Adding zeroize for BlockRng and BlockRng64

[nstilt1]

Regarding #1348 and #934
This appears to work with my working branch of chacha20 without any breaking changes for libraries that use a [Item; N]. Also, I just discovered that using -C target-cpu=native can optimize the code in such a way that the difference between the performance of using pointers and a buffer is about 0.5%... so I think I'm going to close out #1367

[nstilt1]

What about... adding ZeroizeOnDrop as a trait bound for the core of BlockRng and BlockRng64? Something like

pub struct BlockRng<R: BlockRngCore + ?Sized> {
    results: R::Results,
    index: usize,
    /// The *core* part of the RNG, implementing the `generate` function.
    #[cfg(not(feature = "zeroize"))]
    pub core: R,
    /// The *core* part of the RNG, implementing the `generate` function.
    #[cfg(feature = "zeroize")]
    pub core: R + ZeroizeOnDrop
}

Just to ensure that the core implements it.

[dhardy]

By itself this code doesn't do anything at all, but having a feature-flag-dependant bound does complicate the API. We should consider simply making zeroize a hard dependency.

@newpavlov thoughts please since you are also a maintainer of zeroize?

[dhardy]

This has potential to cause unexpected broken builds.

[newpavlov]

In my opinion, this is a wrong use of zeroize. I don't think rand_core needs any particular zeroize support. It's not worth to zeroize the index field and zeroization of core and results fields should be handled by RNG implementation crates.

[dhardy]

We don't care about the index, no, but what about BlockRng::results (currently has type R::Results)?

[newpavlov]

Right now it's an associated type selected by an implementation crate, so it could use zeroize::Zeroizing([u32; 16]) for it, if zeroize feature for this crate is enabled.

[dhardy]

In the wrapper? This requires making BlockRng::results pub, which should be acceptable.

[newpavlov]

No, it's not needed. The Zeroizing wrapper has a zeroizing Drop impl, so zeroization of the result field will be done automatically.

[dhardy]

👍