Skip to content

Commit 63f0707

Browse files
JeremiahM37JeremiahM37
committed
wolfcrypt: zero sensitive buffers
1 parent b777919 commit 63f0707

7 files changed

Lines changed: 36 additions & 5 deletions

File tree

‎wolfcrypt/src/camellia.c‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1634,5 +1634,13 @@ int wc_CamelliaCbcDecrypt(wc_Camellia* cam, byte* out, const byte* in, word32 sz
16341634
}
16351635

16361636

1637+
void wc_CamelliaFree(wc_Camellia* cam)
1638+
{
1639+
if (cam == NULL)
1640+
return;
1641+
ForceZero(cam, sizeof(wc_Camellia));
1642+
}
1643+
1644+
16371645
#endif /* HAVE_CAMELLIA */
16381646

‎wolfcrypt/src/curve25519.c‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -250,7 +250,7 @@ static int curve25519_smul_blind(byte* rp, const byte* n, const byte* p,
250250
for (cnt = 0; cnt < WOLFSSL_CURVE25519_BLINDING_RAND_CNT; cnt++) {
251251
ret = wc_RNG_GenerateBlock(rng, rz, sizeof(rz));
252252
if (ret < 0) {
253-
return ret;
253+
goto cleanup;
254254
}
255255
for (i = CURVE25519_KEYSIZE - 1; i >= 0; i--) {
256256
if (rz[i] != 0xff)
@@ -261,13 +261,14 @@ static int curve25519_smul_blind(byte* rp, const byte* n, const byte* p,
261261
}
262262
}
263263
if (cnt == WOLFSSL_CURVE25519_BLINDING_RAND_CNT) {
264-
return RNG_FAILURE_E;
264+
ret = RNG_FAILURE_E;
265+
goto cleanup;
265266
}
266267

267268
/* Generate 253 random bits. */
268269
ret = wc_RNG_GenerateBlock(rng, a, sizeof(a));
269270
if (ret != 0)
270-
return ret;
271+
goto cleanup;
271272
a[CURVE25519_KEYSIZE-1] &= 0x7f;
272273
/* k' = k ^ 2k ^ a */
273274
n_a[0] = n[0] ^ (byte)(n[0] << 1) ^ a[0];
@@ -281,6 +282,11 @@ static int curve25519_smul_blind(byte* rp, const byte* n, const byte* p,
281282
/* Scalar multiple blinded scalar with blinding value. */
282283
ret = curve25519_blind(rp, n_a, a, p, rz);
283284

285+
cleanup:
286+
ForceZero(a, sizeof(a));
287+
ForceZero(n_a, sizeof(n_a));
288+
ForceZero(rz, sizeof(rz));
289+
284290
RESTORE_VECTOR_REGISTERS();
285291

286292
return ret;

‎wolfcrypt/src/evp.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3016,6 +3016,9 @@ int wolfSSL_EVP_PKEY_CTX_set1_hkdf_key(WOLFSSL_EVP_PKEY_CTX* ctx,
30163016
}
30173017

30183018
if (ret == WOLFSSL_SUCCESS) {
3019+
if (ctx->pkey->hkdfKey != NULL && ctx->pkey->hkdfKeySz > 0) {
3020+
ForceZero(ctx->pkey->hkdfKey, ctx->pkey->hkdfKeySz);
3021+
}
30193022
XFREE(ctx->pkey->hkdfKey, NULL, DYNAMIC_TYPE_KEY);
30203023
ctx->pkey->hkdfKey = (byte*)XMALLOC((size_t)keySz, NULL,
30213024
DYNAMIC_TYPE_KEY);
@@ -11778,6 +11781,9 @@ void wolfSSL_EVP_PKEY_free(WOLFSSL_EVP_PKEY* key)
1177811781
case WC_EVP_PKEY_HKDF:
1177911782
XFREE(key->hkdfSalt, NULL, DYNAMIC_TYPE_SALT);
1178011783
key->hkdfSalt = NULL;
11784+
if (key->hkdfKey != NULL && key->hkdfKeySz > 0) {
11785+
ForceZero(key->hkdfKey, key->hkdfKeySz);
11786+
}
1178111787
XFREE(key->hkdfKey, NULL, DYNAMIC_TYPE_KEY);
1178211788
key->hkdfKey = NULL;
1178311789
XFREE(key->hkdfInfo, NULL, DYNAMIC_TYPE_INFO);

‎wolfcrypt/src/random.c‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -584,7 +584,6 @@ static int Hash_DRBG_Reseed(DRBG_internal* drbg, const byte* seed, word32 seedSz
584584
additional, additionalSz);
585585
if (ret == DRBG_SUCCESS) {
586586
XMEMCPY(drbg->V, newV, sizeof(drbg->V));
587-
ForceZero(newV, DRBG_SEED_LEN);
588587

589588
ret = Hash_df(drbg, drbg->C, sizeof(drbg->C), drbgInitC, drbg->V,
590589
sizeof(drbg->V), NULL, 0, NULL, 0);
@@ -593,6 +592,8 @@ static int Hash_DRBG_Reseed(DRBG_internal* drbg, const byte* seed, word32 seedSz
593592
drbg->reseedCtr = 1;
594593
}
595594

595+
ForceZero(newV, DRBG_SEED_LEN);
596+
596597
#ifndef WOLFSSL_SMALL_STACK_CACHE
597598
WC_FREE_VAR_EX(newV, drbg->heap, DYNAMIC_TYPE_TMP_BUFFER);
598599
#endif
@@ -1177,7 +1178,6 @@ static int Hash512_DRBG_Reseed(DRBG_SHA512_internal* drbg, const byte* seed,
11771178
additional, additionalSz);
11781179
if (ret == DRBG_SUCCESS) {
11791180
XMEMCPY(drbg->V, newV, sizeof(drbg->V));
1180-
ForceZero(newV, DRBG_SHA512_SEED_LEN);
11811181

11821182
ret = Hash512_df(drbg, drbg->C, sizeof(drbg->C), drbgInitC, drbg->V,
11831183
sizeof(drbg->V), NULL, 0,
@@ -1187,6 +1187,8 @@ static int Hash512_DRBG_Reseed(DRBG_SHA512_internal* drbg, const byte* seed,
11871187
drbg->reseedCtr = 1;
11881188
}
11891189

1190+
ForceZero(newV, DRBG_SHA512_SEED_LEN);
1191+
11901192
#ifndef WOLFSSL_SMALL_STACK_CACHE
11911193
WC_FREE_VAR_EX(newV, drbg->heap, DYNAMIC_TYPE_TMP_BUFFER);
11921194
#endif

‎wolfcrypt/src/rsa.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1398,6 +1398,7 @@ static int RsaPad_OAEP(const byte* input, word32 inputLen, byte* pkcsBlock,
13981398
/* generate random seed */
13991399
if ((ret = wc_RNG_GenerateBlock(rng, seed, hLen)) != 0) {
14001400
WC_FREE_VAR_EX(lHash, heap, DYNAMIC_TYPE_RSA_BUFFER);
1401+
ForceZero(seed, hLen);
14011402
WC_FREE_VAR_EX(seed, heap, DYNAMIC_TYPE_RSA_BUFFER);
14021403
return ret;
14031404
}
@@ -1408,6 +1409,7 @@ static int RsaPad_OAEP(const byte* input, word32 inputLen, byte* pkcsBlock,
14081409
if (dbMask == NULL) {
14091410

14101411
XFREE(lHash, heap, DYNAMIC_TYPE_RSA_BUFFER);
1412+
ForceZero(seed, hLen);
14111413
XFREE(seed, heap, DYNAMIC_TYPE_RSA_BUFFER);
14121414
return MEMORY_E;
14131415
}
@@ -1421,6 +1423,7 @@ static int RsaPad_OAEP(const byte* input, word32 inputLen, byte* pkcsBlock,
14211423
if (ret != 0) {
14221424
WC_FREE_VAR_EX(dbMask, heap, DYNAMIC_TYPE_RSA);
14231425
WC_FREE_VAR_EX(lHash, heap, DYNAMIC_TYPE_RSA_BUFFER);
1426+
ForceZero(seed, hLen);
14241427
WC_FREE_VAR_EX(seed, heap, DYNAMIC_TYPE_RSA_BUFFER);
14251428
return ret;
14261429
}
@@ -1435,6 +1438,7 @@ static int RsaPad_OAEP(const byte* input, word32 inputLen, byte* pkcsBlock,
14351438
if ((ret = RsaMGF(mgf, pkcsBlock + hLen + 1, pkcsBlockLen - hLen - 1,
14361439
pkcsBlock + 1, hLen, heap)) != 0) {
14371440
WC_FREE_VAR_EX(lHash, heap, DYNAMIC_TYPE_RSA_BUFFER);
1441+
ForceZero(seed, hLen);
14381442
WC_FREE_VAR_EX(seed, heap, DYNAMIC_TYPE_RSA_BUFFER);
14391443
return ret;
14401444
}

‎wolfcrypt/src/wc_slhdsa.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7261,6 +7261,8 @@ int wc_SlhDsaKey_Sign(SlhDsaKey* key, const byte* ctx, byte ctxSz,
72617261
sigSz, addRnd);
72627262
}
72637263

7264+
ForceZero(addRnd, sizeof(addRnd));
7265+
72647266
return ret;
72657267
}
72667268

@@ -8056,6 +8058,8 @@ int wc_SlhDsaKey_SignHash(SlhDsaKey* key, const byte* ctx, byte ctxSz,
80568058
hashType, sig, sigSz, addRnd);
80578059
}
80588060

8061+
ForceZero(addRnd, sizeof(addRnd));
8062+
80598063
return ret;
80608064
}
80618065
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */

‎wolfssl/wolfcrypt/camellia.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ WOLFSSL_API int wc_CamelliaCbcEncrypt(wc_Camellia* cam,
9090
byte* out, const byte* in, word32 sz);
9191
WOLFSSL_API int wc_CamelliaCbcDecrypt(wc_Camellia* cam,
9292
byte* out, const byte* in, word32 sz);
93+
WOLFSSL_API void wc_CamelliaFree(wc_Camellia* cam);
9394

9495
#ifndef OPENSSL_COEXIST
9596

0 commit comments

Comments
 (0)