Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix!: zeroize temporary scalar value #204

Closed
wants to merge 7 commits into from
Closed

fix!: zeroize temporary scalar value #204

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
f24bda1
fix: zeroize temporary scalar value
stringhandler Aug 27, 2023
59a1957
more zeroizing
stringhandler Aug 27, 2023
a0bd689
use zeroizing
stringhandler Sep 28, 2023
f9c6252
clean up deser bytes
stringhandler Sep 28, 2023
1bbd1e2
Merge branch 'main' into st-zeroize-scalar
stringhandler Sep 28, 2023
65aa742
Update src/ristretto/pedersen/extended_commitment_factory.rs
stringhandler Oct 2, 2023
b0d0a8b
Update src/ristretto/pedersen/extended_commitment_factory.rs
stringhandler Oct 2, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
14 changes: 12 additions & 2 deletions src/ristretto/ristretto_keys.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,9 +65,19 @@ impl borsh::BorshSerialize for RistrettoSecretKey {
impl borsh::BorshDeserialize for RistrettoSecretKey {
fn deserialize_reader<R>(reader: &mut R) -> Result<Self, borsh::maybestd::io::Error>
where R: borsh::maybestd::io::Read {
let bytes: Vec<u8> = borsh::BorshDeserialize::deserialize_reader(reader)?;
Self::from_bytes(bytes.as_slice())
let mut bytes: Vec<u8> = borsh::BorshDeserialize::deserialize_reader(reader)?;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can use a Zeroizing wrapper here and remove the entire match.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tried, but it doesn't deserialize, I could have added a wrapper after the deserialize, but it's basically the same thing

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Which tests fail? I tried it on this branch and everything seems to work fine.

match Self::from_bytes(bytes.as_slice())
.map_err(|e| borsh::maybestd::io::Error::new(borsh::maybestd::io::ErrorKind::InvalidInput, e.to_string()))
{
Ok(k) => {
bytes.zeroize();
Ok(k)
},
Err(e) => {
bytes.zeroize();
Err(e)
},
}
}
}

Expand Down