belt-kwp: add optional zeroize support

belt-kwp/CHANGELOG.md

@@ -5,10 +5,15 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## 0.2.0 (UNRELEASED)
+### Added
+- Optional `zeroize` support ([#88])
+
 ### Removed
 - `std` and `alloc` crate features ([#87])
+- Implementation of `Copy` for `BeltKwp` ([#88])
 
 [#87]: https://github.com/RustCrypto/key-wraps/pull/87
+[#88]: https://github.com/RustCrypto/key-wraps/pull/88
 
 ## 0.1.1 (2026-05-27)
 ### Changed

belt-kwp/Cargo.toml

@@ -13,9 +13,13 @@ rust-version = "1.85"
 
 [dependencies]
 belt-block = "0.2"
+zeroize = { version = "1.8", optional = true, default-features = false }
 
 [dev-dependencies]
 hex-literal = "1"
 
+[features]
+zeroize = ["dep:zeroize", "belt-block/zeroize"]
+
 [package.metadata.docs.rs]
 all-features = true

belt-kwp/src/lib.rs

@@ -29,7 +29,7 @@ pub type WrappedKey<N> = Array<u8, Sum<N, IvLen>>;
 pub const IV_LEN: usize = IvLen::USIZE;
 
 /// BelT Key Wrap instance as defined in STB 34.101.34-2020.
-#[derive(Clone, Copy, PartialEq)]
+#[derive(Clone, PartialEq)]
 pub struct BeltKwp {
     key: [u32; 8],
 }
@@ -206,6 +206,19 @@ impl KeySizeUser for BeltKwp {
     }
 }
 
+impl Drop for BeltKwp {
+    fn drop(&mut self) {
+        #[cfg(feature = "zeroize")]
+        {
+            use zeroize::Zeroize;
+            self.key.zeroize();
+        }
+    }
+}
+
+#[cfg(feature = "zeroize")]
+impl zeroize::ZeroizeOnDrop for BeltKwp {}
+
 /// Errors emitted from the wrap and unwrap operations.
 #[derive(Debug)]
 pub enum Error {