xaes-256-gcm: add zeroize feature (#863) - #863
Merged
Merged
Conversation
eligrubb
commented
Jul 22, 2026
| // Kₘ = AES-256ₖ(M1 ⊕ K1) | ||
| // Kₙ = AES-256ₖ(M2 ⊕ K1) | ||
| // Kₓ = Kₘ || Kₙ = AES-256ₖ(M1 ⊕ K1) || AES-256ₖ(M2 ⊕ K1) | ||
| let mut key: Key<Aes256Gcm> = Array::default(); |
Contributor
Author
There was a problem hiding this comment.
As it was, this helper method would allocate key on the local stack, and then copy raw key material into it. Then, it would copy the result into the return buffer, never clearing the stack-allocated key material. This PR instead allocated the key buffer first, before calling derive_key, and passes in a reference.
tarcieri
approved these changes
Aug 11, 2026
tarcieri
changed the title
xaes-256-gcm cratezeroize feature (#863)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #862, adding optional
zeroizefeature toxaes-256-gcmcrate.Follows pattern of other crates, using marker trait
ZeroizeOnDropto cascade trait to underlyingAes256. Zeroizesk1block on drop. When feature is enabled, zeroizes local variablekthat contains raw key material.As part of this PR, the helper method
derive_key's signature was changed to avoid cloning sensitive key material on the stack. Instead, the helper now accepts a pointer to the key material and modifies it in place. This avoids the helper method copying key material into its local stack, which is not zeroized whenderive_keyreturns.