beardthelion 9a46e8cbb7 fix(core): zeroize the derived X25519 secret (#65) (#66) ...

x25519_secret_from_seed derived the X25519 private scalar from the Ed25519
seed and returned it as a bare [u8; 32]. Because [u8; 32] is Copy with no
Drop (and sha2's digest output likewise has no zeroize), the scalar, the
SHA-512 digest, and the returned temporary were released without being
scrubbed, leaving secret-derived material in freed memory. This is the same
Copy-no-Drop class fixed for the raw seed in #41, on the derived secret.

Return Zeroizing<[u8; 32]>, build the scalar directly into a zeroizing
buffer so no bare secret local persists, and explicitly wipe the SHA-512
digest before it drops. Callers deref the result into crypto_box::SecretKey,
which already scrubs its own copy. No behavior change: the derived scalar and
all decryption output are byte-identical, covered by the existing
ed25519_to_x25519_keypair_agrees and seal_open_round_trip_for_recipients tests.

Stacked on #41 (#64).

2026-06-23 22:05:56 +08:00

..

src

fix(core): zeroize the derived X25519 secret (#65) (#66)

2026-06-23 22:05:56 +08:00

Cargo.toml

ci: harden PR pipeline (audit, MSRV, beta matrix, release + docker smoke) (#57)

2026-06-22 19:02:38 +08:00