diff --git a/Cargo.lock b/Cargo.lock index ca5e1d309..e03f3c250 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -8,6 +8,7 @@ version = "0.10.6" dependencies = [ "digest", "hex-literal", + "zeroize", ] [[package]] @@ -205,6 +206,7 @@ dependencies = [ "digest", "hex-literal", "sha1-asm", + "zeroize", ] [[package]] @@ -225,6 +227,7 @@ dependencies = [ "digest", "hex-literal", "sha2-asm", + "zeroize", ] [[package]] diff --git a/blake2/Cargo.toml b/blake2/Cargo.toml index adb06e061..0141cad0b 100644 --- a/blake2/Cargo.toml +++ b/blake2/Cargo.toml @@ -13,6 +13,7 @@ categories = ["cryptography", "no-std"] [dependencies] digest = { version = "0.10.7", features = ["mac"] } +zeroize = { version = "1", default-features = false, optional = true } [dev-dependencies] digest = { version = "0.10.7", features = ["dev"] } diff --git a/blake2/src/macros.rs b/blake2/src/macros.rs index 917a212c8..44e0c3a9a 100644 --- a/blake2/src/macros.rs +++ b/blake2/src/macros.rs @@ -243,6 +243,17 @@ macro_rules! blake2_impl { } } + #[cfg(feature = "zeroize")] + impl Drop for $name { + fn drop(&mut self) { + use zeroize::Zeroize; + self.h.zeroize(); + self.t.zeroize(); + } + } + #[cfg(feature = "zeroize")] + impl zeroize::ZeroizeOnDrop for $name {} + impl fmt::Debug for $name { fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { f.write_str(concat!(stringify!($name), " { ... }")) diff --git a/blake2/src/simd/simdty.rs b/blake2/src/simd/simdty.rs index 008b8b48c..a2b313c63 100644 --- a/blake2/src/simd/simdty.rs +++ b/blake2/src/simd/simdty.rs @@ -50,6 +50,16 @@ decl_simd! { pub T, pub T, pub T, pub T); } +#[cfg(feature = "zeroize")] +impl zeroize::Zeroize for Simd4 { + fn zeroize(&mut self) { + self.0.zeroize(); + self.1.zeroize(); + self.2.zeroize(); + self.3.zeroize(); + } +} + pub type u64x2 = Simd2; pub type u32x4 = Simd4; diff --git a/sha1/Cargo.toml b/sha1/Cargo.toml index 3f4b8d3ff..5cafe8bf7 100644 --- a/sha1/Cargo.toml +++ b/sha1/Cargo.toml @@ -14,6 +14,7 @@ categories = ["cryptography", "no-std"] [dependencies] digest = "0.10.7" cfg-if = "1.0" +zeroize = { version = "1", default-features = false, optional = true } [target.'cfg(any(target_arch = "aarch64", target_arch = "x86", target_arch = "x86_64"))'.dependencies] cpufeatures = "0.2" diff --git a/sha1/src/lib.rs b/sha1/src/lib.rs index 25e867e0f..9987311f9 100644 --- a/sha1/src/lib.rs +++ b/sha1/src/lib.rs @@ -150,6 +150,17 @@ impl AlgorithmName for Sha1Core { } } +#[cfg(feature = "zeroize")] +impl Drop for Sha1Core { + fn drop(&mut self) { + use zeroize::Zeroize; + self.h.zeroize(); + self.block_len.zeroize(); + } +} +#[cfg(feature = "zeroize")] +impl zeroize::ZeroizeOnDrop for Sha1Core {} + impl fmt::Debug for Sha1Core { fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { f.write_str("Sha1Core { ... }") diff --git a/sha2/Cargo.toml b/sha2/Cargo.toml index a3dafeaa2..4645cff23 100644 --- a/sha2/Cargo.toml +++ b/sha2/Cargo.toml @@ -17,6 +17,7 @@ categories = ["cryptography", "no-std"] [dependencies] digest = "0.10.7" cfg-if = "1.0" +zeroize = { version = "1", default-features = false, optional = true } [target.'cfg(any(target_arch = "aarch64", target_arch = "x86_64", target_arch = "x86"))'.dependencies] cpufeatures = "0.2" diff --git a/sha2/src/core_api.rs b/sha2/src/core_api.rs index cfec02a64..d286e9fd5 100644 --- a/sha2/src/core_api.rs +++ b/sha2/src/core_api.rs @@ -75,6 +75,17 @@ impl AlgorithmName for Sha256VarCore { } } +#[cfg(feature = "zeroize")] +impl Drop for Sha256VarCore { + fn drop(&mut self) { + use zeroize::Zeroize; + self.state.zeroize(); + self.block_len.zeroize(); + } +} +#[cfg(feature = "zeroize")] +impl zeroize::ZeroizeOnDrop for Sha256VarCore {} + impl fmt::Debug for Sha256VarCore { #[inline] fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { @@ -149,6 +160,17 @@ impl AlgorithmName for Sha512VarCore { } } +#[cfg(feature = "zeroize")] +impl Drop for Sha512VarCore { + fn drop(&mut self) { + use zeroize::Zeroize; + self.state.zeroize(); + self.block_len.zeroize(); + } +} +#[cfg(feature = "zeroize")] +impl zeroize::ZeroizeOnDrop for Sha512VarCore {} + impl fmt::Debug for Sha512VarCore { #[inline] fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {