admin/RustCrypto-signatures
1
0
Fork 0
mirror of https://github.com/RustCrypto/signatures synced 2026-06-21 13:45:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

ml-dsa: zeroize NTT-domain derived values in ExpandedSigningKey Drop (#1300)

Browse Source 
The existing Drop impl for ExpandedSigningKey (gated on the zeroize
feature) zeroizes rho, K, tr, s1, s2, and t0 but skips the
NTT-domain derived values s1_hat, s2_hat, and t0_hat.

The NTT is invertible, so s1_hat in memory is equivalent to having
s1. This leaves secret key material unzeroized after drop.

Add s1_hat, s2_hat, and t0_hat to the Drop impl. All three are
NttVector types which implement Zeroize via module-lattice.

A_hat (the public matrix derived from rho) is not zeroized here
because NttMatrix does not implement Zeroize in module-lattice.
A_hat is derived from public data (rho) so this is lower priority,
but a follow-up PR to module-lattice could add Zeroize for NttMatrix
for completeness.
This commit is contained in:
Peter Membrey
2026-04-16 00:53:09 +08:00
committed by GitHub
parent 66de36e62f
commit ecaf35904d
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ml-dsa/src/lib.rs
+3
View File
@@ -301,6 +301,9 @@ impl<P: MlDsaParams> Drop for ExpandedSigningKey<P> {
self.s1.zeroize();
self.s2.zeroize();
self.t0.zeroize();
self.s1_hat.zeroize();
self.s2_hat.zeroize();
self.t0_hat.zeroize();
}
}