From 47b29f0fc496137e4bc92300c8619d395803ddf7 Mon Sep 17 00:00:00 2001 From: Tony Arcieri Date: Sat, 31 Oct 2026 15:45:24 -0600 Subject: [PATCH] ml-kem: harden zeroization Note: these fixes impact copies of secret data potentially kept on the heap, so they're worth fixing --- ml-kem/src/decapsulation_key.rs | 3 ++- ml-kem/src/pkcs8.rs | 16 +++++++++------- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/ml-kem/src/decapsulation_key.rs b/ml-kem/src/decapsulation_key.rs index 141ebaee..25039c9b 100644 --- a/ml-kem/src/decapsulation_key.rs +++ b/ml-kem/src/decapsulation_key.rs @@ -64,7 +64,6 @@ where #[deprecated(since = "0.3.0", note = "use `DecapsulationKey::from_seed` instead")] pub fn from_expanded(enc: &ExpandedDecapsulationKey

) -> Result { let (dk_pke, ek_pke, h, z) = P::split_dk(enc); - let dk_pke = MaybeBox::new(DecryptionKey::from_bytes(dk_pke)); let ek_pke = EncryptionKey::from_bytes(ek_pke)?; let ek = EncapsulationKey::from_encryption_key(ek_pke); @@ -72,6 +71,8 @@ where return Err(InvalidKey); } + let dk_pke = MaybeBox::new(DecryptionKey::from_bytes(dk_pke)); + Ok(Self { dk_pke, ek, diff --git a/ml-kem/src/pkcs8.rs b/ml-kem/src/pkcs8.rs index 6c12b137..6215b7e6 100644 --- a/ml-kem/src/pkcs8.rs +++ b/ml-kem/src/pkcs8.rs @@ -32,7 +32,7 @@ use array::Array; #[cfg(feature = "alloc")] use { ::kem::KeyExport, - ::pkcs8::der::{Encode, TagMode, asn1::BitStringRef}, + ::pkcs8::der::{Encode, TagMode, asn1::BitStringRef, zeroize::Zeroizing}, }; /// Tag number for the seed value. @@ -161,12 +161,14 @@ where fn to_pkcs8_der(&self) -> ::pkcs8::Result { let seed = self.to_seed().ok_or(pkcs8::KeyError::Invalid)?; - let seed_der = SeedString { - tag_mode: TagMode::Implicit, - tag_number: SEED_TAG_NUMBER, - value: OctetStringRef::new(&seed)?, - } - .to_der()?; + let seed_der = Zeroizing::new( + SeedString { + tag_mode: TagMode::Implicit, + tag_number: SEED_TAG_NUMBER, + value: OctetStringRef::new(&seed)?, + } + .to_der()?, + ); let private_key = OctetStringRef::new(&seed_der)?; let private_key_info = pkcs8::PrivateKeyInfoRef::new(P::ALGORITHM_IDENTIFIER, private_key);