Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bug(field): FieldElement is not zeroized on drop #927

Open
Trantorian1 opened this issue Oct 8, 2024 · 0 comments
Open

bug(field): FieldElement is not zeroized on drop #927

Trantorian1 opened this issue Oct 8, 2024 · 0 comments

Comments

@Trantorian1
Copy link

Bug Report

lambdaworks-math version: 021c3b6

Current behavior: FieldElement does not implement any zeroizing when it is dropped, opening the door for potential memory read attacks on sensitive information such as private keys.

Expected behavior:

FieldElement should implement #[derive(ZeroizeOnDrop)] or similar to allow memory zeroing when dropped. This could be feature-gated. Either a manual implementation using ptr::write_volatile and atomic::compiler_fence or using zeroize would fix this issue

Other information:

While there certainly are more common ways to leak sensitive cryptographic information like private keys, it seems like for something in our control such as in-memory representation we should at least provide this as an option.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant