You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Current behavior:FieldElement does not implement any zeroizing when it is dropped, opening the door for potential memory read attacks on sensitive information such as private keys.
While there certainly are more common ways to leak sensitive cryptographic information like private keys, it seems like for something in our control such as in-memory representation we should at least provide this as an option.
The text was updated successfully, but these errors were encountered:
Bug Report
lambdaworks-math version: 021c3b6
Current behavior:
FieldElement
does not implement any zeroizing when it is dropped, opening the door for potential memory read attacks on sensitive information such as private keys.Expected behavior:
FieldElement
should implement#[derive(ZeroizeOnDrop)]
or similar to allow memory zeroing when dropped. This could be feature-gated. Either a manual implementation usingptr::write_volatile
andatomic::compiler_fence
or usingzeroize
would fix this issueOther information:
While there certainly are more common ways to leak sensitive cryptographic information like private keys, it seems like for something in our control such as in-memory representation we should at least provide this as an option.
The text was updated successfully, but these errors were encountered: