Repository navigation
Conversation
`sha256_crypt()` and `sha512_crypt()` left intermediate digests derived from the password on the stack: the digests A, B, DP and DS, and the hash of each round before it was copied out. Some certifications, such as Common Criteria FDP_RIP.2, require that a password hasher clears such data. The new `zeroize` feature clears these digests before return, and enables `sha2/zeroize`, which clears the hasher states on drop, like `argon2` does for `blake2`. The rounds now finalize in place with `finalize_into()`, which leaves no temporary copy of the digest. Without the feature, the output is the same and nothing is cleared.
Member
|
We don't clear the stack by policy: RustCrypto/meta#38 I guess we need to make an AGENTS.md that describes this |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
sha256_crypt()andsha512_crypt()leave intermediate digests derived from the password on the stack: the digests A, B, DP and DS, and the hash of each round before it is copied out. Some certifications, such as Common Criteria FDP_RIP.2 (residual information protection), require that a password hasher clears such data. We want to replace our C SHA-crypt with this crate, and this is the only blocker.This PR adds an optional
zeroizefeature:sha2/zeroize, so the hasher states clear themselves on drop.argon2does the same forblake2(argon2: pass zeroize along to blake2 #932).finalize_into(), so no temporary copy of a digest is left behind.Without the feature, the output is unchanged and nothing is cleared. The extra calls compile to nothing.
Checked with
cargo test,cargo clippy --all-targetsandcargo fmt --checkonsha-crypt, with the default features,--all-featuresand--no-default-features.I did not touch
CHANGELOG.md, because its entries reference PR numbers and appear to be written at release time. I can add an entry if you prefer.