diff --git a/tests/api/test_digest.h b/tests/api/test_digest.h index 78ce499dd8..db45865242 100644 --- a/tests/api/test_digest.h +++ b/tests/api/test_digest.h @@ -574,7 +574,7 @@ do { \ ExpectIntEQ(wc_##name##_Final(&dst, hashDst, WC_##upper##_COUNT * 8), 0); \ ExpectBufEQ(hashSrc, emptyHash, WC_##upper##_COUNT * 8); \ ExpectBufEQ(hashDst, emptyHash, WC_##upper##_COUNT * 8); \ - wc_##name##_Free(&src); \ + wc_##name##_Free(&dst); \ \ /* Test buffered data is copied. */ \ ExpectIntEQ(wc_##name##_Update(&src, (byte*)"abc", 3), 0); \ @@ -583,7 +583,7 @@ do { \ ExpectIntEQ(wc_##name##_Final(&dst, hashDst, WC_##upper##_COUNT * 8), 0); \ ExpectBufEQ(hashSrc, abcHash, WC_##upper##_COUNT * 8); \ ExpectBufEQ(hashDst, abcHash, WC_##upper##_COUNT * 8); \ - wc_##name##_Free(&src); \ + wc_##name##_Free(&dst); \ \ /* Test count of length is copied. */ \ ExpectIntEQ(wc_##name##_Update(&src, data, sizeof(data)), 0); \ diff --git a/wolfcrypt/src/aes.c b/wolfcrypt/src/aes.c index 562e69c597..72f5bcb238 100644 --- a/wolfcrypt/src/aes.c +++ b/wolfcrypt/src/aes.c @@ -1066,6 +1066,7 @@ static WC_INLINE void wc_Stm32_CrypAesBlock(const byte* in, byte* out) if (AES_set_encrypt_key_AESNI(userKey,bits,temp_key) == WC_NO_ERR_TRACE(BAD_FUNC_ARG)) { + ForceZero(temp_key, sizeof(Aes)); WC_FREE_VAR_EX(temp_key, aes->heap, DYNAMIC_TYPE_AES); return BAD_FUNC_ARG; } @@ -1099,6 +1100,9 @@ static WC_INLINE void wc_Stm32_CrypAesBlock(const byte* in, byte* out) Key_Schedule[0] = Temp_Key_Schedule[nr]; + /* temp_key holds the expanded key schedule + * (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(temp_key, sizeof(Aes)); WC_FREE_VAR_EX(temp_key, aes->heap, DYNAMIC_TYPE_AES); return 0; @@ -9088,6 +9092,7 @@ void GHASH(Gcm* gcm, const byte* a, word32 aSz, const byte* c, /* Copy the result into s. */ XMEMCPY(s, x, sSz); + ForceZero(x, sizeof(x)); } #ifdef WOLFSSL_AESGCM_STREAM @@ -9188,6 +9193,7 @@ void GHASH(Gcm* gcm, const byte* a, word32 aSz, const byte* c, /* Copy the result into s. */ XMEMCPY(s, x, sSz); + ForceZero(x, sizeof(x)); } #ifdef WOLFSSL_AESGCM_STREAM @@ -9571,6 +9577,7 @@ void GHASH(Gcm* gcm, const byte* a, word32 aSz, const byte* c, /* Copy the result into s. */ XMEMCPY(s, x, sSz); + ForceZero(x, sizeof(x)); } #ifdef WOLFSSL_AESGCM_STREAM @@ -10073,6 +10080,7 @@ void GHASH(Gcm* gcm, const byte* a, word32 aSz, const byte* c, /* Copy the result into s. */ XMEMCPY(s, x, sSz); + ForceZero(x, sizeof(x)); } #ifdef WOLFSSL_AESGCM_STREAM @@ -10249,6 +10257,7 @@ void GHASH(Gcm* gcm, const byte* a, word32 aSz, const byte* c, ByteReverseWords64(x, x, WC_AES_BLOCK_SIZE); #endif XMEMCPY(s, x, sSz); + ForceZero(x, sizeof(x)); } #endif /* !FREESCALE_LTC_AES_GCM */ @@ -10556,6 +10565,7 @@ void GHASH(Gcm* gcm, const byte* a, word32 aSz, const byte* c, ByteReverseWords(x, x, WC_AES_BLOCK_SIZE); #endif XMEMCPY(s, x, sSz); + ForceZero(x, sizeof(x)); } #ifdef WOLFSSL_AESGCM_STREAM @@ -12713,20 +12723,23 @@ static WARN_UNUSED_RESULT int AesGcmCryptUpdate_C( else #endif /* HAVE_AES_ECB */ { + ALIGN32 byte scratch[WC_AES_BLOCK_SIZE]; /* Encrypt block by block. */ while (blocks--) { - ALIGN32 byte scratch[WC_AES_BLOCK_SIZE]; IncrementGcmCounter(AES_COUNTER(aes)); /* Encrypt counter into a buffer. */ ret = wc_AesEncrypt(aes, AES_COUNTER(aes), scratch); - if (ret != 0) + if (ret != 0) { + ForceZero(scratch, sizeof(scratch)); return ret; + } /* XOR plain text into encrypted counter into cipher text buffer. */ xorbufout(out, scratch, in, WC_AES_BLOCK_SIZE); /* Data complete. */ in += WC_AES_BLOCK_SIZE; out += WC_AES_BLOCK_SIZE; } + ForceZero(scratch, sizeof(scratch)); } if (partial != 0) { @@ -15453,7 +15466,7 @@ int wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz, wolfSSL_CryptHwMutexUnLock(); if (status != kStatus_Success) { - XMEMSET(out, 0, inSz); + ForceZero(out, inSz); return AES_CCM_AUTH_E; } return 0; @@ -15946,7 +15959,7 @@ int wc_AesCcmDecrypt(Aes* aes, byte* out, const byte* in, word32 inSz, WOLFSSL_MSG("Preserve output for vector responses"); #else if (inSz > 0) - XMEMSET(out, 0, inSz); + ForceZero(out, inSz); #endif ret = AES_CCM_AUTH_E; } @@ -16256,8 +16269,19 @@ void wc_AesFree(Aes* aes) aes->keyInstalled = 0; /* If callback wants standard free, it can set devId to INVALID_DEVID. * Otherwise assume the callback handled cleanup. */ - if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) + if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) { + /* Release heap state first; the wipe drops its pointers. */ + #if defined(WOLFSSL_AESGCM_STREAM) && defined(WOLFSSL_SMALL_STACK) && \ + !defined(WOLFSSL_AESNI) + if (aes->streamData != NULL) { + ForceZero(aes->streamData, aes->streamData_sz); + XFREE(aes->streamData, aes->heap, DYNAMIC_TYPE_AES); + aes->streamData = NULL; + } + #endif + ForceZero(aes, sizeof(Aes)); return; + } /* fall-through when unavailable */ } #endif /* WOLF_CRYPTO_CB && WOLF_CRYPTO_CB_FREE */ @@ -17598,13 +17622,14 @@ static int AesKeyWrapRaw(Aes* aes, word32 inSz, byte* out, const byte* aiv) VECTOR_REGISTERS_POP; #endif - if (ret != 0) - return ret; - - /* C[0] = A */ - XMEMCPY(out, tmp, KEYWRAP_BLOCK_SIZE); + if (ret == 0) { + /* C[0] = A */ + XMEMCPY(out, tmp, KEYWRAP_BLOCK_SIZE); + } + /* tmp holds A || P[i] on an encrypt failure (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(tmp, sizeof(tmp)); - return 0; + return ret; } int wc_AesKeyWrap_ex(Aes *aes, const byte* in, word32 inSz, byte* out, @@ -17766,13 +17791,20 @@ static int AesKeyUnWrapRaw(Aes* aes, const byte* in, word32 inSz, byte* out, VECTOR_REGISTERS_POP; #endif - if (ret != 0) - return ret; - - /* return recovered A */ - XMEMCPY(aOut, tmp, KEYWRAP_BLOCK_SIZE); + if (ret == 0) { + /* return recovered A */ + XMEMCPY(aOut, tmp, KEYWRAP_BLOCK_SIZE); + } + else { + /* Partially recovered plaintext (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(out, inSz - KEYWRAP_BLOCK_SIZE); + } + /* tmp ends holding the first 8 bytes of the recovered key + * (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(tmp, sizeof(tmp)); + ForceZero(t, sizeof(t)); - return 0; + return ret; } int wc_AesKeyUnWrap_ex(Aes *aes, const byte* in, word32 inSz, byte* out, @@ -18630,10 +18662,11 @@ static int AesXtsEncrypt_sw(XtsAes* xaes, byte* out, const byte* in, word32 sz, byte tweak_block[WC_AES_BLOCK_SIZE]; ret = wc_AesEncryptDirect(&xaes->tweak, tweak_block, i); - if (ret != 0) - return ret; - - return AesXtsEncryptUpdate_sw(xaes, out, in, sz, tweak_block); + if (ret == 0) { + ret = AesXtsEncryptUpdate_sw(xaes, out, in, sz, tweak_block); + } + ForceZero(tweak_block, sizeof(tweak_block)); + return ret; } #endif /* !WOLFSSL_RISCV_ASM */ #endif @@ -19177,10 +19210,11 @@ static int AesXtsDecrypt_sw(XtsAes* xaes, byte* out, const byte* in, word32 sz, byte tweak_block[WC_AES_BLOCK_SIZE]; ret = wc_AesEncryptDirect(&xaes->tweak, tweak_block, i); - if (ret != 0) - return ret; - - return AesXtsDecryptUpdate_sw(xaes, out, in, sz, tweak_block); + if (ret == 0) { + ret = AesXtsDecryptUpdate_sw(xaes, out, in, sz, tweak_block); + } + ForceZero(tweak_block, sizeof(tweak_block)); + return ret; } #endif /* !WOLFSSL_RISCV_ASM */ #endif diff --git a/wolfcrypt/src/cmac.c b/wolfcrypt/src/cmac.c index 28a8b50e82..aeafea1404 100644 --- a/wolfcrypt/src/cmac.c +++ b/wolfcrypt/src/cmac.c @@ -591,6 +591,7 @@ int wc_AesCmacGenerate(byte* out, word32* outSz, #ifdef WOLFSSL_SMALL_STACK + ForceZero(cmac, sizeof(Cmac)); XFREE(cmac, NULL, DYNAMIC_TYPE_CMAC); #elif defined(WOLFSSL_CHECK_MEM_ZERO) wc_MemZero_Check(cmac, sizeof(Cmac)); @@ -676,6 +677,7 @@ int wc_AesCmacVerify(const byte* check, word32 checkSz, INVALID_DEVID); #ifdef WOLFSSL_SMALL_STACK + ForceZero(cmac, sizeof(Cmac)); XFREE(cmac, NULL, DYNAMIC_TYPE_CMAC); #elif defined(WOLFSSL_CHECK_MEM_ZERO) wc_MemZero_Check(cmac, sizeof(Cmac)); diff --git a/wolfcrypt/src/curve25519.c b/wolfcrypt/src/curve25519.c index 9cf5cb08d7..bfbc831342 100644 --- a/wolfcrypt/src/curve25519.c +++ b/wolfcrypt/src/curve25519.c @@ -704,6 +704,12 @@ static int wc_curve25519_make_key_nb(WC_RNG* rng, int keysize, if (ret == 0) { key->pubSet = 1; } + else if (ret != FP_WOULDBLOCK) { + /* Public half failed: drop the scalar too + * (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(key->k, sizeof(key->k)); + key->privSet = 0; + } } return ret; @@ -717,7 +723,7 @@ int wc_curve25519_set_nonblock(curve25519_key* key, x25519_nb_ctx_t* ctx) /* If a different context is already set, clear it before replacing. * The caller is responsible for freeing any heap-allocated context. */ if (key->nb_ctx != NULL && key->nb_ctx != ctx) { - XMEMSET(key->nb_ctx, 0, sizeof(x25519_nb_ctx_t)); + ForceZero(key->nb_ctx, sizeof(x25519_nb_ctx_t)); } if (ctx != NULL) { XMEMSET(ctx, 0, sizeof(x25519_nb_ctx_t)); @@ -792,6 +798,12 @@ int wc_curve25519_make_key(WC_RNG* rng, int keysize, curve25519_key* key) } #endif key->pubSet = (ret == 0); + if (ret != 0) { + /* Public half failed: drop the scalar too + * (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(key->k, sizeof(key->k)); + key->privSet = 0; + } } } #endif /* !WOLFSSL_SE050 */ @@ -867,7 +879,7 @@ static int wc_curve25519_shared_secret_nb(curve25519_key* privKey, } if (ret != FP_WOULDBLOCK) { - XMEMSET(privKey->nb_ctx, 0, sizeof(x25519_nb_ctx_t)); + ForceZero(privKey->nb_ctx, sizeof(x25519_nb_ctx_t)); } return ret; @@ -1420,7 +1432,6 @@ void wc_curve25519_free(curve25519_key* key) #ifdef WOLFSSL_SE050 se050_curve25519_free_key(key); #endif - ForceZero(key, sizeof(*key)); #ifdef WOLFSSL_CHECK_MEM_ZERO diff --git a/wolfcrypt/src/curve448.c b/wolfcrypt/src/curve448.c index c318935ef9..b3f0f199f9 100644 --- a/wolfcrypt/src/curve448.c +++ b/wolfcrypt/src/curve448.c @@ -291,6 +291,9 @@ int wc_curve448_make_key(WC_RNG* rng, int keysize, curve448_key* key) else { ForceZero(key->k, sizeof(key->k)); XMEMSET(key->p, 0, sizeof(key->p)); + /* A zeroised SSP shall not be reusable + * (ISO/IEC 19790:2012 7.9.7 [09.29]). */ + key->privSet = 0; } } #endif /* WOLF_CRYPTO_CB_ONLY_CURVE448 */ diff --git a/wolfcrypt/src/dh.c b/wolfcrypt/src/dh.c index 7aa0258815..dce11a6c6a 100644 --- a/wolfcrypt/src/dh.c +++ b/wolfcrypt/src/dh.c @@ -1021,7 +1021,10 @@ int wc_DhSetNonBlock(DhKey* key, DhNb* nb) return BAD_FUNC_ARG; if (nb != NULL) { - XMEMSET(nb, 0, sizeof(DhNb)); + ForceZero(nb, sizeof(DhNb)); + } + if ((key->nb != NULL) && (key->nb != nb)) { + ForceZero(key->nb, sizeof(DhNb)); } /* Pass NULL to disable non-blocking mode. */ @@ -1495,6 +1498,7 @@ static int wc_DhGenerateKeyPair_Sync(DhKey* key, WC_RNG* rng, byte* priv, word32* privSz, byte* pub, word32* pubSz) { int ret; + int privWritten; if (key == NULL || rng == NULL || priv == NULL || privSz == NULL || pub == NULL || pubSz == NULL) { @@ -1502,6 +1506,8 @@ static int wc_DhGenerateKeyPair_Sync(DhKey* key, WC_RNG* rng, } ret = GeneratePrivateDh(key, rng, priv, privSz); + /* From here *privSz is the length actually written. */ + privWritten = (ret == 0); if (ret == 0) ret = GeneratePublicDh(key, priv, *privSz, pub, pubSz); @@ -1511,6 +1517,11 @@ static int wc_DhGenerateKeyPair_Sync(DhKey* key, WC_RNG* rng, if (ret == 0) ret = _ffc_pairwise_consistency_test(key, pub, *pubSz, priv, *privSz); #endif /* FIPS V5 or later || WOLFSSL_VALIDATE_DH_KEYGEN */ + if (privWritten && (ret != 0)) { + /* A failed pair is not handed back (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(priv, *privSz); + *privSz = 0; + } return ret; } @@ -2563,6 +2574,8 @@ int wc_DhImportKeyPair(DhKey* key, const byte* priv, word32 privSz, if (priv[0] == 0) { privSz--; priv++; } + /* Never overwrite one SSP with another (ISO/IEC 19790:2012 [09.31]). */ + mp_forcezero(&key->priv); if (mp_init(&key->priv) != MP_OKAY) havePriv = 0; } diff --git a/wolfcrypt/src/ecc.c b/wolfcrypt/src/ecc.c index c575fd96f9..2a118c4c45 100644 --- a/wolfcrypt/src/ecc.c +++ b/wolfcrypt/src/ecc.c @@ -3444,6 +3444,8 @@ static int ecc_mulmod(const mp_int* k, ecc_point* P, ecc_point* Q, err = mp_cond_swap_ct_ex(R[0]->z, R[1]->z, (int)modulus->used, (int)b, tmp); } + /* tmp holds a scalar bit (ISO/IEC 19790:2012 7.9.7). */ + mp_forcezero(tmp); #endif } @@ -6112,7 +6114,7 @@ static int _ecc_make_key_ex(WC_RNG* rng, int keysize, ecc_key* key, err = mp_set(key->pubkey.z, 1); if (err) { key->privKey = NULL; - XMEMSET(key->keyRaw, 0, sizeof(key->keyRaw)); + ForceZero(key->keyRaw, sizeof(key->keyRaw)); return err; } @@ -7199,6 +7201,7 @@ static int deterministic_sign_helper(const byte* in, word32 inlen, ecc_key* key) if (wc_ecc_gen_deterministic_k(in, inlen, key->hashType, ecc_get_k(key), key->sign_k, curve->order, key->heap) != 0) { + mp_forcezero(key->sign_k); mp_free(key->sign_k); XFREE(key->sign_k, key->heap, DYNAMIC_TYPE_ECC); key->sign_k = NULL; @@ -7217,6 +7220,7 @@ static int deterministic_sign_helper(const byte* in, word32 inlen, ecc_key* key) key->sign_k_set = 0; if (wc_ecc_gen_deterministic_k(in, inlen, key->hashType, ecc_get_k(key), key->sign_k, curve->order, key->heap) != 0) { + mp_forcezero(key->sign_k); err = ECC_PRIV_KEY_E; } else { @@ -7466,12 +7470,10 @@ static int ecc_sign_hash_sw(ecc_key* key, ecc_key* pubkey, WC_RNG* rng, } #endif -#ifdef WOLFSSL_HAVE_SP_ECC #if defined(WOLFSSL_ECDSA_SET_K) || defined(WOLFSSL_ECDSA_SET_K_ONE_LOOP) || \ defined(WOLFSSL_ECDSA_DETERMINISTIC_K) || \ defined(WOLFSSL_ECDSA_DETERMINISTIC_K_VARIANT) -/* SP only resets the logical length of k, leaving its digits in the backing - * store. Clear it the way the software path does. */ +/* The nonce is consumed by every sign result; SP only resets its length. */ static void ecc_sign_k_forcezero(ecc_key* key) { #ifndef WOLFSSL_NO_MALLOC @@ -7482,14 +7484,13 @@ static void ecc_sign_k_forcezero(ecc_key* key) key->sign_k = NULL; } #else - if (key->sign_k_set) { - mp_forcezero(key->sign_k); - key->sign_k_set = 0; - } + mp_forcezero(key->sign_k); + key->sign_k_set = 0; #endif } #endif +#ifdef WOLFSSL_HAVE_SP_ECC static int ecc_sign_hash_sp(const byte* in, word32 inlen, WC_RNG* rng, ecc_key* key, mp_int *r, mp_int *s) { @@ -7896,6 +7897,12 @@ int wc_ecc_sign_hash_ex(const byte* in, word32 inlen, WC_RNG* rng, } } } +#if defined(WOLFSSL_ECDSA_SET_K) || defined(WOLFSSL_ECDSA_SET_K_ONE_LOOP) || \ + defined(WOLFSSL_ECDSA_DETERMINISTIC_K) || \ + defined(WOLFSSL_ECDSA_DETERMINISTIC_K_VARIANT) + /* The nonce is consumed whatever the result. */ + ecc_sign_k_forcezero(key); +#endif mp_clear(e); wc_ecc_curve_free(curve); @@ -8285,6 +8292,7 @@ int wc_ecc_sign_set_k(const byte* k, word32 klen, ecc_key* key) } if (ret == 0 && mp_cmp(key->sign_k, curve->order) != MP_LT) { ret = MP_VAL; + ecc_sign_k_forcezero(key); } #ifdef WOLFSSL_NO_MALLOC if (ret == 0) { @@ -12478,6 +12486,16 @@ static int _ecc_import_private_key_ex(const byte* priv, word32 privSz, #endif + if (ret != 0) { + /* Rejected scalar must not stay in the key + * (ISO/IEC 19790:2012 7.9.7). */ + mp_forcezero(key->k); + #ifdef WOLFSSL_ECC_BLIND_K + mp_forcezero(key->kb); + mp_forcezero(key->ku); + #endif + } + #ifdef WOLFSSL_MAXQ10XX_CRYPTO if ((ret == 0) && (key->devId != INVALID_DEVID)) { ret = wc_MAXQ10XX_EccSetKey(key, key->dp->size); @@ -17381,7 +17399,7 @@ int wc_ecc_set_nonblock(ecc_key *key, ecc_nb_ctx_t* ctx) /* If a different context is already set, clear it before replacing. * The caller is responsible for freeing any heap-allocated context. */ if (key->nb_ctx != NULL && key->nb_ctx != ctx) { - XMEMSET(key->nb_ctx, 0, sizeof(ecc_nb_ctx_t)); + ForceZero(key->nb_ctx, sizeof(ecc_nb_ctx_t)); } if (ctx != NULL) { XMEMSET(ctx, 0, sizeof(ecc_nb_ctx_t)); diff --git a/wolfcrypt/src/ed25519.c b/wolfcrypt/src/ed25519.c index 037210efaa..9d72826f05 100644 --- a/wolfcrypt/src/ed25519.c +++ b/wolfcrypt/src/ed25519.c @@ -418,6 +418,11 @@ int wc_ed25519_make_public(ed25519_key* key, unsigned char* pubKey, } #endif /* WOLF_CRYPTO_CB_ONLY_ED25519 */ +#ifndef WOLF_CRYPTO_CB_ONLY_ED25519 + /* az holds the clamped secret scalar (ISO/IEC 19790:2012 7.9.7). The + * crypto-callback return above happens before az is written. */ + ForceZero(az, sizeof(az)); +#endif return ret; } @@ -472,6 +477,13 @@ int wc_ed25519_make_key(WC_RNG* rng, int keySz, ed25519_key* key) if (ret == 0) { ret = ed25519_pairwise_consistency_test(key, rng); } + if (ret != 0) { + /* Do not hand back a key that failed its check or PCT. */ + key->privKeySet = 0; + key->pubKeySet = 0; + ForceZero(key->k, ED25519_PRV_KEY_SIZE); + ForceZero(key->p, ED25519_PUB_KEY_SIZE); + } #endif return ret; @@ -1761,10 +1773,18 @@ int wc_ed25519_export_key(const ed25519_key* key, int ret; /* export 'full' private part */ + /* Check the public arguments before anything is written to priv. */ + if ((pub == NULL) || (pubSz == NULL)) { + return BAD_FUNC_ARG; + } ret = wc_ed25519_export_private(key, priv, privSz); if (ret == 0) { /* export public part */ ret = wc_ed25519_export_public(key, pub, pubSz); + if (ret != 0) { + /* Public export failed: do not hand back the private key. */ + ForceZero(priv, *privSz); + } } return ret; diff --git a/wolfcrypt/src/ed448.c b/wolfcrypt/src/ed448.c index 02e062ac7e..176e4e6ca0 100644 --- a/wolfcrypt/src/ed448.c +++ b/wolfcrypt/src/ed448.c @@ -385,6 +385,9 @@ int wc_ed448_make_public(ed448_key* key, unsigned char* pubKey, word32 pubKeySz) key->pubKeySet = 1; } + /* az holds the clamped secret scalar (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(az, sizeof(az)); + return ret; } @@ -433,6 +436,13 @@ int wc_ed448_make_key(WC_RNG* rng, int keySz, ed448_key* key) if (ret == 0) { ret = ed448_pairwise_consistency_test(key, rng); } + if (ret != 0) { + /* Do not hand back a key that failed its check or PCT. */ + key->privKeySet = 0; + key->pubKeySet = 0; + ForceZero(key->k, ED448_PRV_KEY_SIZE); + ForceZero(key->p, ED448_PUB_KEY_SIZE); + } } #endif @@ -628,7 +638,8 @@ int wc_ed448_sign_msg_ex(const byte* in, word32 inLen, byte* out, #endif } #ifndef WOLFSSL_ED448_PERSISTENT_SHA - WC_FREE_VAR_EX(sha, key->heap, DYNAMIC_TYPE_HASHES); + /* key may be NULL here and XFREE evaluates its heap argument. */ + WC_FREE_VAR_EX(sha, key ? key->heap : NULL, DYNAMIC_TYPE_HASHES); #endif if (ret == 0) { @@ -885,6 +896,50 @@ static int ed448_verify_msg_final_with_sha(const byte* sig, word32 sigLen, return BAD_FUNC_ARG; } +#if FIPS_VERSION3_GE(7,0,0) + /* FIPS 186-5 sec 7.7 step 1: decoding shall fail for y >= p. The point + * decoder reduces mod p instead, so check the range here. */ + { + int j; + int rangeRet = PUBLIC_KEY_E; + /* The final byte carries only the x sign bit; bits 0-6 shall be zero + * (RFC 8032 sec 5.2.2). */ + if ((key->p[ED448_PUB_KEY_SIZE - 1] & 0x7f) != 0) { + return BAD_FUNC_ARG; + } + /* Check top part before 0xFE. y ends at byte ED448_PUB_KEY_SIZE-2; + * starting at the sign byte would accept every y >= p. */ + for (j = ED448_PUB_KEY_SIZE - 2; j > ED448_PUB_KEY_SIZE/2; j--) { + if (key->p[j] < 0xff) { + rangeRet = 0; + break; + } + } + if (rangeRet == WC_NO_ERR_TRACE(PUBLIC_KEY_E)) { + /* Check against 0xFE. */ + if (key->p[ED448_PUB_KEY_SIZE/2] < 0xfe) { + rangeRet = 0; + } + else if (key->p[ED448_PUB_KEY_SIZE/2] == 0xfe) { + /* Check bottom part before last byte. */ + for (j = ED448_PUB_KEY_SIZE/2 - 1; j > 0; j--) { + if (key->p[j] != 0xff) { + rangeRet = 0; + break; + } + } + /* Check last byte. */ + if ((rangeRet == WC_NO_ERR_TRACE(PUBLIC_KEY_E)) && + (key->p[0] < 0xff)) { + rangeRet = 0; + } + } + } + if (rangeRet != 0) + return BAD_FUNC_ARG; + } +#endif /* FIPS_VERSION3_GE(7,0,0) */ + /* uncompress A (public key), test if valid, and negate it */ if (ge448_from_bytes_negate_vartime(&A, key->p) != 0) return BAD_FUNC_ARG; @@ -1548,10 +1603,18 @@ int wc_ed448_export_key(const ed448_key* key, byte* priv, word32 *privSz, int ret = 0; /* export 'full' private part */ + /* Check the public arguments before anything is written to priv. */ + if ((pub == NULL) || (pubSz == NULL)) { + return BAD_FUNC_ARG; + } ret = wc_ed448_export_private(key, priv, privSz); if (ret == 0) { /* export public part */ ret = wc_ed448_export_public(key, pub, pubSz); + if (ret != 0) { + /* Public export failed: do not hand back the private key. */ + ForceZero(priv, *privSz); + } } return ret; @@ -1609,21 +1672,31 @@ int wc_ed448_check_key(ed448_key* key) int i; ret = PUBLIC_KEY_E; - /* Check top part before 0xFE. */ - for (i = ED448_PUB_KEY_SIZE - 1; i > ED448_PUB_KEY_SIZE/2; i--) { - if (key->p[i] < 0xff) { - ret = 0; - break; - } + /* The final byte carries only the x sign bit; bits 0-6 shall be zero + * (RFC 8032 sec 5.2.2). */ + if ((key->p[ED448_PUB_KEY_SIZE - 1] & 0x7f) != 0) { + ret = PUBLIC_KEY_E; } - if (ret == WC_NO_ERR_TRACE(PUBLIC_KEY_E)) { - /* Every byte above this one is 0xff here, so y > p whenever this - * byte is 0xff, and y == p is then the only remaining encoding - * outside [0, p - 1]. It is already rejected by - * ed448_is_small_order() above, whose table carries y == p as a - * non-canonical encoding, so the low bytes need no check. */ - if (key->p[ED448_PUB_KEY_SIZE/2] <= 0xfe) { - ret = 0; + else { + /* Check top part before 0xFE. y ends at byte ED448_PUB_KEY_SIZE-2; + * starting at the sign byte would accept every y >= p. */ + for (i = ED448_PUB_KEY_SIZE - 2; i > ED448_PUB_KEY_SIZE/2; i--) { + if (key->p[i] < 0xff) { + ret = 0; + break; + } + } + /* Kept inside the else: at the outer level this would also clear + * the non-canonical-pad rejection above. */ + if (ret == WC_NO_ERR_TRACE(PUBLIC_KEY_E)) { + /* Every byte above this one is 0xff here, so y > p whenever + * this byte is 0xff, and y == p is then the only remaining + * encoding outside [0, p - 1]. It is already rejected by + * ed448_is_small_order() above, whose table carries y == p as + * a non-canonical encoding, so the low bytes need no check. */ + if (key->p[ED448_PUB_KEY_SIZE/2] <= 0xfe) { + ret = 0; + } } } diff --git a/wolfcrypt/src/hmac.c b/wolfcrypt/src/hmac.c index 26a2904ed4..a07e8ba758 100644 --- a/wolfcrypt/src/hmac.c +++ b/wolfcrypt/src/hmac.c @@ -528,7 +528,7 @@ int wc_HmacCopy(Hmac* src, Hmac* dst) { if (hashes_copied >= 3) HmacKeyFreeHash(src->macType, &dst->o_hash); #endif - XMEMSET(dst, 0, sizeof(*dst)); + ForceZero(dst, sizeof(*dst)); } return ret; } @@ -1747,7 +1747,7 @@ void wc_HmacFree(Hmac* hmac) byte finalHash[WC_HMAC_BLOCK_SIZE]; ret = wc_CryptoCb_Hmac(hmac, hmac->macType, NULL, 0, finalHash); (void)ret; /* must ignore return code here */ - (void)finalHash; + ForceZero(finalHash, sizeof(finalHash)); } #endif diff --git a/wolfcrypt/src/kdf.c b/wolfcrypt/src/kdf.c index dd0467e069..9010e0318a 100644 --- a/wolfcrypt/src/kdf.c +++ b/wolfcrypt/src/kdf.c @@ -282,6 +282,7 @@ int wc_PRF_TLSv1(byte* digest, word32 digLen, const byte* secret, } } + ForceZero(sha_result, MAX_PRF_DIG); #if defined(WOLFSSL_CHECK_MEM_ZERO) wc_MemZero_Check(sha_result, MAX_PRF_DIG); #endif @@ -846,6 +847,8 @@ int wc_SSH_KDF(byte hashId, byte keyId, byte* key, word32 keySz, ret = _HashFinal(enmhashId, &hash, lastBlock); if (ret == 0) XMEMCPY(key, lastBlock, remainder); + /* lastBlock held derived key material (ISO/IEC 19790 7.9). */ + ForceZero(lastBlock, sizeof(lastBlock)); } } else { @@ -891,11 +894,15 @@ int wc_SSH_KDF(byte hashId, byte keyId, byte* key, word32 keySz, ret = _HashFinal(enmhashId, &hash, lastBlock); if (ret == 0) XMEMCPY(key + runningKeySz, lastBlock, remainder); + /* lastBlock held derived key material (ISO/IEC 19790 7.9). */ + ForceZero(lastBlock, sizeof(lastBlock)); } } } _HashFree(enmhashId, &hash); + /* hash absorbed the shared secret K (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(&hash, sizeof(hash)); return ret; } @@ -994,6 +1001,8 @@ static int wc_srtp_kdf_derive_key(byte* block, int idxSz, byte label, /* Copy into key required amount. */ XMEMCPY(key, enc, keySz); } + /* enc held a derived SRTP key block (ISO/IEC 19790 7.9). */ + ForceZero(enc, sizeof(enc)); } /* XOR out label. */ block[WC_SRTP_MAX_SALT - idxSz - 1] ^= label; @@ -1583,6 +1592,7 @@ int wc_KDA_KDF_twostep_cmac(const byte * salt, word32 salt_len, #ifdef WOLFSSL_SMALL_STACK if (cmac) { + ForceZero(cmac, sizeof(Cmac)); XFREE(cmac, heap, DYNAMIC_TYPE_CMAC); cmac = NULL; } @@ -1756,6 +1766,7 @@ int wc_KDA_KDF_PRF_cmac(const byte* Kin, word32 KinSz, #ifdef WOLFSSL_SMALL_STACK if (cmac) { + ForceZero(cmac, sizeof(Cmac)); XFREE(cmac, heap, DYNAMIC_TYPE_CMAC); cmac = NULL; } diff --git a/wolfcrypt/src/pwdbased.c b/wolfcrypt/src/pwdbased.c index 1c2c4acbc4..f4b2242421 100644 --- a/wolfcrypt/src/pwdbased.c +++ b/wolfcrypt/src/pwdbased.c @@ -590,6 +590,7 @@ int wc_PKCS12_PBKDF_ex(byte* output, const byte* passwd, int passLen, byte tmp[WC_MAX_BLOCK_SIZE + 1]; ret = mp_to_unsigned_bin(res, tmp); XMEMCPY(I + i, tmp + 1, v); + ForceZero(tmp, sizeof(tmp)); } else if (outSz < (int)v) { XMEMSET(I + i, 0, v - (word32)outSz); @@ -895,6 +896,7 @@ static void scryptSalsa(word32* out, word32* in) for (i = 0; i < 16; i++) out[i] = ByteReverseWord32(ByteReverseWord32(in[i]) + x[i]); #endif + ForceZero(x, sizeof(x)); } /* Mix a block using Salsa20/8. @@ -948,6 +950,7 @@ static void scryptBlockMix(byte* b, byte* y, int r) } #endif } + ForceZero(x, sizeof(x)); } /* Random oracles mix. diff --git a/wolfcrypt/src/random.c b/wolfcrypt/src/random.c index fff02bad25..7d06ddf9ab 100644 --- a/wolfcrypt/src/random.c +++ b/wolfcrypt/src/random.c @@ -847,6 +847,8 @@ static int Hash_gen(DRBG_internal* drbg, byte* out, word32 outSz, const byte* V) defined(WOLFSSL_CHECK_MEM_ZERO) wc_MemZero_Check(data, DRBG_SEED_LEN); #endif + /* digest holds the last output block (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(digest, WC_SHA256_DIGEST_SIZE); #ifndef WOLFSSL_SMALL_STACK_CACHE WC_FREE_VAR_EX(digest, drbg->heap, DYNAMIC_TYPE_DIGEST); @@ -1446,6 +1448,8 @@ static int Hash512_gen(DRBG_SHA512_internal* drbg, byte* out, word32 outSz, defined(WOLFSSL_CHECK_MEM_ZERO) wc_MemZero_Check(data, DRBG_SHA512_SEED_LEN); #endif + /* See Hash_gen. */ + ForceZero(digest, WC_SHA512_DIGEST_SIZE); #ifndef WOLFSSL_SMALL_STACK_CACHE WC_FREE_VAR_EX(digest, drbg->heap, DYNAMIC_TYPE_DIGEST); @@ -1738,6 +1742,7 @@ int wc_RNG_TestSeed(const byte* seed, word32 seedSz) /* Accumulate failure flag - once set, stays set */ rctFailed |= (repCount >= WC_RNG_SEED_RCT_CUTOFF); } + ForceZero(&prevByte, sizeof(prevByte)); } /* SP800-90B 4.4.2 - Adaptive Proportion Test (APT) @@ -1795,6 +1800,8 @@ int wc_RNG_TestSeed(const byte* seed, word32 seedSz) WC_RNG_SEED_APT_CUTOFF); } + /* Histogram of the live seed (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(byteCounts, MAX_ENTROPY_BITS * sizeof(word16)); #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_SMALL_STACK_CACHE) XFREE(byteCounts, NULL, DYNAMIC_TYPE_TMP_BUFFER); #endif @@ -1917,6 +1924,7 @@ static int _InitRng(WC_RNG* rng, byte* nonce, word32 nonceSz, #ifdef WOLFSSL_SMALL_STACK_CACHE int drbg_scratch_instantiated = 0; #endif + int drbg_instantiated = 0; #endif (void)nonce; @@ -2238,6 +2246,8 @@ static int _InitRng(WC_RNG* rng, byte* nonce, word32 nonceSz, #endif if (ret == DRBG_SUCCESS) { + /* Instantiate clears the block on entry. */ + drbg_instantiated = 1; #ifndef NO_SHA256 if (rng->drbgType == WC_DRBG_SHA256) ret = Hash_DRBG_Instantiate((DRBG_internal *)rng->drbg, @@ -2275,8 +2285,14 @@ static int _InitRng(WC_RNG* rng, byte* nonce, word32 nonceSz, WC_FREE_VAR_EX(seed, rng->heap, DYNAMIC_TYPE_SEED); if (ret != DRBG_SUCCESS) { + (void)drbg_instantiated; #ifndef NO_SHA256 if (rng->drbgType == WC_DRBG_SHA256) { + /* A failed instantiate may have left V in the block + * (ISO/IEC 19790:2012 7.9.7). */ + if (drbg_instantiated) { + (void)Hash_DRBG_Uninstantiate((DRBG_internal *)rng->drbg); + } #if !defined(WOLFSSL_NO_MALLOC) || defined(WOLFSSL_STATIC_MEMORY) XFREE(rng->drbg, rng->heap, DYNAMIC_TYPE_RNG); #endif @@ -2295,6 +2311,11 @@ static int _InitRng(WC_RNG* rng, byte* nonce, word32 nonceSz, #endif /* !NO_SHA256 */ #ifdef WOLFSSL_DRBG_SHA512 if (rng->drbgType == WC_DRBG_SHA512) { + /* See the SHA-256 branch above. */ + if (drbg_instantiated) { + (void)Hash512_DRBG_Uninstantiate( + (DRBG_SHA512_internal *)rng->drbg512); + } #if !defined(WOLFSSL_NO_MALLOC) || defined(WOLFSSL_STATIC_MEMORY) XFREE(rng->drbg512, rng->heap, DYNAMIC_TYPE_RNG); #endif @@ -4269,7 +4290,7 @@ void wc_NoiseSrc_Free(wc_NoiseSrc* src) if (src->work != NULL && src->workSz > 0) { ForceZero(src->work, src->workSz); } - XMEMSET(src->health, 0, sizeof(src->health)); + ForceZero(src->health, sizeof(src->health)); src->chunkCtr = 0; src->failed = 0; src->degraded = 0; diff --git a/wolfcrypt/src/rsa.c b/wolfcrypt/src/rsa.c index 40d01b1a4c..4153cc7a6b 100644 --- a/wolfcrypt/src/rsa.c +++ b/wolfcrypt/src/rsa.c @@ -656,6 +656,20 @@ int wc_RsaGetKeyId(RsaKey* key, word32* keyId) } #endif /* WOLFSSL_SE050 */ +#ifndef WOLFSSL_RSA_PUBLIC_ONLY +static void RsaForceZeroPriv(RsaKey* key) +{ +#if defined(WOLFSSL_KEY_GEN) || defined(OPENSSL_EXTRA) || !defined(RSA_LOW_MEM) + mp_forcezero(&key->u); + mp_forcezero(&key->dQ); + mp_forcezero(&key->dP); +#endif + mp_forcezero(&key->q); + mp_forcezero(&key->p); + mp_forcezero(&key->d); +} +#endif + int wc_FreeRsaKey(RsaKey* key) { int ret = 0; @@ -673,8 +687,13 @@ int wc_FreeRsaKey(RsaKey* key) WC_PK_TYPE_RSA, 0, key); /* If callback wants standard free, it returns CRYPTOCB_UNAVAILABLE. * Otherwise assume the callback handled cleanup. */ - if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) + if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) { + wc_RsaCleanup(key); + #ifndef WOLFSSL_RSA_PUBLIC_ONLY + RsaForceZeroPriv(key); + #endif return ret; + } /* fall-through to software cleanup */ ret = 0; } @@ -691,17 +710,8 @@ int wc_FreeRsaKey(RsaKey* key) #endif #ifndef WOLFSSL_RSA_PUBLIC_ONLY - /* Forcezero all private key fields that are present in this build - * configuration, since they may contain residual sensitive data even when - * key->type is not RSA_PRIVATE (e.g., after a partial key decode failure). */ -#if defined(WOLFSSL_KEY_GEN) || defined(OPENSSL_EXTRA) || !defined(RSA_LOW_MEM) - mp_forcezero(&key->u); - mp_forcezero(&key->dQ); - mp_forcezero(&key->dP); -#endif - mp_forcezero(&key->q); - mp_forcezero(&key->p); - mp_forcezero(&key->d); + /* Private fields may hold residue even when type is not RSA_PRIVATE. */ + RsaForceZeroPriv(key); #endif /* WOLFSSL_RSA_PUBLIC_ONLY */ /* public part */ @@ -1183,6 +1193,17 @@ static int RsaMGF1(enum wc_HashType hType, byte* seed, word32 seedSz, ret = wc_Hash(hType, tmp, (seedSz + 4), tmp, tmpSz); #endif if (ret != 0) { + /* tmp holds the OAEP seed (ISO/IEC 19790:2012 7.9.7). */ +#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC) + if (tmpF) { + ForceZero(tmp, tmpSz); + } + else { + ForceZero(tmpA, sizeof(tmpA)); + } +#else + ForceZero(tmp, sizeof(tmp)); +#endif /* check for if dynamic memory was needed, then free */ #ifdef WOLFSSL_SMALL_STACK_CACHE wc_HashFree(hash, hType); @@ -1201,6 +1222,17 @@ static int RsaMGF1(enum wc_HashType hType, byte* seed, word32 seedSz, } counter++; } while (idx < outSz); + /* tmp holds the OAEP seed (ISO/IEC 19790:2012 7.9.7). */ +#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC) + if (tmpF) { + ForceZero(tmp, tmpSz); + } + else { + ForceZero(tmpA, sizeof(tmpA)); + } +#else + ForceZero(tmp, sizeof(tmp)); +#endif #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC) /* check for if dynamic memory was needed, then free */ if (tmpF) { @@ -1494,12 +1526,14 @@ static int RsaPad_OAEP(const byte* input, word32 inputLen, byte* pkcsBlock, } #else if (pkcsBlockLen - hLen - 1 > sizeof(dbMask)) { + ForceZero(seed, hLen); return MEMORY_E; } #endif XMEMSET(dbMask, 0, pkcsBlockLen - hLen - 1); /* help static analyzer */ ret = RsaMGF(mgf, seed, hLen, dbMask, pkcsBlockLen - hLen - 1, heap); if (ret != 0) { + ForceZero(dbMask, pkcsBlockLen - hLen - 1); WC_FREE_VAR_EX(dbMask, heap, DYNAMIC_TYPE_RSA); WC_FREE_VAR_EX(lHash, heap, DYNAMIC_TYPE_RSA_BUFFER); ForceZero(seed, hLen); @@ -1509,6 +1543,8 @@ static int RsaPad_OAEP(const byte* input, word32 inputLen, byte* pkcsBlock, xorbuf(pkcsBlock + hLen + 1, dbMask,pkcsBlockLen - hLen - 1); + /* dbMask is derived from the seed (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(dbMask, pkcsBlockLen - hLen - 1); WC_FREE_VAR_EX(dbMask, heap, DYNAMIC_TYPE_RSA); /* create maskedSeed from seedMask */ @@ -3983,6 +4019,10 @@ static int RsaPublicEncryptEx(const byte* in, word32 inLen, byte* out, hash, mgf, label, labelSz, saltLen, mp_count_bits(&key->n), key->heap); if (ret < 0) { + if (rsa_type == RSA_PUBLIC_ENCRYPT) { + /* Padding failed with the secret already copied in. */ + ForceZero(out, (word32)sz); + } break; } @@ -3999,6 +4039,16 @@ static int RsaPublicEncryptEx(const byte* in, word32 inLen, byte* out, key->state = RSA_STATE_ENCRYPT_RES; } if (ret < 0) { + /* out holds the padded secret (ISO/IEC 19790:2012 7.9.7); a + * pending or would-block result still needs it. */ + if ((rsa_type == RSA_PUBLIC_ENCRYPT) && + (ret != WC_NO_ERR_TRACE(WC_PENDING_E)) + #ifdef WC_RSA_NONBLOCK + && (ret != FP_WOULDBLOCK) + #endif + ) { + ForceZero(out, (word32)sz); + } break; } diff --git a/wolfcrypt/src/sha.c b/wolfcrypt/src/sha.c index d65766313e..720a4b7f11 100644 --- a/wolfcrypt/src/sha.c +++ b/wolfcrypt/src/sha.c @@ -850,6 +850,7 @@ int wc_ShaFinalRaw(wc_Sha* sha, byte* hash) ByteReverseWords((word32*)digest, (word32*)sha->digest, WC_SHA_DIGEST_SIZE); } XMEMCPY(hash, (byte *)&digest[0], WC_SHA_DIGEST_SIZE); + ForceZero(digest, sizeof(digest)); #else XMEMCPY(hash, sha->digest, WC_SHA_DIGEST_SIZE); #endif @@ -1135,8 +1136,18 @@ void wc_ShaFree(wc_Sha* sha) /* If they want the standard free, they can call it themselves */ /* via their callback setting devId to INVALID_DEVID */ /* otherwise assume the callback handled it */ - if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) + if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) { + /* Release heap state first; the wipe drops its pointers. */ + #ifdef WOLFSSL_HASH_KEEP + if (sha->msg != NULL) { + ForceZero(sha->msg, sha->len); + XFREE(sha->msg, sha->heap, DYNAMIC_TYPE_TMP_BUFFER); + sha->msg = NULL; + } + #endif + ForceZero(sha, sizeof(*sha)); return; + } /* fall-through when unavailable */ } @@ -1182,6 +1193,10 @@ void wc_ShaFree(wc_Sha* sha) #if defined(PSOC6_HASH_SHA1) wc_Psoc6_Sha_Free(); #endif + + /* digest and buffer hold keyed material for HMAC-SHA1 and the SSH KDF + * (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(sha, sizeof(*sha)); } #endif /* !MAX3266X_SHA */ diff --git a/wolfcrypt/src/sha256.c b/wolfcrypt/src/sha256.c index 14c1f99caa..8bf74b051d 100644 --- a/wolfcrypt/src/sha256.c +++ b/wolfcrypt/src/sha256.c @@ -2296,6 +2296,7 @@ static WC_INLINE int Transform_Sha256_Len(wc_Sha256* sha256, const byte* data, WC_SHA256_DIGEST_SIZE); } XMEMCPY(hash, digest, WC_SHA256_DIGEST_SIZE); + ForceZero(digest, sizeof(digest)); #else XMEMCPY(hash, sha256->digest, WC_SHA256_DIGEST_SIZE); #endif @@ -2374,13 +2375,16 @@ static WC_INLINE int Transform_Sha256_Len(wc_Sha256* sha256, const byte* data, #endif { byte buffer[WC_SHA256_BLOCK_SIZE]; + int tret; ByteReverseWords((word32*)buffer, (word32*)data, WC_SHA256_BLOCK_SIZE); #ifdef __aarch64__ - return Transform_Sha256_aarch64(sha256, buffer); + tret = Transform_Sha256_aarch64(sha256, buffer); #else - return Transform_Sha256(sha256, buffer); + tret = Transform_Sha256(sha256, buffer); #endif + ForceZero(buffer, sizeof(buffer)); + return tret; } #else return Transform_Sha256(sha256, data); @@ -2990,8 +2994,26 @@ static WC_INLINE int Transform_Sha256_Len(wc_Sha256* sha256, const byte* data, /* If they want the standard free, they can call it themselves */ /* via their callback setting devId to INVALID_DEVID */ /* otherwise assume the callback handled it */ - if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) + if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) { + /* Release heap state first; the wipe drops its pointers. */ + #ifdef WOLFSSL_SMALL_STACK_CACHE + if (sha224->W != NULL) { + ForceZero(sha224->W, + sizeof(word32) * WC_SHA224_BLOCK_SIZE); + XFREE(sha224->W, sha224->heap, DYNAMIC_TYPE_DIGEST); + sha224->W = NULL; + } + #endif + #ifdef WOLFSSL_HASH_KEEP + if (sha224->msg != NULL) { + ForceZero(sha224->msg, sha224->len); + XFREE(sha224->msg, sha224->heap, DYNAMIC_TYPE_TMP_BUFFER); + sha224->msg = NULL; + } + #endif + ForceZero(sha224, sizeof(*sha224)); return; + } /* fall-through when unavailable */ } @@ -3067,8 +3089,26 @@ void wc_Sha256Free(wc_Sha256* sha256) /* If they want the standard free, they can call it themselves */ /* via their callback setting devId to INVALID_DEVID */ /* otherwise assume the callback handled it */ - if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) + if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) { + /* Release heap state first; the wipe drops its pointers. */ + #ifdef WOLFSSL_SMALL_STACK_CACHE + if (sha256->W != NULL) { + ForceZero(sha256->W, + sizeof(word32) * WC_SHA256_BLOCK_SIZE); + XFREE(sha256->W, sha256->heap, DYNAMIC_TYPE_DIGEST); + sha256->W = NULL; + } + #endif + #ifdef WOLFSSL_HASH_KEEP + if (sha256->msg != NULL) { + ForceZero(sha256->msg, sha256->len); + XFREE(sha256->msg, sha256->heap, DYNAMIC_TYPE_TMP_BUFFER); + sha256->msg = NULL; + } + #endif + ForceZero(sha256, sizeof(*sha256)); return; + } /* fall-through when unavailable */ } @@ -3233,6 +3273,8 @@ int wc_Sha224_Grow(wc_Sha224* sha224, const byte* in, int inSz) wc_Sha224Free(tmpSha224); } + ForceZero(tmpSha224, sizeof(*tmpSha224)); + WC_FREE_VAR_EX(tmpSha224, NULL, DYNAMIC_TYPE_TMP_BUFFER); return ret; } @@ -3269,7 +3311,7 @@ int wc_Sha224_Grow(wc_Sha224* sha224, const byte* in, int inSz) dst->W = (word32*)XMALLOC(sizeof(word32) * WC_SHA256_BLOCK_SIZE, dst->heap, DYNAMIC_TYPE_DIGEST); if (dst->W == NULL) { - XMEMSET(dst, 0, sizeof(wc_Sha224)); + ForceZero(dst, sizeof(wc_Sha224)); return MEMORY_E; } #endif @@ -3382,6 +3424,9 @@ int wc_Sha256GetHash(wc_Sha256* sha256, byte* hash) } + ForceZero(tmpSha256, sizeof(*tmpSha256)); + + WC_FREE_VAR_EX(tmpSha256, NULL, DYNAMIC_TYPE_TMP_BUFFER); return ret; @@ -3423,7 +3468,7 @@ int wc_Sha256Copy(wc_Sha256* src, wc_Sha256* dst) dst->W = (word32*)XMALLOC(sizeof(word32) * WC_SHA256_BLOCK_SIZE, dst->heap, DYNAMIC_TYPE_DIGEST); if (dst->W == NULL) { - XMEMSET(dst, 0, sizeof(wc_Sha256)); + ForceZero(dst, sizeof(wc_Sha256)); return MEMORY_E; } #endif diff --git a/wolfcrypt/src/sha3.c b/wolfcrypt/src/sha3.c index 15f6ba2a2e..cf0d157798 100644 --- a/wolfcrypt/src/sha3.c +++ b/wolfcrypt/src/sha3.c @@ -1589,12 +1589,10 @@ static void wc_Sha3Free(wc_Sha3* sha3) int ret = 0; #endif - (void)sha3; - -#if defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_FREE) if (sha3 == NULL) return; +#if defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_FREE) #ifndef WOLF_CRYPTO_CB_FIND if (sha3->devId != INVALID_DEVID) #endif @@ -1604,8 +1602,10 @@ static void wc_Sha3Free(wc_Sha3* sha3) /* If they want the standard free, they can call it themselves */ /* via their callback setting devId to INVALID_DEVID */ /* otherwise assume the callback handled it */ - if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) + if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) { + ForceZero(sha3, sizeof(*sha3)); return; + } /* fall-through when unavailable */ } @@ -1624,6 +1624,10 @@ static void wc_Sha3Free(wc_Sha3* sha3) #if defined(PSOC6_HASH_SHA3) wc_Psoc6_Sha_Free(); #endif + + /* s and t hold absorbed keys and seeds for Ed448, ML-KEM, ML-DSA, + * SLH-DSA, LMS, XMSS and HMAC-SHA3 (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(sha3, sizeof(*sha3)); } /* Copy the state of the SHA3 operation. @@ -1704,6 +1708,8 @@ static int wc_Sha3GetHash(wc_Sha3* sha3, byte* hash, word32 p, word32 len) ret = wc_Sha3Final(tmpSha3, hash, p, len); } + ForceZero(tmpSha3, sizeof(*tmpSha3)); + WC_FREE_VAR_EX(tmpSha3, sha3->heap, DYNAMIC_TYPE_TMP_BUFFER); return ret; } @@ -2235,6 +2241,9 @@ int wc_Shake128_Absorb(wc_Shake* shake, const byte* data, word32 len) byte hash[1]; ret = Sha3Final(shake, 0x1f, hash, WC_SHA3_128_COUNT, 0); } + /* Sha3Final does not clear t; the absorbed seed would stay for the + * squeeze lifetime (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(shake->t, sizeof(shake->t)); /* No partial data. */ shake->i = 0; @@ -2548,6 +2557,9 @@ int wc_Shake256_Absorb(wc_Shake* shake, const byte* data, word32 len) byte hash[1]; ret = Sha3Final(shake, 0x1f, hash, WC_SHA3_256_COUNT, 0); } + /* Sha3Final does not clear t; the absorbed seed would stay for the + * squeeze lifetime (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(shake->t, sizeof(shake->t)); /* No partial data. */ shake->i = 0; diff --git a/wolfcrypt/src/sha512.c b/wolfcrypt/src/sha512.c index 108af7ed2f..6b79c6014c 100644 --- a/wolfcrypt/src/sha512.c +++ b/wolfcrypt/src/sha512.c @@ -507,8 +507,10 @@ void wc_Sha512Free(wc_Sha512* sha512) /* If they want the standard free, they can call it themselves */ /* via their callback setting devId to INVALID_DEVID */ /* otherwise assume the callback handled it */ - if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) + if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) { + ForceZero(sha512, sizeof(*sha512)); return; + } /* fall-through when unavailable */ } @@ -536,6 +538,8 @@ int wc_Sha512GetHash(wc_Sha512* sha512, byte* hash) wc_Sha512Free(tmpSha512); } + ForceZero(tmpSha512, sizeof(*tmpSha512)); + WC_FREE_VAR_EX(tmpSha512, NULL, DYNAMIC_TYPE_TMP_BUFFER); return ret; @@ -649,6 +653,8 @@ int wc_Sha512_224GetHash(wc_Sha512* sha512, byte* hash) wc_Sha512_224Free(tmpSha512); } + ForceZero(tmpSha512, sizeof(*tmpSha512)); + WC_FREE_VAR_EX(tmpSha512, NULL, DYNAMIC_TYPE_TMP_BUFFER); return ret; @@ -729,6 +735,8 @@ int wc_Sha512_256GetHash(wc_Sha512* sha512, byte* hash) wc_Sha512_256Free(tmpSha512); } + ForceZero(tmpSha512, sizeof(*tmpSha512)); + WC_FREE_VAR_EX(tmpSha512, NULL, DYNAMIC_TYPE_TMP_BUFFER); return ret; @@ -829,8 +837,10 @@ void wc_Sha384Free(wc_Sha384* sha384) /* If they want the standard free, they can call it themselves */ /* via their callback setting devId to INVALID_DEVID */ /* otherwise assume the callback handled it */ - if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) + if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) { + ForceZero(sha384, sizeof(*sha384)); return; + } /* fall-through when unavailable */ } @@ -858,6 +868,8 @@ int wc_Sha384GetHash(wc_Sha384* sha384, byte* hash) wc_Sha384Free(tmpSha384); } + ForceZero(tmpSha384, sizeof(*tmpSha384)); + WC_FREE_VAR_EX(tmpSha384, NULL, DYNAMIC_TYPE_TMP_BUFFER); return ret; @@ -2592,8 +2604,26 @@ void wc_Sha512Free(wc_Sha512* sha512) /* If they want the standard free, they can call it themselves */ /* via their callback setting devId to INVALID_DEVID */ /* otherwise assume the callback handled it */ - if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) + if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) { + /* Release heap state first; the wipe drops its pointers. */ + #ifdef WOLFSSL_SMALL_STACK_CACHE + if (sha512->W != NULL) { + ForceZero(sha512->W, + (sizeof(word64) * 16) + WC_SHA512_BLOCK_SIZE); + XFREE(sha512->W, sha512->heap, DYNAMIC_TYPE_DIGEST); + sha512->W = NULL; + } + #endif + #ifdef WOLFSSL_HASH_KEEP + if (sha512->msg != NULL) { + ForceZero(sha512->msg, sha512->len); + XFREE(sha512->msg, sha512->heap, DYNAMIC_TYPE_TMP_BUFFER); + sha512->msg = NULL; + } + #endif + ForceZero(sha512, sizeof(*sha512)); return; + } /* fall-through when unavailable */ } @@ -2703,8 +2733,8 @@ int wc_Sha512Transform(wc_Sha512* sha, const unsigned char* data) XMEMCPY(sha->buffer, buffer, WC_SHA512_BLOCK_SIZE); #endif -#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_SMALL_STACK_CACHE) ForceZero(buffer, WC_SHA512_BLOCK_SIZE); +#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_SMALL_STACK_CACHE) XFREE(buffer, sha->heap, DYNAMIC_TYPE_TMP_BUFFER); #endif return ret; @@ -3068,8 +3098,26 @@ void wc_Sha384Free(wc_Sha384* sha384) /* If they want the standard free, they can call it themselves */ /* via their callback setting devId to INVALID_DEVID */ /* otherwise assume the callback handled it */ - if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) + if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) { + /* Release heap state first; the wipe drops its pointers. */ + #ifdef WOLFSSL_SMALL_STACK_CACHE + if (sha384->W != NULL) { + ForceZero(sha384->W, + (sizeof(word64) * 16) + WC_SHA512_BLOCK_SIZE); + XFREE(sha384->W, sha384->heap, DYNAMIC_TYPE_DIGEST); + sha384->W = NULL; + } + #endif + #ifdef WOLFSSL_HASH_KEEP + if (sha384->msg != NULL) { + ForceZero(sha384->msg, sha384->len); + XFREE(sha384->msg, sha384->heap, DYNAMIC_TYPE_TMP_BUFFER); + sha384->msg = NULL; + } + #endif + ForceZero(sha384, sizeof(*sha384)); return; + } /* fall-through when unavailable */ } @@ -3160,6 +3208,8 @@ static int Sha512_Family_GetHash(wc_Sha512* sha512, byte* hash, wc_Sha512Free(tmpSha512); } + ForceZero(tmpSha512, sizeof(*tmpSha512)); + WC_FREE_VAR_EX(tmpSha512, NULL, DYNAMIC_TYPE_TMP_BUFFER); return ret; @@ -3205,7 +3255,7 @@ int wc_Sha512Copy(wc_Sha512* src, wc_Sha512* dst) dst->W = (word64 *)XMALLOC((sizeof(word64) * 16) + WC_SHA512_BLOCK_SIZE, dst->heap, DYNAMIC_TYPE_DIGEST); if (dst->W == NULL) { - XMEMSET(dst, 0, sizeof(wc_Sha512)); + ForceZero(dst, sizeof(wc_Sha512)); return MEMORY_E; } #endif @@ -3606,6 +3656,8 @@ int wc_Sha384GetHash(wc_Sha384* sha384, byte* hash) wc_Sha384Free(tmpSha384); } + ForceZero(tmpSha384, sizeof(*tmpSha384)); + WC_FREE_VAR_EX(tmpSha384, NULL, DYNAMIC_TYPE_TMP_BUFFER); return ret; @@ -3647,7 +3699,7 @@ int wc_Sha384Copy(wc_Sha384* src, wc_Sha384* dst) dst->W = (word64 *)XMALLOC((sizeof(word64) * 16) + WC_SHA384_BLOCK_SIZE, dst->heap, DYNAMIC_TYPE_DIGEST); if (dst->W == NULL) { - XMEMSET(dst, 0, sizeof(wc_Sha384)); + ForceZero(dst, sizeof(wc_Sha384)); return MEMORY_E; } #endif diff --git a/wolfcrypt/src/sp_arm32.c b/wolfcrypt/src/sp_arm32.c index 1b85225729..6dc7293f2c 100644 --- a/wolfcrypt/src/sp_arm32.c +++ b/wolfcrypt/src/sp_arm32.c @@ -18285,7 +18285,7 @@ int sp_RsaPrivate_2048(const byte* in, word32 inLen, const mp_int* dm, *outLen = 256; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 64, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 64 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -18482,7 +18482,9 @@ int sp_ModExp_2048(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_2048_to_mp(r, res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -19083,7 +19085,9 @@ int sp_DhExp_2048(const mp_int* base, const byte* exp, word32 expLen, } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -19138,7 +19142,9 @@ int sp_ModExp_1024(const mp_int* base, const mp_int* exp, const mp_int* mod, mp_clamp(res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -46343,7 +46349,7 @@ int sp_RsaPrivate_3072(const byte* in, word32 inLen, const mp_int* dm, *outLen = 384; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 96, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 96 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -46540,7 +46546,9 @@ int sp_ModExp_3072(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -47333,7 +47341,9 @@ int sp_DhExp_3072(const mp_int* base, const byte* exp, word32 expLen, } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -47388,7 +47398,9 @@ int sp_ModExp_1536(const mp_int* base, const mp_int* exp, const mp_int* mod, mp_clamp(res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -62168,7 +62180,7 @@ int sp_RsaPrivate_4096(const byte* in, word32 inLen, const mp_int* dm, *outLen = 512; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 128, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 128 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -62365,7 +62377,9 @@ int sp_ModExp_4096(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_4096_to_mp(r, res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -63350,7 +63364,9 @@ int sp_DhExp_4096(const mp_int* base, const byte* exp, word32 expLen, } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -77152,7 +77168,7 @@ int sp_ecc_mulmod_256(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_256_point_to_ecc_point_8(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 8, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -77213,7 +77229,7 @@ int sp_ecc_mulmod_add_256(const mp_int* km, const ecc_point* gm, err = sp_256_point_to_ecc_point_8(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 8 + 8 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -78669,7 +78685,7 @@ int sp_ecc_mulmod_base_256(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_256_point_to_ecc_point_8(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 8, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -78728,7 +78744,7 @@ int sp_ecc_mulmod_base_add_256(const mp_int* km, const ecc_point* am, err = sp_256_point_to_ecc_point_8(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 8 + 8 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -78922,7 +78938,7 @@ int sp_ecc_make_key_256(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_256_point_to_ecc_point_8(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 8, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -79081,8 +79097,8 @@ int sp_ecc_secret_gen_256(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 32; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 8, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_256, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -81936,7 +81952,7 @@ int sp_ecc_check_key_256(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 8, heap, DYNAMIC_TYPE_ECC); return err; } @@ -95472,7 +95488,7 @@ int sp_ecc_mulmod_384(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_384_point_to_ecc_point_12(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 12, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -95533,7 +95549,7 @@ int sp_ecc_mulmod_add_384(const mp_int* km, const ecc_point* gm, err = sp_384_point_to_ecc_point_12(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 12 + 12 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -96989,7 +97005,7 @@ int sp_ecc_mulmod_base_384(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_384_point_to_ecc_point_12(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 12, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -97048,7 +97064,7 @@ int sp_ecc_mulmod_base_add_384(const mp_int* km, const ecc_point* am, err = sp_384_point_to_ecc_point_12(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 12 + 12 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -97248,7 +97264,7 @@ int sp_ecc_make_key_384(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_384_point_to_ecc_point_12(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 12, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -97407,8 +97423,8 @@ int sp_ecc_secret_gen_384(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 48; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 12, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_384, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -100484,7 +100500,7 @@ int sp_ecc_check_key_384(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 12, heap, DYNAMIC_TYPE_ECC); return err; } @@ -122918,7 +122934,7 @@ int sp_ecc_mulmod_521(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_521_point_to_ecc_point_17(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 17, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -122979,7 +122995,7 @@ int sp_ecc_mulmod_add_521(const mp_int* km, const ecc_point* gm, err = sp_521_point_to_ecc_point_17(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 17 + 17 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -124979,7 +124995,7 @@ int sp_ecc_mulmod_base_521(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_521_point_to_ecc_point_17(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 17, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -125038,7 +125054,7 @@ int sp_ecc_mulmod_base_add_521(const mp_int* km, const ecc_point* am, err = sp_521_point_to_ecc_point_17(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 17 + 17 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -125248,7 +125264,7 @@ int sp_ecc_make_key_521(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_521_point_to_ecc_point_17(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 17, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -125409,8 +125425,8 @@ int sp_ecc_secret_gen_521(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 66; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 17, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_521, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -129712,7 +129728,7 @@ int sp_ecc_check_key_521(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 17, heap, DYNAMIC_TYPE_ECC); return err; } @@ -152872,7 +152888,7 @@ int sp_ecc_mulmod_1024(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_1024_point_to_ecc_point_32(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 32, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -156496,7 +156512,7 @@ int sp_ecc_mulmod_base_1024(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_1024_point_to_ecc_point_32(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 32, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -156555,7 +156571,7 @@ int sp_ecc_mulmod_base_add_1024(const mp_int* km, const ecc_point* am, err = sp_1024_point_to_ecc_point_32(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 32 + 32 * 2 * 37, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -156686,7 +156702,7 @@ int sp_ecc_mulmod_table_1024(const mp_int* km, const ecc_point* gm, byte* table, } SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 32, heap, DYNAMIC_TYPE_ECC); return err; } @@ -160320,7 +160336,7 @@ int sp_ecc_check_key_1024(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 32, heap, DYNAMIC_TYPE_ECC); return err; } diff --git a/wolfcrypt/src/sp_arm64.c b/wolfcrypt/src/sp_arm64.c index 4f013db6c9..9fbb9e87dc 100644 --- a/wolfcrypt/src/sp_arm64.c +++ b/wolfcrypt/src/sp_arm64.c @@ -6996,7 +6996,7 @@ int sp_RsaPrivate_2048(const byte* in, word32 inLen, const mp_int* dm, *outLen = 256; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 32, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 32 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -7193,7 +7193,9 @@ int sp_ModExp_2048(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_2048_to_mp(r, res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -7586,7 +7588,9 @@ int sp_DhExp_2048(const mp_int* base, const byte* exp, word32 expLen, } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -7641,7 +7645,9 @@ int sp_ModExp_1024(const mp_int* base, const mp_int* exp, const mp_int* mod, mp_clamp(res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -17091,7 +17097,7 @@ int sp_RsaPrivate_3072(const byte* in, word32 inLen, const mp_int* dm, *outLen = 384; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 48, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 48 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -17288,7 +17294,9 @@ int sp_ModExp_3072(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -17777,7 +17785,9 @@ int sp_DhExp_3072(const mp_int* base, const byte* exp, word32 expLen, } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -17832,7 +17842,9 @@ int sp_ModExp_1536(const mp_int* base, const mp_int* exp, const mp_int* mod, mp_clamp(res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -22486,7 +22498,7 @@ int sp_RsaPrivate_4096(const byte* in, word32 inLen, const mp_int* dm, *outLen = 512; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 64, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 64 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -22683,7 +22695,9 @@ int sp_ModExp_4096(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_4096_to_mp(r, res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -23268,7 +23282,9 @@ int sp_DhExp_4096(const mp_int* base, const byte* exp, word32 expLen, } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -27098,7 +27114,7 @@ int sp_ecc_mulmod_256(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_256_point_to_ecc_point_4(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 4, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -27159,7 +27175,7 @@ int sp_ecc_mulmod_add_256(const mp_int* km, const ecc_point* gm, err = sp_256_point_to_ecc_point_4(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 4 + 4 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -55502,7 +55518,7 @@ int sp_ecc_mulmod_base_256(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_256_point_to_ecc_point_4(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 4, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -55561,7 +55577,7 @@ int sp_ecc_mulmod_base_add_256(const mp_int* km, const ecc_point* am, err = sp_256_point_to_ecc_point_4(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 4 + 4 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -55814,7 +55830,7 @@ int sp_ecc_make_key_256(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_256_point_to_ecc_point_4(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 4, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -55979,8 +55995,8 @@ int sp_ecc_secret_gen_256(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 32; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 4, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_256, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -58282,7 +58298,7 @@ int sp_ecc_check_key_256(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 4, heap, DYNAMIC_TYPE_ECC); return err; } @@ -62359,7 +62375,7 @@ int sp_ecc_mulmod_384(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_384_point_to_ecc_point_6(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -62420,7 +62436,7 @@ int sp_ecc_mulmod_add_384(const mp_int* km, const ecc_point* gm, err = sp_384_point_to_ecc_point_6(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 6 + 6 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -82122,7 +82138,7 @@ int sp_ecc_mulmod_base_384(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_384_point_to_ecc_point_6(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -82181,7 +82197,7 @@ int sp_ecc_mulmod_base_add_384(const mp_int* km, const ecc_point* am, err = sp_384_point_to_ecc_point_6(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 6 + 6 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -82438,7 +82454,7 @@ int sp_ecc_make_key_384(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_384_point_to_ecc_point_6(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 6, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -82603,8 +82619,8 @@ int sp_ecc_secret_gen_384(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 48; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 6, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_384, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -84197,7 +84213,7 @@ int sp_ecc_check_key_384(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 6, heap, DYNAMIC_TYPE_ECC); return err; } @@ -90666,7 +90682,7 @@ int sp_ecc_mulmod_521(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_521_point_to_ecc_point_9(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -90727,7 +90743,7 @@ int sp_ecc_mulmod_add_521(const mp_int* km, const ecc_point* gm, err = sp_521_point_to_ecc_point_9(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9 + 9 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -127143,7 +127159,7 @@ int sp_ecc_mulmod_base_521(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_521_point_to_ecc_point_9(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -127202,7 +127218,7 @@ int sp_ecc_mulmod_base_add_521(const mp_int* km, const ecc_point* am, err = sp_521_point_to_ecc_point_9(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9 + 9 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -127468,7 +127484,7 @@ int sp_ecc_make_key_521(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_521_point_to_ecc_point_9(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -127635,8 +127651,8 @@ int sp_ecc_secret_gen_521(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 66; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_521, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -129014,7 +129030,7 @@ int sp_ecc_check_key_521(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 9, heap, DYNAMIC_TYPE_ECC); return err; } @@ -134006,7 +134022,7 @@ int sp_ecc_mulmod_1024(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_1024_point_to_ecc_point_16(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 16, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -137391,7 +137407,7 @@ int sp_ecc_mulmod_base_1024(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_1024_point_to_ecc_point_16(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 16, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -137450,7 +137466,7 @@ int sp_ecc_mulmod_base_add_1024(const mp_int* km, const ecc_point* am, err = sp_1024_point_to_ecc_point_16(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 16 + 16 * 2 * 37, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -137581,7 +137597,7 @@ int sp_ecc_mulmod_table_1024(const mp_int* km, const ecc_point* gm, byte* table, } SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 16, heap, DYNAMIC_TYPE_ECC); return err; } @@ -141034,7 +141050,7 @@ int sp_ecc_check_key_1024(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 16, heap, DYNAMIC_TYPE_ECC); return err; } diff --git a/wolfcrypt/src/sp_armthumb.c b/wolfcrypt/src/sp_armthumb.c index 0a77bddf1c..e94fe2ce36 100644 --- a/wolfcrypt/src/sp_armthumb.c +++ b/wolfcrypt/src/sp_armthumb.c @@ -28526,7 +28526,7 @@ int sp_RsaPrivate_2048(const byte* in, word32 inLen, const mp_int* dm, *outLen = 256; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 64, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 64 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -28723,7 +28723,9 @@ int sp_ModExp_2048(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_2048_to_mp(r, res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -30506,7 +30508,9 @@ int sp_DhExp_2048(const mp_int* base, const byte* exp, word32 expLen, } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -30561,7 +30565,9 @@ int sp_ModExp_1024(const mp_int* base, const mp_int* exp, const mp_int* mod, mp_clamp(res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -81037,7 +81043,7 @@ int sp_RsaPrivate_3072(const byte* in, word32 inLen, const mp_int* dm, *outLen = 384; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 96, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 96 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -81234,7 +81240,9 @@ int sp_ModExp_3072(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -83815,7 +83823,9 @@ int sp_DhExp_3072(const mp_int* base, const byte* exp, word32 expLen, } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -83870,7 +83880,9 @@ int sp_ModExp_1536(const mp_int* base, const mp_int* exp, const mp_int* mod, mp_clamp(res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -93684,7 +93696,7 @@ int sp_RsaPrivate_4096(const byte* in, word32 inLen, const mp_int* dm, *outLen = 512; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 128, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 128 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -93881,7 +93893,9 @@ int sp_ModExp_4096(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_4096_to_mp(r, res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -97250,7 +97264,9 @@ int sp_DhExp_4096(const mp_int* base, const byte* exp, word32 expLen, } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -102774,7 +102790,7 @@ int sp_ecc_mulmod_256(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_256_point_to_ecc_point_8(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 8, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -102835,7 +102851,7 @@ int sp_ecc_mulmod_add_256(const mp_int* km, const ecc_point* gm, err = sp_256_point_to_ecc_point_8(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 8 + 8 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -104291,7 +104307,7 @@ int sp_ecc_mulmod_base_256(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_256_point_to_ecc_point_8(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 8, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -104350,7 +104366,7 @@ int sp_ecc_mulmod_base_add_256(const mp_int* km, const ecc_point* am, err = sp_256_point_to_ecc_point_8(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 8 + 8 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -104592,7 +104608,7 @@ int sp_ecc_make_key_256(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_256_point_to_ecc_point_8(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 8, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -104751,8 +104767,8 @@ int sp_ecc_secret_gen_256(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 32; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 8, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_256, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -108447,7 +108463,7 @@ int sp_ecc_check_key_256(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 8, heap, DYNAMIC_TYPE_ECC); return err; } @@ -113524,7 +113540,7 @@ int sp_ecc_mulmod_384(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_384_point_to_ecc_point_12(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 12, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -113585,7 +113601,7 @@ int sp_ecc_mulmod_add_384(const mp_int* km, const ecc_point* gm, err = sp_384_point_to_ecc_point_12(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 12 + 12 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -115041,7 +115057,7 @@ int sp_ecc_mulmod_base_384(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_384_point_to_ecc_point_12(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 12, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -115100,7 +115116,7 @@ int sp_ecc_mulmod_base_add_384(const mp_int* km, const ecc_point* am, err = sp_384_point_to_ecc_point_12(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 12 + 12 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -115378,7 +115394,7 @@ int sp_ecc_make_key_384(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_384_point_to_ecc_point_12(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 12, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -115537,8 +115553,8 @@ int sp_ecc_secret_gen_384(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 48; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 12, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_384, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -119498,7 +119514,7 @@ int sp_ecc_check_key_384(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 12, heap, DYNAMIC_TYPE_ECC); return err; } @@ -127071,7 +127087,7 @@ int sp_ecc_mulmod_521(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_521_point_to_ecc_point_17(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 17, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -127132,7 +127148,7 @@ int sp_ecc_mulmod_add_521(const mp_int* km, const ecc_point* gm, err = sp_521_point_to_ecc_point_17(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 17 + 17 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -129132,7 +129148,7 @@ int sp_ecc_mulmod_base_521(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_521_point_to_ecc_point_17(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 17, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -129191,7 +129207,7 @@ int sp_ecc_mulmod_base_add_521(const mp_int* km, const ecc_point* am, err = sp_521_point_to_ecc_point_17(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 17 + 17 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -129515,7 +129531,7 @@ int sp_ecc_make_key_521(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_521_point_to_ecc_point_17(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 17, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -129676,8 +129692,8 @@ int sp_ecc_secret_gen_521(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 66; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 17, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_521, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -136349,7 +136365,7 @@ int sp_ecc_check_key_521(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 17, heap, DYNAMIC_TYPE_ECC); return err; } @@ -211520,7 +211536,7 @@ int sp_ecc_mulmod_1024(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_1024_point_to_ecc_point_32(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 32, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -215144,7 +215160,7 @@ int sp_ecc_mulmod_base_1024(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_1024_point_to_ecc_point_32(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 32, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -215203,7 +215219,7 @@ int sp_ecc_mulmod_base_add_1024(const mp_int* km, const ecc_point* am, err = sp_1024_point_to_ecc_point_32(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 32 + 32 * 2 * 37, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -215334,7 +215350,7 @@ int sp_ecc_mulmod_table_1024(const mp_int* km, const ecc_point* gm, byte* table, } SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 32, heap, DYNAMIC_TYPE_ECC); return err; } @@ -218968,7 +218984,7 @@ int sp_ecc_check_key_1024(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 32, heap, DYNAMIC_TYPE_ECC); return err; } diff --git a/wolfcrypt/src/sp_c32.c b/wolfcrypt/src/sp_c32.c index 8352093aa7..a5380569f6 100644 --- a/wolfcrypt/src/sp_c32.c +++ b/wolfcrypt/src/sp_c32.c @@ -4286,7 +4286,7 @@ int sp_RsaPrivate_2048(const byte* in, word32 inLen, const mp_int* dm, *outLen = 256; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 72, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 72 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -4337,7 +4337,7 @@ int sp_RsaPrivate_2048(const byte* in, word32 inLen, const mp_int* dm, *outLen = 256; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 72, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 72 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #endif /* WOLFSSL_SP_SMALL */ @@ -4732,7 +4732,7 @@ int sp_ModExp_2048(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_2048_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 72U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 72 * 4, NULL, DYNAMIC_TYPE_DH); return err; #else @@ -4774,7 +4774,7 @@ int sp_ModExp_2048(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_2048_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 72U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 72 * 4, NULL, DYNAMIC_TYPE_DH); return err; #endif @@ -5220,7 +5220,7 @@ int sp_DhExp_2048(const mp_int* base, const byte* exp, word32 expLen, XMEMMOVE(out, out + i, *outLen); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 72U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 72 * 4, NULL, DYNAMIC_TYPE_DH); return err; } @@ -5387,7 +5387,7 @@ int sp_ModExp_1024(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_2048_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 72U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 36 * 4, NULL, DYNAMIC_TYPE_DH); return err; #else @@ -5430,7 +5430,7 @@ int sp_ModExp_1024(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_2048_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 72U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 36 * 4, NULL, DYNAMIC_TYPE_DH); return err; #endif @@ -8116,7 +8116,7 @@ int sp_RsaPrivate_3072(const byte* in, word32 inLen, const mp_int* dm, *outLen = 384; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 106, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 106 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -8167,7 +8167,7 @@ int sp_RsaPrivate_3072(const byte* in, word32 inLen, const mp_int* dm, *outLen = 384; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 106, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 106 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #endif /* WOLFSSL_SP_SMALL */ @@ -8562,7 +8562,7 @@ int sp_ModExp_3072(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 106U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 106 * 4, NULL, DYNAMIC_TYPE_DH); return err; #else @@ -8604,7 +8604,7 @@ int sp_ModExp_3072(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 106U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 106 * 4, NULL, DYNAMIC_TYPE_DH); return err; #endif @@ -8900,7 +8900,7 @@ int sp_DhExp_3072(const mp_int* base, const byte* exp, word32 expLen, XMEMMOVE(out, out + i, *outLen); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 106U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 106 * 4, NULL, DYNAMIC_TYPE_DH); return err; } @@ -9067,7 +9067,7 @@ int sp_ModExp_1536(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 106U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 53 * 4, NULL, DYNAMIC_TYPE_DH); return err; #else @@ -9110,7 +9110,7 @@ int sp_ModExp_1536(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 106U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 53 * 4, NULL, DYNAMIC_TYPE_DH); return err; #endif @@ -12494,7 +12494,7 @@ int sp_RsaPrivate_3072(const byte* in, word32 inLen, const mp_int* dm, *outLen = 384; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 112, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 112 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -12545,7 +12545,7 @@ int sp_RsaPrivate_3072(const byte* in, word32 inLen, const mp_int* dm, *outLen = 384; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 112, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 112 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #endif /* WOLFSSL_SP_SMALL */ @@ -12840,7 +12840,7 @@ int sp_ModExp_3072(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 112U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 112 * 4, NULL, DYNAMIC_TYPE_DH); return err; #else @@ -12882,7 +12882,7 @@ int sp_ModExp_3072(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 112U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 112 * 4, NULL, DYNAMIC_TYPE_DH); return err; #endif @@ -13309,7 +13309,7 @@ int sp_DhExp_3072(const mp_int* base, const byte* exp, word32 expLen, XMEMMOVE(out, out + i, *outLen); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 112U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 112 * 4, NULL, DYNAMIC_TYPE_DH); return err; } @@ -13369,7 +13369,7 @@ int sp_ModExp_1536(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 112U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 56 * 4, NULL, DYNAMIC_TYPE_DH); return err; #else @@ -13412,7 +13412,7 @@ int sp_ModExp_1536(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 112U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 56 * 4, NULL, DYNAMIC_TYPE_DH); return err; #endif @@ -16109,7 +16109,7 @@ int sp_RsaPrivate_4096(const byte* in, word32 inLen, const mp_int* dm, *outLen = 512; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 142, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 142 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -16160,7 +16160,7 @@ int sp_RsaPrivate_4096(const byte* in, word32 inLen, const mp_int* dm, *outLen = 512; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 142, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 142 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #endif /* WOLFSSL_SP_SMALL */ @@ -16555,7 +16555,7 @@ int sp_ModExp_4096(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_4096_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 142U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 142 * 4, NULL, DYNAMIC_TYPE_DH); return err; #else @@ -16597,7 +16597,7 @@ int sp_ModExp_4096(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_4096_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 142U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 142 * 4, NULL, DYNAMIC_TYPE_DH); return err; #endif @@ -16893,7 +16893,7 @@ int sp_DhExp_4096(const mp_int* base, const byte* exp, word32 expLen, XMEMMOVE(out, out + i, *outLen); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 142U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 142 * 4, NULL, DYNAMIC_TYPE_DH); return err; } @@ -20393,7 +20393,7 @@ int sp_RsaPrivate_4096(const byte* in, word32 inLen, const mp_int* dm, *outLen = 512; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 162, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 162 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -20444,7 +20444,7 @@ int sp_RsaPrivate_4096(const byte* in, word32 inLen, const mp_int* dm, *outLen = 512; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 162, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 162 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #endif /* WOLFSSL_SP_SMALL */ @@ -20739,7 +20739,7 @@ int sp_ModExp_4096(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_4096_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 162U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 162 * 4, NULL, DYNAMIC_TYPE_DH); return err; #else @@ -20781,7 +20781,7 @@ int sp_ModExp_4096(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_4096_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 162U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 162 * 4, NULL, DYNAMIC_TYPE_DH); return err; #endif @@ -21308,7 +21308,7 @@ int sp_DhExp_4096(const mp_int* base, const byte* exp, word32 expLen, XMEMMOVE(out, out + i, *outLen); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 162U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 162 * 4, NULL, DYNAMIC_TYPE_DH); return err; } @@ -24613,7 +24613,7 @@ int sp_ecc_mulmod_256(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_256_point_to_ecc_point_9(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -24674,7 +24674,7 @@ int sp_ecc_mulmod_add_256(const mp_int* km, const ecc_point* gm, err = sp_256_point_to_ecc_point_9(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9 + 9 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -26067,7 +26067,7 @@ int sp_ecc_mulmod_base_256(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_256_point_to_ecc_point_9(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -26126,7 +26126,7 @@ int sp_ecc_mulmod_base_add_256(const mp_int* km, const ecc_point* am, err = sp_256_point_to_ecc_point_9(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9 + 9 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -26280,7 +26280,7 @@ int sp_ecc_make_key_256(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_256_point_to_ecc_point_9(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -26467,8 +26467,8 @@ int sp_ecc_secret_gen_256(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 32; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_256, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -28013,7 +28013,7 @@ int sp_ecc_check_key_256(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 9, heap, DYNAMIC_TYPE_ECC); return err; } @@ -32034,7 +32034,7 @@ int sp_ecc_mulmod_384(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_384_point_to_ecc_point_15(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 15, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -32095,7 +32095,7 @@ int sp_ecc_mulmod_add_384(const mp_int* km, const ecc_point* gm, err = sp_384_point_to_ecc_point_15(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 15 + 15 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -34000,7 +34000,7 @@ int sp_ecc_mulmod_base_384(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_384_point_to_ecc_point_15(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 15, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -34059,7 +34059,7 @@ int sp_ecc_mulmod_base_add_384(const mp_int* km, const ecc_point* am, err = sp_384_point_to_ecc_point_15(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 15 + 15 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -34213,7 +34213,7 @@ int sp_ecc_make_key_384(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_384_point_to_ecc_point_15(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 15, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -34400,8 +34400,8 @@ int sp_ecc_secret_gen_384(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 48; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 15, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_384, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -35961,7 +35961,7 @@ int sp_ecc_check_key_384(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 15, heap, DYNAMIC_TYPE_ECC); return err; } @@ -39520,7 +39520,7 @@ int sp_ecc_mulmod_521(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_521_point_to_ecc_point_21(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 21, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -39581,7 +39581,7 @@ int sp_ecc_mulmod_add_521(const mp_int* km, const ecc_point* gm, err = sp_521_point_to_ecc_point_21(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 21 + 21 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -41996,7 +41996,7 @@ int sp_ecc_mulmod_base_521(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_521_point_to_ecc_point_21(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 21, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -42055,7 +42055,7 @@ int sp_ecc_mulmod_base_add_521(const mp_int* km, const ecc_point* am, err = sp_521_point_to_ecc_point_21(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 21 + 21 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -42210,7 +42210,7 @@ int sp_ecc_make_key_521(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_521_point_to_ecc_point_21(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 21, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -42397,8 +42397,8 @@ int sp_ecc_secret_gen_521(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 66; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 21, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_521, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -44018,7 +44018,7 @@ int sp_ecc_check_key_521(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 21, heap, DYNAMIC_TYPE_ECC); return err; } @@ -47997,7 +47997,7 @@ int sp_ecc_mulmod_1024(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_1024_point_to_ecc_point_42(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 42, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -51946,7 +51946,7 @@ int sp_ecc_mulmod_base_1024(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_1024_point_to_ecc_point_42(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 42, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -52005,7 +52005,7 @@ int sp_ecc_mulmod_base_add_1024(const mp_int* km, const ecc_point* am, err = sp_1024_point_to_ecc_point_42(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 42 + 42 * 2 * 37, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -52136,7 +52136,7 @@ int sp_ecc_mulmod_table_1024(const mp_int* km, const ecc_point* gm, byte* table, } SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 42, heap, DYNAMIC_TYPE_ECC); return err; } @@ -55758,7 +55758,7 @@ int sp_ecc_check_key_1024(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 42, heap, DYNAMIC_TYPE_ECC); return err; } diff --git a/wolfcrypt/src/sp_c64.c b/wolfcrypt/src/sp_c64.c index 147dc8ddad..ae960aab21 100644 --- a/wolfcrypt/src/sp_c64.c +++ b/wolfcrypt/src/sp_c64.c @@ -2881,7 +2881,7 @@ int sp_RsaPrivate_2048(const byte* in, word32 inLen, const mp_int* dm, *outLen = 256; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 34, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 34 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -2932,7 +2932,7 @@ int sp_RsaPrivate_2048(const byte* in, word32 inLen, const mp_int* dm, *outLen = 256; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 34, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 34 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #endif /* WOLFSSL_SP_SMALL */ @@ -3327,7 +3327,7 @@ int sp_ModExp_2048(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_2048_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 34U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 34 * 4, NULL, DYNAMIC_TYPE_DH); return err; #else @@ -3369,7 +3369,7 @@ int sp_ModExp_2048(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_2048_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 34U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 34 * 4, NULL, DYNAMIC_TYPE_DH); return err; #endif @@ -3666,7 +3666,7 @@ int sp_DhExp_2048(const mp_int* base, const byte* exp, word32 expLen, XMEMMOVE(out, out + i, *outLen); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 34U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 34 * 4, NULL, DYNAMIC_TYPE_DH); return err; } @@ -3833,7 +3833,7 @@ int sp_ModExp_1024(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_2048_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 34U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 17 * 4, NULL, DYNAMIC_TYPE_DH); return err; #else @@ -3876,7 +3876,7 @@ int sp_ModExp_1024(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_2048_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 34U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 17 * 4, NULL, DYNAMIC_TYPE_DH); return err; #endif @@ -6741,7 +6741,7 @@ int sp_RsaPrivate_2048(const byte* in, word32 inLen, const mp_int* dm, *outLen = 256; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 36, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 36 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -6792,7 +6792,7 @@ int sp_RsaPrivate_2048(const byte* in, word32 inLen, const mp_int* dm, *outLen = 256; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 36, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 36 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #endif /* WOLFSSL_SP_SMALL */ @@ -7087,7 +7087,7 @@ int sp_ModExp_2048(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_2048_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 36U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 36 * 4, NULL, DYNAMIC_TYPE_DH); return err; #else @@ -7129,7 +7129,7 @@ int sp_ModExp_2048(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_2048_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 36U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 36 * 4, NULL, DYNAMIC_TYPE_DH); return err; #endif @@ -7405,7 +7405,7 @@ int sp_DhExp_2048(const mp_int* base, const byte* exp, word32 expLen, XMEMMOVE(out, out + i, *outLen); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 36U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 36 * 4, NULL, DYNAMIC_TYPE_DH); return err; } @@ -7465,7 +7465,7 @@ int sp_ModExp_1024(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_2048_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 36U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 18 * 4, NULL, DYNAMIC_TYPE_DH); return err; #else @@ -7508,7 +7508,7 @@ int sp_ModExp_1024(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_2048_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 36U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 18 * 4, NULL, DYNAMIC_TYPE_DH); return err; #endif @@ -10099,7 +10099,7 @@ int sp_RsaPrivate_3072(const byte* in, word32 inLen, const mp_int* dm, *outLen = 384; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 52, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 52 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -10150,7 +10150,7 @@ int sp_RsaPrivate_3072(const byte* in, word32 inLen, const mp_int* dm, *outLen = 384; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 52, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 52 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #endif /* WOLFSSL_SP_SMALL */ @@ -10545,7 +10545,7 @@ int sp_ModExp_3072(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 52U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 52 * 4, NULL, DYNAMIC_TYPE_DH); return err; #else @@ -10587,7 +10587,7 @@ int sp_ModExp_3072(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 52U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 52 * 4, NULL, DYNAMIC_TYPE_DH); return err; #endif @@ -10884,7 +10884,7 @@ int sp_DhExp_3072(const mp_int* base, const byte* exp, word32 expLen, XMEMMOVE(out, out + i, *outLen); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 52U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 52 * 4, NULL, DYNAMIC_TYPE_DH); return err; } @@ -11051,7 +11051,7 @@ int sp_ModExp_1536(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 52U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 26 * 4, NULL, DYNAMIC_TYPE_DH); return err; #else @@ -11094,7 +11094,7 @@ int sp_ModExp_1536(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 52U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 26 * 4, NULL, DYNAMIC_TYPE_DH); return err; #endif @@ -14108,7 +14108,7 @@ int sp_RsaPrivate_3072(const byte* in, word32 inLen, const mp_int* dm, *outLen = 384; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 54, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 54 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -14159,7 +14159,7 @@ int sp_RsaPrivate_3072(const byte* in, word32 inLen, const mp_int* dm, *outLen = 384; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 54, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 54 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #endif /* WOLFSSL_SP_SMALL */ @@ -14454,7 +14454,7 @@ int sp_ModExp_3072(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 54U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 54 * 4, NULL, DYNAMIC_TYPE_DH); return err; #else @@ -14496,7 +14496,7 @@ int sp_ModExp_3072(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 54U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 54 * 4, NULL, DYNAMIC_TYPE_DH); return err; #endif @@ -14808,7 +14808,7 @@ int sp_DhExp_3072(const mp_int* base, const byte* exp, word32 expLen, XMEMMOVE(out, out + i, *outLen); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 54U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 54 * 4, NULL, DYNAMIC_TYPE_DH); return err; } @@ -14868,7 +14868,7 @@ int sp_ModExp_1536(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 54U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 27 * 4, NULL, DYNAMIC_TYPE_DH); return err; #else @@ -14911,7 +14911,7 @@ int sp_ModExp_1536(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 54U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 27 * 4, NULL, DYNAMIC_TYPE_DH); return err; #endif @@ -17503,7 +17503,7 @@ int sp_RsaPrivate_4096(const byte* in, word32 inLen, const mp_int* dm, *outLen = 512; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 70, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 70 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -17554,7 +17554,7 @@ int sp_RsaPrivate_4096(const byte* in, word32 inLen, const mp_int* dm, *outLen = 512; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 70, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 70 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #endif /* WOLFSSL_SP_SMALL */ @@ -17949,7 +17949,7 @@ int sp_ModExp_4096(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_4096_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 70U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 70 * 4, NULL, DYNAMIC_TYPE_DH); return err; #else @@ -17991,7 +17991,7 @@ int sp_ModExp_4096(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_4096_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 70U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 70 * 4, NULL, DYNAMIC_TYPE_DH); return err; #endif @@ -18288,7 +18288,7 @@ int sp_DhExp_4096(const mp_int* base, const byte* exp, word32 expLen, XMEMMOVE(out, out + i, *outLen); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 70U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 70 * 4, NULL, DYNAMIC_TYPE_DH); return err; } @@ -21611,7 +21611,7 @@ int sp_RsaPrivate_4096(const byte* in, word32 inLen, const mp_int* dm, *outLen = 512; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 78, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 78 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -21662,7 +21662,7 @@ int sp_RsaPrivate_4096(const byte* in, word32 inLen, const mp_int* dm, *outLen = 512; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 78, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 78 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #endif /* WOLFSSL_SP_SMALL */ @@ -21957,7 +21957,7 @@ int sp_ModExp_4096(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_4096_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 78U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 78 * 4, NULL, DYNAMIC_TYPE_DH); return err; #else @@ -21999,7 +21999,7 @@ int sp_ModExp_4096(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_4096_to_mp(r, res); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 78U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 78 * 4, NULL, DYNAMIC_TYPE_DH); return err; #endif @@ -22359,7 +22359,7 @@ int sp_DhExp_4096(const mp_int* base, const byte* exp, word32 expLen, XMEMMOVE(out, out + i, *outLen); } - SP_ZEROFREE_VAR_ALT(sp_digit, b, e, 78U, NULL, DYNAMIC_TYPE_DH); + SP_ZEROFREE_VAR(sp_digit, b, 78 * 4, NULL, DYNAMIC_TYPE_DH); return err; } @@ -25411,7 +25411,7 @@ int sp_ecc_mulmod_256(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_256_point_to_ecc_point_5(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 5, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -25472,7 +25472,7 @@ int sp_ecc_mulmod_add_256(const mp_int* km, const ecc_point* gm, err = sp_256_point_to_ecc_point_5(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 5 + 5 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -26865,7 +26865,7 @@ int sp_ecc_mulmod_base_256(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_256_point_to_ecc_point_5(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 5, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -26924,7 +26924,7 @@ int sp_ecc_mulmod_base_add_256(const mp_int* km, const ecc_point* am, err = sp_256_point_to_ecc_point_5(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 5 + 5 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -27078,7 +27078,7 @@ int sp_ecc_make_key_256(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_256_point_to_ecc_point_5(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 5, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -27265,8 +27265,8 @@ int sp_ecc_secret_gen_256(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 32; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 5, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_256, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -28796,7 +28796,7 @@ int sp_ecc_check_key_256(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 5, heap, DYNAMIC_TYPE_ECC); return err; } @@ -32257,7 +32257,7 @@ int sp_ecc_mulmod_384(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_384_point_to_ecc_point_7(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 7, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -32318,7 +32318,7 @@ int sp_ecc_mulmod_add_384(const mp_int* km, const ecc_point* gm, err = sp_384_point_to_ecc_point_7(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 7 + 7 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -34221,7 +34221,7 @@ int sp_ecc_mulmod_base_384(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_384_point_to_ecc_point_7(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 7, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -34280,7 +34280,7 @@ int sp_ecc_mulmod_base_add_384(const mp_int* km, const ecc_point* am, err = sp_384_point_to_ecc_point_7(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 7 + 7 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -34434,7 +34434,7 @@ int sp_ecc_make_key_384(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_384_point_to_ecc_point_7(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 7, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -34621,8 +34621,8 @@ int sp_ecc_secret_gen_384(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 48; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 7, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_384, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -36131,7 +36131,7 @@ int sp_ecc_check_key_384(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 7, heap, DYNAMIC_TYPE_ECC); return err; } @@ -39581,7 +39581,7 @@ int sp_ecc_mulmod_521(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_521_point_to_ecc_point_9(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -39642,7 +39642,7 @@ int sp_ecc_mulmod_add_521(const mp_int* km, const ecc_point* gm, err = sp_521_point_to_ecc_point_9(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9 + 9 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -41545,7 +41545,7 @@ int sp_ecc_mulmod_base_521(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_521_point_to_ecc_point_9(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -41604,7 +41604,7 @@ int sp_ecc_mulmod_base_add_521(const mp_int* km, const ecc_point* am, err = sp_521_point_to_ecc_point_9(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9 + 9 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -41759,7 +41759,7 @@ int sp_ecc_make_key_521(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_521_point_to_ecc_point_9(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -41946,8 +41946,8 @@ int sp_ecc_secret_gen_521(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 66; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_521, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -43498,7 +43498,7 @@ int sp_ecc_check_key_521(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 9, heap, DYNAMIC_TYPE_ECC); return err; } @@ -47240,7 +47240,7 @@ int sp_ecc_mulmod_1024(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_1024_point_to_ecc_point_18(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 18, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -50675,7 +50675,7 @@ int sp_ecc_mulmod_base_1024(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_1024_point_to_ecc_point_18(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 18, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -50734,7 +50734,7 @@ int sp_ecc_mulmod_base_add_1024(const mp_int* km, const ecc_point* am, err = sp_1024_point_to_ecc_point_18(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 18 + 18 * 2 * 37, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -50865,7 +50865,7 @@ int sp_ecc_mulmod_table_1024(const mp_int* km, const ecc_point* gm, byte* table, } SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 18, heap, DYNAMIC_TYPE_ECC); return err; } @@ -54231,7 +54231,7 @@ int sp_ecc_check_key_1024(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 18, heap, DYNAMIC_TYPE_ECC); return err; } diff --git a/wolfcrypt/src/sp_cortexm.c b/wolfcrypt/src/sp_cortexm.c index 8f8ca66052..f9342ec2eb 100644 --- a/wolfcrypt/src/sp_cortexm.c +++ b/wolfcrypt/src/sp_cortexm.c @@ -9705,7 +9705,7 @@ int sp_RsaPrivate_2048(const byte* in, word32 inLen, const mp_int* dm, *outLen = 256; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 64, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 64 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -9902,7 +9902,9 @@ int sp_ModExp_2048(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_2048_to_mp(r, res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -10503,7 +10505,9 @@ int sp_DhExp_2048(const mp_int* base, const byte* exp, word32 expLen, } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -10558,7 +10562,9 @@ int sp_ModExp_1024(const mp_int* base, const mp_int* exp, const mp_int* mod, mp_clamp(res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -22882,7 +22888,7 @@ int sp_RsaPrivate_3072(const byte* in, word32 inLen, const mp_int* dm, *outLen = 384; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 96, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 96 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -23079,7 +23085,9 @@ int sp_ModExp_3072(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -23872,7 +23880,9 @@ int sp_DhExp_3072(const mp_int* base, const byte* exp, word32 expLen, } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -23927,7 +23937,9 @@ int sp_ModExp_1536(const mp_int* base, const mp_int* exp, const mp_int* mod, mp_clamp(res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -31559,7 +31571,7 @@ int sp_RsaPrivate_4096(const byte* in, word32 inLen, const mp_int* dm, *outLen = 512; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 128, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 128 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -31756,7 +31768,9 @@ int sp_ModExp_4096(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_4096_to_mp(r, res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -32741,7 +32755,9 @@ int sp_DhExp_4096(const mp_int* base, const byte* exp, word32 expLen, } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -39262,7 +39278,7 @@ int sp_ecc_mulmod_256(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_256_point_to_ecc_point_8(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 8, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -39323,7 +39339,7 @@ int sp_ecc_mulmod_add_256(const mp_int* km, const ecc_point* gm, err = sp_256_point_to_ecc_point_8(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 8 + 8 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -40779,7 +40795,7 @@ int sp_ecc_mulmod_base_256(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_256_point_to_ecc_point_8(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 8, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -40838,7 +40854,7 @@ int sp_ecc_mulmod_base_add_256(const mp_int* km, const ecc_point* am, err = sp_256_point_to_ecc_point_8(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 8 + 8 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -41032,7 +41048,7 @@ int sp_ecc_make_key_256(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_256_point_to_ecc_point_8(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 8, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -41191,8 +41207,8 @@ int sp_ecc_secret_gen_256(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 32; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 8, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_256, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -43440,7 +43456,7 @@ int sp_ecc_check_key_256(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 8, heap, DYNAMIC_TYPE_ECC); return err; } @@ -49650,7 +49666,7 @@ int sp_ecc_mulmod_384(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_384_point_to_ecc_point_12(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 12, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -49711,7 +49727,7 @@ int sp_ecc_mulmod_add_384(const mp_int* km, const ecc_point* gm, err = sp_384_point_to_ecc_point_12(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 12 + 12 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -51167,7 +51183,7 @@ int sp_ecc_mulmod_base_384(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_384_point_to_ecc_point_12(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 12, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -51226,7 +51242,7 @@ int sp_ecc_mulmod_base_add_384(const mp_int* km, const ecc_point* am, err = sp_384_point_to_ecc_point_12(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 12 + 12 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -51426,7 +51442,7 @@ int sp_ecc_make_key_384(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_384_point_to_ecc_point_12(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 12, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -51585,8 +51601,8 @@ int sp_ecc_secret_gen_384(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 48; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 12, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_384, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -53805,7 +53821,7 @@ int sp_ecc_check_key_384(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 12, heap, DYNAMIC_TYPE_ECC); return err; } @@ -61927,7 +61943,7 @@ int sp_ecc_mulmod_521(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_521_point_to_ecc_point_17(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 17, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -61988,7 +62004,7 @@ int sp_ecc_mulmod_add_521(const mp_int* km, const ecc_point* gm, err = sp_521_point_to_ecc_point_17(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 17 + 17 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -63988,7 +64004,7 @@ int sp_ecc_mulmod_base_521(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_521_point_to_ecc_point_17(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 17, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -64047,7 +64063,7 @@ int sp_ecc_mulmod_base_add_521(const mp_int* km, const ecc_point* am, err = sp_521_point_to_ecc_point_17(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 17 + 17 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -64257,7 +64273,7 @@ int sp_ecc_make_key_521(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_521_point_to_ecc_point_17(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 17, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -64418,8 +64434,8 @@ int sp_ecc_secret_gen_521(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 66; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 17, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_521, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -67500,7 +67516,7 @@ int sp_ecc_check_key_521(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 17, heap, DYNAMIC_TYPE_ECC); return err; } @@ -76592,7 +76608,7 @@ int sp_ecc_mulmod_1024(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_1024_point_to_ecc_point_32(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 32, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -80216,7 +80232,7 @@ int sp_ecc_mulmod_base_1024(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_1024_point_to_ecc_point_32(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 32, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -80275,7 +80291,7 @@ int sp_ecc_mulmod_base_add_1024(const mp_int* km, const ecc_point* am, err = sp_1024_point_to_ecc_point_32(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 32 + 32 * 2 * 37, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -80406,7 +80422,7 @@ int sp_ecc_mulmod_table_1024(const mp_int* km, const ecc_point* gm, byte* table, } SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 32, heap, DYNAMIC_TYPE_ECC); return err; } @@ -84040,7 +84056,7 @@ int sp_ecc_check_key_1024(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 32, heap, DYNAMIC_TYPE_ECC); return err; } diff --git a/wolfcrypt/src/sp_riscv64.c b/wolfcrypt/src/sp_riscv64.c index 1f9309b079..1045472f14 100644 --- a/wolfcrypt/src/sp_riscv64.c +++ b/wolfcrypt/src/sp_riscv64.c @@ -15895,7 +15895,7 @@ int sp_RsaPrivate_2048(const byte* in, word32 inLen, const mp_int* dm, *outLen = 256; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 32, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 32 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -16092,7 +16092,9 @@ int sp_ModExp_2048(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_2048_to_mp(r, res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -16518,7 +16520,9 @@ int sp_DhExp_2048(const mp_int* base, const byte* exp, word32 expLen, } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -16573,7 +16577,9 @@ int sp_ModExp_1024(const mp_int* base, const mp_int* exp, const mp_int* mod, mp_clamp(res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -28169,7 +28175,7 @@ int sp_RsaPrivate_3072(const byte* in, word32 inLen, const mp_int* dm, *outLen = 384; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 48, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 48 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -28366,7 +28372,9 @@ int sp_ModExp_3072(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -28904,7 +28912,9 @@ int sp_DhExp_3072(const mp_int* base, const byte* exp, word32 expLen, } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -28959,7 +28969,9 @@ int sp_ModExp_1536(const mp_int* base, const mp_int* exp, const mp_int* mod, mp_clamp(res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -35918,7 +35930,7 @@ int sp_RsaPrivate_4096(const byte* in, word32 inLen, const mp_int* dm, *outLen = 512; } - SP_ZEROFREE_VAR_ALT(sp_digit, d, a, 64, NULL, DYNAMIC_TYPE_RSA); + SP_ZEROFREE_VAR(sp_digit, d, 64 * 4, NULL, DYNAMIC_TYPE_RSA); return err; #else @@ -36115,7 +36127,9 @@ int sp_ModExp_4096(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_4096_to_mp(r, res); } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -36765,7 +36779,9 @@ int sp_DhExp_4096(const mp_int* base, const byte* exp, word32 expLen, } - XMEMSET(e, 0, sizeof(e)); + ForceZero(e, sizeof(e)); + ForceZero(b, sizeof(b)); + ForceZero(m, sizeof(m)); return err; } @@ -41134,7 +41150,7 @@ int sp_ecc_mulmod_256(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_256_point_to_ecc_point_4(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 4, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -41195,7 +41211,7 @@ int sp_ecc_mulmod_add_256(const mp_int* km, const ecc_point* gm, err = sp_256_point_to_ecc_point_4(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 4 + 4 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -42651,7 +42667,7 @@ int sp_ecc_mulmod_base_256(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_256_point_to_ecc_point_4(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 4, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -42710,7 +42726,7 @@ int sp_ecc_mulmod_base_add_256(const mp_int* km, const ecc_point* am, err = sp_256_point_to_ecc_point_4(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 4 + 4 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -42908,7 +42924,7 @@ int sp_ecc_make_key_256(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_256_point_to_ecc_point_4(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 4, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -43071,8 +43087,8 @@ int sp_ecc_secret_gen_256(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 32; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 4, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_256, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -44649,7 +44665,7 @@ int sp_ecc_check_key_256(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 4, heap, DYNAMIC_TYPE_ECC); return err; } @@ -51269,7 +51285,7 @@ int sp_ecc_mulmod_384(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_384_point_to_ecc_point_6(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -51330,7 +51346,7 @@ int sp_ecc_mulmod_add_384(const mp_int* km, const ecc_point* gm, err = sp_384_point_to_ecc_point_6(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 6 + 6 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -52786,7 +52802,7 @@ int sp_ecc_mulmod_base_384(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_384_point_to_ecc_point_6(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -52845,7 +52861,7 @@ int sp_ecc_mulmod_base_add_384(const mp_int* km, const ecc_point* am, err = sp_384_point_to_ecc_point_6(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 6 + 6 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -53051,7 +53067,7 @@ int sp_ecc_make_key_384(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_384_point_to_ecc_point_6(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 6, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -53214,8 +53230,8 @@ int sp_ecc_secret_gen_384(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 48; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 6, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_384, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -54795,7 +54811,7 @@ int sp_ecc_check_key_384(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 6, heap, DYNAMIC_TYPE_ECC); return err; } @@ -61374,7 +61390,7 @@ int sp_ecc_mulmod_521(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_521_point_to_ecc_point_9(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -61435,7 +61451,7 @@ int sp_ecc_mulmod_add_521(const mp_int* km, const ecc_point* gm, err = sp_521_point_to_ecc_point_9(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9 + 9 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -63431,7 +63447,7 @@ int sp_ecc_mulmod_base_521(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_521_point_to_ecc_point_9(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -63490,7 +63506,7 @@ int sp_ecc_mulmod_base_add_521(const mp_int* km, const ecc_point* am, err = sp_521_point_to_ecc_point_9(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9 + 9 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -63709,7 +63725,7 @@ int sp_ecc_make_key_521(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_521_point_to_ecc_point_9(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -63874,8 +63890,8 @@ int sp_ecc_secret_gen_521(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 66; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_521, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -65207,7 +65223,7 @@ int sp_ecc_check_key_521(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 9, heap, DYNAMIC_TYPE_ECC); return err; } @@ -75757,7 +75773,7 @@ int sp_ecc_mulmod_1024(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_1024_point_to_ecc_point_16(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 16, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -79377,7 +79393,7 @@ int sp_ecc_mulmod_base_1024(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_1024_point_to_ecc_point_16(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 16, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -79436,7 +79452,7 @@ int sp_ecc_mulmod_base_add_1024(const mp_int* km, const ecc_point* am, err = sp_1024_point_to_ecc_point_16(point, r); } - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 16 + 16 * 2 * 37, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -79567,7 +79583,7 @@ int sp_ecc_mulmod_table_1024(const mp_int* km, const ecc_point* gm, byte* table, } SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 16, heap, DYNAMIC_TYPE_ECC); return err; } @@ -82957,7 +82973,7 @@ int sp_ecc_check_key_1024(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 16, heap, DYNAMIC_TYPE_ECC); return err; } diff --git a/wolfcrypt/src/sp_x86_64.c b/wolfcrypt/src/sp_x86_64.c index ca0abb541e..fd715929db 100644 --- a/wolfcrypt/src/sp_x86_64.c +++ b/wolfcrypt/src/sp_x86_64.c @@ -2287,8 +2287,8 @@ int sp_RsaPrivate_2048(const byte* in, word32 inLen, const mp_int* dm, *outLen = 256; } - /* only zeroing private "d" */ - SP_ZEROFREE_VAR(sp_digit, d, 32, NULL, DYNAMIC_TYPE_RSA); + /* zero the whole work buffer: d, a/r and m */ + SP_ZEROFREE_VAR(sp_digit, d, 32 * 4, NULL, DYNAMIC_TYPE_RSA); return err; } @@ -2586,9 +2586,9 @@ int sp_ModExp_2048(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_2048_to_mp(r, res); } - SP_FREE_VAR(m, NULL, DYNAMIC_TYPE_TMP_BUFFER); + SP_ZEROFREE_VAR(sp_digit, m, 32, NULL, DYNAMIC_TYPE_TMP_BUFFER); SP_ZEROFREE_VAR(sp_digit, e, 32, NULL, DYNAMIC_TYPE_TMP_BUFFER); - SP_FREE_VAR(b, NULL, DYNAMIC_TYPE_TMP_BUFFER); + SP_ZEROFREE_VAR(sp_digit, b, 64, NULL, DYNAMIC_TYPE_TMP_BUFFER); return err; } @@ -2932,9 +2932,9 @@ int sp_DhExp_2048(const mp_int* base, const byte* exp, word32 expLen, XMEMMOVE(out, out + i, *outLen); } - SP_FREE_VAR(m, NULL, DYNAMIC_TYPE_TMP_BUFFER); + SP_ZEROFREE_VAR(sp_digit, m, 32, NULL, DYNAMIC_TYPE_TMP_BUFFER); SP_ZEROFREE_VAR(sp_digit, e, 32, NULL, DYNAMIC_TYPE_TMP_BUFFER); - SP_FREE_VAR(b, NULL, DYNAMIC_TYPE_TMP_BUFFER); + SP_ZEROFREE_VAR(sp_digit, b, 64, NULL, DYNAMIC_TYPE_TMP_BUFFER); return err; } @@ -3002,9 +3002,9 @@ int sp_ModExp_1024(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_2048_to_mp(r, res); } - SP_FREE_VAR(m, NULL, DYNAMIC_TYPE_TMP_BUFFER); + SP_ZEROFREE_VAR(sp_digit, m, 16, NULL, DYNAMIC_TYPE_TMP_BUFFER); SP_ZEROFREE_VAR(sp_digit, e, 16, NULL, DYNAMIC_TYPE_TMP_BUFFER); - SP_FREE_VAR(b, NULL, DYNAMIC_TYPE_TMP_BUFFER); + SP_ZEROFREE_VAR(sp_digit, b, 32, NULL, DYNAMIC_TYPE_TMP_BUFFER); return err; } @@ -5071,8 +5071,8 @@ int sp_RsaPrivate_3072(const byte* in, word32 inLen, const mp_int* dm, *outLen = 384; } - /* only zeroing private "d" */ - SP_ZEROFREE_VAR(sp_digit, d, 48, NULL, DYNAMIC_TYPE_RSA); + /* zero the whole work buffer: d, a/r and m */ + SP_ZEROFREE_VAR(sp_digit, d, 48 * 4, NULL, DYNAMIC_TYPE_RSA); return err; } @@ -5370,9 +5370,9 @@ int sp_ModExp_3072(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - SP_FREE_VAR(m, NULL, DYNAMIC_TYPE_TMP_BUFFER); + SP_ZEROFREE_VAR(sp_digit, m, 48, NULL, DYNAMIC_TYPE_TMP_BUFFER); SP_ZEROFREE_VAR(sp_digit, e, 48, NULL, DYNAMIC_TYPE_TMP_BUFFER); - SP_FREE_VAR(b, NULL, DYNAMIC_TYPE_TMP_BUFFER); + SP_ZEROFREE_VAR(sp_digit, b, 96, NULL, DYNAMIC_TYPE_TMP_BUFFER); return err; } @@ -5716,9 +5716,9 @@ int sp_DhExp_3072(const mp_int* base, const byte* exp, word32 expLen, XMEMMOVE(out, out + i, *outLen); } - SP_FREE_VAR(m, NULL, DYNAMIC_TYPE_TMP_BUFFER); + SP_ZEROFREE_VAR(sp_digit, m, 48, NULL, DYNAMIC_TYPE_TMP_BUFFER); SP_ZEROFREE_VAR(sp_digit, e, 48, NULL, DYNAMIC_TYPE_TMP_BUFFER); - SP_FREE_VAR(b, NULL, DYNAMIC_TYPE_TMP_BUFFER); + SP_ZEROFREE_VAR(sp_digit, b, 96, NULL, DYNAMIC_TYPE_TMP_BUFFER); return err; } @@ -5786,9 +5786,9 @@ int sp_ModExp_1536(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_3072_to_mp(r, res); } - SP_FREE_VAR(m, NULL, DYNAMIC_TYPE_TMP_BUFFER); + SP_ZEROFREE_VAR(sp_digit, m, 24, NULL, DYNAMIC_TYPE_TMP_BUFFER); SP_ZEROFREE_VAR(sp_digit, e, 24, NULL, DYNAMIC_TYPE_TMP_BUFFER); - SP_FREE_VAR(b, NULL, DYNAMIC_TYPE_TMP_BUFFER); + SP_ZEROFREE_VAR(sp_digit, b, 48, NULL, DYNAMIC_TYPE_TMP_BUFFER); return err; } @@ -7082,8 +7082,8 @@ int sp_RsaPrivate_4096(const byte* in, word32 inLen, const mp_int* dm, *outLen = 512; } - /* only zeroing private "d" */ - SP_ZEROFREE_VAR(sp_digit, d, 64, NULL, DYNAMIC_TYPE_RSA); + /* zero the whole work buffer: d, a/r and m */ + SP_ZEROFREE_VAR(sp_digit, d, 64 * 4, NULL, DYNAMIC_TYPE_RSA); return err; } @@ -7381,9 +7381,9 @@ int sp_ModExp_4096(const mp_int* base, const mp_int* exp, const mp_int* mod, err = sp_4096_to_mp(r, res); } - SP_FREE_VAR(m, NULL, DYNAMIC_TYPE_TMP_BUFFER); + SP_ZEROFREE_VAR(sp_digit, m, 64, NULL, DYNAMIC_TYPE_TMP_BUFFER); SP_ZEROFREE_VAR(sp_digit, e, 64, NULL, DYNAMIC_TYPE_TMP_BUFFER); - SP_FREE_VAR(b, NULL, DYNAMIC_TYPE_TMP_BUFFER); + SP_ZEROFREE_VAR(sp_digit, b, 128, NULL, DYNAMIC_TYPE_TMP_BUFFER); return err; } @@ -7727,9 +7727,9 @@ int sp_DhExp_4096(const mp_int* base, const byte* exp, word32 expLen, XMEMMOVE(out, out + i, *outLen); } - SP_FREE_VAR(m, NULL, DYNAMIC_TYPE_TMP_BUFFER); + SP_ZEROFREE_VAR(sp_digit, m, 64, NULL, DYNAMIC_TYPE_TMP_BUFFER); SP_ZEROFREE_VAR(sp_digit, e, 64, NULL, DYNAMIC_TYPE_TMP_BUFFER); - SP_FREE_VAR(b, NULL, DYNAMIC_TYPE_TMP_BUFFER); + SP_ZEROFREE_VAR(sp_digit, b, 128, NULL, DYNAMIC_TYPE_TMP_BUFFER); return err; } @@ -11277,7 +11277,7 @@ int sp_ecc_mulmod_256(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_256_point_to_ecc_point_4(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 4, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -11365,7 +11365,7 @@ int sp_ecc_mulmod_add_256(const mp_int* km, const ecc_point* gm, RESTORE_VECTOR_REGISTERS(); #endif - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 4 + 4 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -24049,7 +24049,7 @@ int sp_ecc_mulmod_base_256(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_256_point_to_ecc_point_4(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 4, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -24135,7 +24135,7 @@ int sp_ecc_mulmod_base_add_256(const mp_int* km, const ecc_point* am, RESTORE_VECTOR_REGISTERS(); #endif - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 4 + 4 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -24312,7 +24312,7 @@ int sp_ecc_make_key_256(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_256_point_to_ecc_point_4(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 4, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -24498,8 +24498,8 @@ int sp_ecc_secret_gen_256(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 32; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 4, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_256, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -26289,7 +26289,7 @@ int sp_ecc_check_key_256(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 4, heap, DYNAMIC_TYPE_ECC); return err; } @@ -30311,7 +30311,7 @@ int sp_ecc_mulmod_384(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_384_point_to_ecc_point_6(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -30399,7 +30399,7 @@ int sp_ecc_mulmod_add_384(const mp_int* km, const ecc_point* gm, RESTORE_VECTOR_REGISTERS(); #endif - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 6 + 6 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -48897,7 +48897,7 @@ int sp_ecc_mulmod_base_384(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_384_point_to_ecc_point_6(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -48983,7 +48983,7 @@ int sp_ecc_mulmod_base_add_384(const mp_int* km, const ecc_point* am, RESTORE_VECTOR_REGISTERS(); #endif - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 6 + 6 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -49160,7 +49160,7 @@ int sp_ecc_make_key_384(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_384_point_to_ecc_point_6(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 6, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -49346,8 +49346,8 @@ int sp_ecc_secret_gen_384(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 48; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 6, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_384, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -51105,7 +51105,7 @@ int sp_ecc_check_key_384(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 6, heap, DYNAMIC_TYPE_ECC); return err; } @@ -55072,7 +55072,7 @@ int sp_ecc_mulmod_521(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_521_point_to_ecc_point_9(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -55160,7 +55160,7 @@ int sp_ecc_mulmod_add_521(const mp_int* km, const ecc_point* gm, RESTORE_VECTOR_REGISTERS(); #endif - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9 + 9 * 2 * 6, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -89844,7 +89844,7 @@ int sp_ecc_mulmod_base_521(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_521_point_to_ecc_point_9(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -89930,7 +89930,7 @@ int sp_ecc_mulmod_base_add_521(const mp_int* km, const ecc_point* am, RESTORE_VECTOR_REGISTERS(); #endif - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9 + 9 * 2 * 6, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -90108,7 +90108,7 @@ int sp_ecc_make_key_521(WC_RNG* rng, mp_int* priv, ecc_point* pub, void* heap) err = sp_521_point_to_ecc_point_9(point, pub); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); /* point is not sensitive, so no need to zeroize */ SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); @@ -90294,8 +90294,8 @@ int sp_ecc_secret_gen_521(const mp_int* priv, const ecc_point* pub, byte* out, *outLen = 66; } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 9, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_point_521, point, 1, heap, DYNAMIC_TYPE_ECC); return err; } @@ -92126,7 +92126,7 @@ int sp_ecc_check_key_521(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 9, heap, DYNAMIC_TYPE_ECC); return err; } @@ -96140,7 +96140,7 @@ int sp_ecc_mulmod_1024(const mp_int* km, const ecc_point* gm, ecc_point* r, err = sp_1024_point_to_ecc_point_16(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 16, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -99562,7 +99562,7 @@ int sp_ecc_mulmod_base_1024(const mp_int* km, ecc_point* r, int map, void* heap) err = sp_1024_point_to_ecc_point_16(point, r); } - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 16, heap, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); return err; @@ -99648,7 +99648,7 @@ int sp_ecc_mulmod_base_add_1024(const mp_int* km, const ecc_point* am, RESTORE_VECTOR_REGISTERS(); #endif - SP_FREE_VAR(k, NULL, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 16 + 16 * 2 * 37, NULL, DYNAMIC_TYPE_ECC); SP_FREE_VAR(point, NULL, DYNAMIC_TYPE_ECC); return err; @@ -99803,7 +99803,7 @@ int sp_ecc_mulmod_table_1024(const mp_int* km, const ecc_point* gm, byte* table, } SP_FREE_VAR(point, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(k, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, k, 16, heap, DYNAMIC_TYPE_ECC); return err; } @@ -104894,7 +104894,7 @@ int sp_ecc_check_key_1024(const mp_int* pX, const mp_int* pY, } SP_FREE_VAR(pub, heap, DYNAMIC_TYPE_ECC); - SP_FREE_VAR(priv, heap, DYNAMIC_TYPE_ECC); + SP_ZEROFREE_VAR(sp_digit, priv, 16, heap, DYNAMIC_TYPE_ECC); return err; } diff --git a/wolfcrypt/src/wc_lms_impl.c b/wolfcrypt/src/wc_lms_impl.c index 5f05494a08..21d870faca 100644 --- a/wolfcrypt/src/wc_lms_impl.c +++ b/wolfcrypt/src/wc_lms_impl.c @@ -481,6 +481,8 @@ static WC_INLINE int wc_lms_sha256_192_hash_block(wc_Sha256* sha256, if (ret == 0) { XMEMCPY(hash, output, WC_SHA256_192_DIGEST_SIZE); } + /* Prefix is x_q[i] or a child SEED (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(output, sizeof(output)); return ret; } @@ -544,6 +546,8 @@ static WC_INLINE int wc_lms_hash_sha256_192(wc_Sha256* sha256, byte* data, } } #endif /* !WC_LMS_FULL_HASH */ + /* Prefix is x_q[i] or a child SEED (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(output, sizeof(output)); return ret; } @@ -588,6 +592,8 @@ static WC_INLINE int wc_lms_hash_sha256_192_final(wc_Sha256* sha256, byte* hash) sha256->hiLen = 0; sha256->loLen = 0; } + /* Prefix is x_q[i] or a child SEED (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(output, sizeof(output)); return ret; #else @@ -598,6 +604,8 @@ static WC_INLINE int wc_lms_hash_sha256_192_final(wc_Sha256* sha256, byte* hash) if (ret == 0) { XMEMCPY(hash, output, WC_SHA256_192_DIGEST_SIZE); } + /* Prefix is x_q[i] or a child SEED (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(output, sizeof(output)); return ret; #endif @@ -3054,6 +3062,8 @@ static int wc_hss_derive_seed_i(LmsState* state, const byte* id, /* Copy part of hash as new I into private key. */ XMEMCPY(seed_i, tmp, LMS_I_LEN); } + /* buffer held the parent SEED (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(buffer, sizeof(buffer)); return ret; } diff --git a/wolfcrypt/src/wc_mldsa.c b/wolfcrypt/src/wc_mldsa.c index fba0512064..3bad36fdc9 100644 --- a/wolfcrypt/src/wc_mldsa.c +++ b/wolfcrypt/src/wc_mldsa.c @@ -9617,6 +9617,10 @@ static int mldsa_sign_with_seed_mu(wc_MlDsaKey* key, } /* Step 11: Check we have a valid signature. */ while ((ret == 0) && (!valid)); + if (ret != 0) { + /* sig holds a rejected candidate (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(sig, params->sigSz); + } } if (ret == 0) { byte* ze = sig + params->lambda / 4; @@ -10198,6 +10202,10 @@ static int mldsa_sign_with_seed_mu(wc_MlDsaKey* key, } /* Step 11: Check we have a valid signature. */ while ((ret == 0) && (!valid)); + if (ret != 0) { + /* sig holds a rejected candidate (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(sig, params->sigSz); + } } ForceZero(priv_rand_seed, sizeof(priv_rand_seed)); @@ -12337,6 +12345,12 @@ int wc_MlDsaKey_SetParams(wc_MlDsaKey* key, byte level) } #endif +#if !defined(WOLFSSL_MLDSA_DYNAMIC_KEYS) && \ + !defined(WOLFSSL_MLDSA_ASSIGN_KEY) && !defined(WOLFSSL_MLDSA_VERIFY_ONLY) + if (key->prvKeySet) { + ForceZero(key->k, sizeof(key->k)); + } +#endif /* Store level and indicate public and private key are not set. */ key->level = level % WC_ML_DSA_DRAFT; key->pubKeySet = 0; diff --git a/wolfcrypt/src/wc_mlkem.c b/wolfcrypt/src/wc_mlkem.c index 616bc1e018..a5a6578145 100644 --- a/wolfcrypt/src/wc_mlkem.c +++ b/wolfcrypt/src/wc_mlkem.c @@ -978,6 +978,18 @@ int wc_MlKemKey_MakeKeyWithRandom(MlKemKey* key, const unsigned char* rand, key->flags |= MLKEM_FLAG_A_SET; #endif } + else if ((key != NULL) && (k != 0)) { + /* Keygen failed after s and z were written; k is 0 until the + * argument checks passed (ISO/IEC 19790:2012 7.9.7). */ +#ifdef WOLFSSL_MLKEM_DYNAMIC_KEYS + if (key->priv != NULL) { + ForceZero(key->priv, key->privAllocSz); + } +#else + ForceZero(key->priv, sizeof(key->priv)); +#endif + ForceZero(key->z, sizeof(key->z)); + } /* Zeroize the secret seed material in rho||sigma (sigma) before return. */ ForceZero(buf, sizeof(buf)); diff --git a/wolfcrypt/src/wc_slhdsa.c b/wolfcrypt/src/wc_slhdsa.c index e40c8eebe7..a10b1dce3a 100644 --- a/wolfcrypt/src/wc_slhdsa.c +++ b/wolfcrypt/src/wc_slhdsa.c @@ -5227,6 +5227,8 @@ static int slhdsakey_hash_f_ti_x4(const byte* pk_seed, byte* addr, byte* node, slhdsakey_shake256_get_hash_x4(state, node, n); } + /* state holds four FORS secret leaves (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(state, sizeof(word64) * SLHDSA_SHAKE_X4_STATE_W); WC_FREE_VAR_EX(state, heap, DYNAMIC_TYPE_SLHDSA); } @@ -5347,6 +5349,10 @@ static int slhdsakey_fors_node_x4_z0(SlhDsaKey* key, const byte* sk_seed, ret = HASH_F(key, pk_seed, adrs, node, n, node); } + if (ret != 0) { + /* node may still hold the FORS secret leaf. */ + ForceZero(node, n); + } return ret; } @@ -5419,6 +5425,8 @@ static int slhdsakey_fors_node_x4_z1(SlhDsaKey* key, const byte* sk_seed, ret = HASH_H(key, pk_seed, adrs, nodes, n, node); } + /* nodes held two FORS secret leaves (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(nodes, sizeof(nodes)); return ret; } @@ -5546,6 +5554,10 @@ static int slhdsakey_fors_node_x4_low(SlhDsaKey* key, const byte* sk_seed, ret = HASH_H(key, pk_seed, adrs, nodes, n, node); } + /* nodes may still hold FORS secret leaves (ISO/IEC 19790:2012 7.9.7). */ + if (WC_VAR_OK(nodes)) { + ForceZero(nodes, (1 << SLHDSA_MAX_FORS_NODE_DEPTH) * SLHDSA_MAX_N); + } WC_FREE_VAR_EX(nodes, key->heap, DYNAMIC_TYPE_SLHDSA); return ret; } @@ -5774,6 +5786,10 @@ static int slhdsakey_fors_node_c(SlhDsaKey* key, const byte* sk_seed, word32 i, /* Step 5: Compute node from public key seed, address and value. */ ret = HASH_F(key, pk_seed, adrs, node, n, node); } + if (ret != 0) { + /* node may still hold the FORS secret leaf. */ + ForceZero(node, n); + } } /* Step 6: Non leaf node. */ else { @@ -5843,6 +5859,11 @@ static int slhdsakey_fors_node_c(SlhDsaKey* key, const byte* sk_seed, word32 i, } } + /* nodes may still hold FORS secret leaves + * (ISO/IEC 19790:2012 7.9.7). */ + if (WC_VAR_OK(nodes)) { + ForceZero(nodes, (SLHDSA_MAX_A + 1) * SLHDSA_MAX_N); + } WC_FREE_VAR_EX(nodes, key->heap, DYNAMIC_TYPE_SLHDSA); } @@ -5898,6 +5919,10 @@ static int slhdsakey_fors_node_c(SlhDsaKey* key, const byte* sk_seed, word32 i, /* Step 5: Compute node from public key seed, address and value. */ ret = HASH_F(key, pk_seed, adrs, node, n, node); } + if (ret != 0) { + /* node may still hold the FORS secret leaf. */ + ForceZero(node, n); + } } else { byte nodes[2 * SLHDSA_MAX_N]; @@ -5918,6 +5943,8 @@ static int slhdsakey_fors_node_c(SlhDsaKey* key, const byte* sk_seed, word32 i, /* Step 11: Compute node from public key seed, address and nodes. */ ret = HASH_H(key, pk_seed, adrs, nodes, n, node); } + /* nodes held two FORS secret leaves (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(nodes, sizeof(nodes)); } return ret; @@ -7198,11 +7225,17 @@ int wc_SlhDsaKey_MakeKeyWithRandom(SlhDsaKey* key, const byte* sk_seed, { /* The seeds are now staged in the key as the contiguous * SK.seed || SK.prf || PK.seed the callback expects. */ + key->flags &= ~((int)WC_SLHDSA_FLAG_BOTH_KEYS); ret = wc_CryptoCb_MakePqcSignatureKeyEx(NULL, WC_PQC_SIG_TYPE_SLHDSA, (int)key->params->param, key->sk, 3U * key->params->n, key); - if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) + if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) { + if ((key->flags & WC_SLHDSA_FLAG_PRIVATE) == 0) { + /* Device owns the key (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(key->sk, 2U * key->params->n); + } return ret; + } /* fall-through when unavailable */ ret = 0; } @@ -7310,6 +7343,7 @@ static int slhdsakey_sign(SlhDsaKey* key, byte* md, byte* sig) word32 l; byte pk_fors[SLHDSA_MAX_N]; byte n = key->params->n; + byte* sigFors = sig; /* Steps 1, 7-13: Set address based on message digest. */ slhdsakey_set_ha_from_md(key, md, adrs, t, &l); @@ -7328,6 +7362,11 @@ static int slhdsakey_sign(SlhDsaKey* key, byte* md, byte* sig) ret = slhdsakey_ht_sign(key, pk_fors, key->sk, key->sk + 2 * n, t, l, sig); } + if (ret != 0) { + /* Unreleased FORS secrets may be in sig + * (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(sigFors, key->params->k * (1 + key->params->a) * n); + } return ret; } diff --git a/wolfcrypt/src/wc_xmss.c b/wolfcrypt/src/wc_xmss.c index 5b38b96c27..62621b6631 100644 --- a/wolfcrypt/src/wc_xmss.c +++ b/wolfcrypt/src/wc_xmss.c @@ -794,6 +794,9 @@ static WC_INLINE int wc_xmsskey_signupdate(XmssKey* key, byte* sig, /* Free state after use. */ wc_xmss_state_free(state); } + /* State holds S_XMSS, SK_PRF and WOTS+ secrets + * (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(state, sizeof(XmssState)); WC_FREE_VAR_EX(state, key->heap, DYNAMIC_TYPE_TMP_BUFFER); } } @@ -1288,10 +1291,14 @@ int wc_XmssKey_MakeKey(XmssKey* key, WC_RNG* rng) if (ret != 0) { WOLFSSL_MSG("error: XMSS keygen failed"); key->state = WC_XMSS_STATE_BAD; + ForceZero(key->sk, key->sk_len); } /* Free state after use. */ wc_xmss_state_free(state); } + /* State holds S_XMSS, SK_PRF and WOTS+ secrets + * (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(state, sizeof(XmssState)); WC_FREE_VAR_EX(state, key->heap, DYNAMIC_TYPE_TMP_BUFFER); } } @@ -1314,6 +1321,14 @@ int wc_XmssKey_MakeKey(XmssKey* key, WC_RNG* rng) key->pubSet = 1; } + /* seed came straight from the DRBG (ISO/IEC 19790:2012 7.9.7). */ +#ifdef WOLFSSL_SMALL_STACK + if (seed != NULL) { + ForceZero(seed, 3U * key->params->n); + } +#else + ForceZero(seed, sizeof(seed)); +#endif WC_FREE_VAR_EX(seed, key->heap, DYNAMIC_TYPE_TMP_BUFFER); return ret; } @@ -1578,15 +1593,19 @@ int wc_XmssKey_SigsLeft(XmssKey* key) WOLFSSL_MSG("error: can't sign, XMSS key not in good state"); ret = 0; } - /* Read the current secret key from NV storage.*/ - else if (key->read_private_key(key->sk, key->sk_len, key->context) != - WC_XMSS_RC_READ_TO_MEMORY) { - WOLFSSL_MSG("error: XMSS read_private_key failed"); - ret = 0; - } else { - /* Ask implementation to check index in private key. */ - ret = wc_xmss_sigsleft(key->params, key->sk); + /* Read the current secret key from NV storage.*/ + if (key->read_private_key(key->sk, key->sk_len, key->context) != + WC_XMSS_RC_READ_TO_MEMORY) { + WOLFSSL_MSG("error: XMSS read_private_key failed"); + ret = 0; + } + else { + /* Ask implementation to check index in private key. */ + ret = wc_xmss_sigsleft(key->params, key->sk); + } + /* Only the index was needed (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(key->sk, key->sk_len); } return ret; @@ -2074,6 +2093,8 @@ int wc_XmssKey_Verify(XmssKey* key, const byte* sig, word32 sigLen, /* Free state after use. */ wc_xmss_state_free(state); } + /* Scratch state; no SSPs on the verify path. */ + ForceZero(state, sizeof(XmssState)); WC_FREE_VAR_EX(state, key->heap, DYNAMIC_TYPE_TMP_BUFFER); } } diff --git a/wolfcrypt/src/wc_xmss_impl.c b/wolfcrypt/src/wc_xmss_impl.c index 32bf45dded..35b8c415c5 100644 --- a/wolfcrypt/src/wc_xmss_impl.c +++ b/wolfcrypt/src/wc_xmss_impl.c @@ -642,6 +642,9 @@ static WC_INLINE void wc_xmss_hash(XmssState* state, const byte* in, if (ret == 0) { XMEMCPY(out, buf, params->n); } + /* Prefix may be a WOTS+ secret element + * (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(buf, sizeof(buf)); } #endif else diff --git a/wolfcrypt/src/wolfentropy.c b/wolfcrypt/src/wolfentropy.c index 569c3ab0a7..c07109620d 100644 --- a/wolfcrypt/src/wolfentropy.c +++ b/wolfcrypt/src/wolfentropy.c @@ -46,6 +46,12 @@ data, use this implementation to seed and re-seed the DRBG. #endif #include +#ifdef NO_INLINE + #include +#else + #define WOLFSSL_MISC_INCLUDED + #include +#endif #if defined(__APPLE__) || defined(__MACH__) #include #endif @@ -836,6 +842,7 @@ static int Entropy_Condition(byte* output, word32 len, byte* noise, if (ret == 0) { XMEMCPY(output, hash, len); } + ForceZero(hash, sizeof(hash)); } } @@ -945,6 +952,9 @@ int wc_Entropy_Get(int bits, unsigned char* entropy, word32 len) #endif if (ret != WC_NO_ERR_TRACE(BAD_MUTEX_E)) { + /* Raw samples were conditioned into the seed + * (ISO/IEC 19790:2012 7.9.7). */ + ForceZero(noise, sizeof(noise)); /* Unlock mutex now we are done. */ wc_UnLockMutex(&entropy_mutex); }