aSigningKey(Rust forbids field moves out ofDroptypes). Both are refactored:ExpandedSigningKey::from_seednow contains the FIPS-204 KeyGen_internal logic directly, and
P::from_seeddelegates to it. The pkcs8TryFrom<PrivateKeyInfoRef>for
ExpandedSigningKeydecodes the seed inline and callsExpandedSigningKey::from_seedrather than going throughSigningKey.Adds a compile-time test asserting
ZeroizeOnDropon bothSigningKey<P>andExpandedSigningKey<P>for each parameter set.