adding zeroize for stream_core.rs (#1494)

.github/workflows/async-signature.yml

@@ -36,6 +36,7 @@ jobs:
       - run: cargo test --all-features --release
 
   minimal-versions:
+    if: false # Temporarily disabled until signature v2.3.0 is published
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

Cargo.toml

@@ -16,7 +16,4 @@ members = [
 ]
 
 [patch.crates-io]
-crypto-common = { path = "./crypto-common" }
-digest = { path = "./digest" }
 signature = { path = "./signature" }
-sha2 = { git = "https://github.com/RustCrypto/hashes.git" }

aead/Cargo.toml

@@ -16,7 +16,7 @@ categories = ["cryptography", "no-std"]
 rust-version = "1.65"
 
 [dependencies]
-crypto-common = "=0.2.0-pre.4"
+crypto-common = "=0.2.0-pre.5"
 
 # optional dependencies
 arrayvec = { version = "0.7", optional = true, default-features = false }

async-signature/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name          = "async-signature"
 description   = "Traits for cryptographic signature algorithms (e.g. ECDSA, Ed25519)"
-version       = "0.6.0-pre.0"
+version       = "0.6.0-pre.1"
 authors       = ["RustCrypto Developers"]
 license       = "Apache-2.0 OR MIT"
 documentation = "https://docs.rs/async-signature"
@@ -13,7 +13,7 @@ edition       = "2021"
 rust-version  = "1.75"
 
 [dependencies]
-signature = "=2.3.0-pre.2"
+signature = "=2.3.0-pre.3"
 
 [features]
 digest = ["signature/digest"]

cipher/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "cipher"
 description = "Traits for describing block ciphers and stream ciphers"
-version = "0.5.0-pre.2"
+version = "0.5.0-pre.3"
 authors = ["RustCrypto Developers"]
 license = "MIT OR Apache-2.0"
 readme = "README.md"
@@ -13,7 +13,7 @@ keywords = ["crypto", "block-cipher", "stream-cipher", "trait"]
 categories = ["cryptography", "no-std"]
 
 [dependencies]
-crypto-common = "=0.2.0-pre.4"
+crypto-common = "=0.2.0-pre.5"
 inout = "=0.2.0-pre.4"
 
 # optional dependencies
@@ -26,6 +26,7 @@ std = ["alloc", "crypto-common/std", "inout/std"]
 block-padding = ["inout/block-padding"]
 rand_core = ["crypto-common/rand_core"] # Enable random key and IV generation methods
 dev = ["blobby"]
+zeroize = ["dep:zeroize", "crypto-common/zeroize"]
 
 [package.metadata.docs.rs]
 all-features = true

cipher/src/stream_core.rs

@@ -2,6 +2,9 @@ use crate::{ParBlocks, ParBlocksSizeUser, StreamCipherError};
 use crypto_common::{array::Array, typenum::Unsigned, Block, BlockSizeUser, BlockSizes};
 use inout::{InOut, InOutBuf};
 
+#[cfg(feature = "zeroize")]
+use zeroize::Zeroize;
+
 /// Trait implemented by stream cipher backends.
 pub trait StreamBackend: ParBlocksSizeUser {
     /// Generate keystream block.
@@ -35,7 +38,7 @@ pub trait StreamClosure: BlockSizeUser {
 }
 
 /// Block-level synchronous stream ciphers.
-pub trait StreamCipherCore: BlockSizeUser + Sized {
+pub trait StreamCipherCore: BlockSizeUser + ParBlocksSizeUser + Sized {
     /// Return number of remaining blocks before cipher wraps around.
     ///
     /// Returns `None` if number of remaining blocks can not be computed
@@ -125,6 +128,10 @@ pub trait StreamCipherCore: BlockSizeUser + Sized {
         let t = InOutBuf::from_mut(&mut block);
         self.apply_keystream_blocks_inout(t);
         buf.get_out().copy_from_slice(&block[..n]);
+
+        #[cfg(feature = "zeroize")]
+        block.zeroize();
+
         Ok(())
     }
 
@@ -236,6 +243,8 @@ impl<'inp, 'out, BS: BlockSizes> StreamClosure for ApplyBlockCtx<'inp, 'out, BS>
         let mut t = Default::default();
         backend.gen_ks_block(&mut t);
         self.block.xor_in2out(&t);
+        #[cfg(feature = "zeroize")]
+        t.zeroize()
     }
 }
 
@@ -253,24 +262,27 @@ impl<'inp, 'out, BS: BlockSizes> StreamClosure for ApplyBlocksCtx<'inp, 'out, BS
     fn call<B: StreamBackend<BlockSize = BS>>(self, backend: &mut B) {
         if B::ParBlocksSize::USIZE > 1 {
             let (chunks, mut tail) = self.blocks.into_chunks::<B::ParBlocksSize>();
+            let mut buf = Array::<_, B::ParBlocksSize>::default();
             for mut chunk in chunks {
-                let mut tmp = Default::default();
-                backend.gen_par_ks_blocks(&mut tmp);
-                chunk.xor_in2out(&tmp);
+                backend.gen_par_ks_blocks(&mut buf);
+                chunk.xor_in2out(&buf);
             }
             let n = tail.len();
-            let mut buf = Array::<_, B::ParBlocksSize>::default();
             let ks = &mut buf[..n];
             backend.gen_tail_blocks(ks);
             for i in 0..n {
                 tail.get(i).xor_in2out(&ks[i]);
             }
+            #[cfg(feature = "zeroize")]
+            buf.zeroize()
         } else {
+            let mut buf = Default::default();
             for mut block in self.blocks {
-                let mut t = Default::default();
-                backend.gen_ks_block(&mut t);
-                block.xor_in2out(&t);
+                backend.gen_ks_block(&mut buf);
+                block.xor_in2out(&buf);
             }
+            #[cfg(feature = "zeroize")]
+            buf.zeroize()
         }
     }
 }