Remove Zeroize Tests (#381)

* Remove Zeroize tests

* Remove `Zeroize` requirements from `Group::Pk`

* Remove `Copy` requirements from `Group::Pk`

* Change to `ZeroizeOnDrop` requirements for `Group::Sk`

* Add note why we don't use `elliptic_curve::PublicKey`
This commit is contained in:
daxpedda
2025-07-17 13:15:30 -07:00
committed by GitHub
parent 1b6633cdcc
commit c04fb97b5c
21 changed files with 110 additions and 841 deletions
+5 -28
View File
@@ -109,6 +109,7 @@ where
Le<<H::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
{
server_nonce: GenericArray<u8, NonceLen>,
#[derive_where(skip(Zeroize))]
server_e_pk: PublicKey<G>,
mac: Output<H>,
}
@@ -375,6 +376,8 @@ where
}
}
/// TODO: implement via derive after hash crates get `Zeroize` support in
/// `digest` v11.
impl<G: Group, H: Hash> Drop for Ke2Builder<G, H>
where
H::Core: ProxyHash,
@@ -382,21 +385,17 @@ where
Le<<H::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
{
fn drop(&mut self) {
struct AssertZeroizeOnDrop<'a, T: ZeroizeOnDrop>(#[allow(unused)] &'a T);
let Self {
server_nonce,
transcript_hasher,
client_e_pk,
server_e_pk,
client_e_pk: _,
server_e_pk: _,
shared_secret_1,
shared_secret_3,
} = self;
server_nonce.zeroize();
transcript_hasher.reset();
let _ = AssertZeroizeOnDrop(client_e_pk);
let _ = AssertZeroizeOnDrop(server_e_pk);
shared_secret_1.zeroize();
shared_secret_3.zeroize();
}
@@ -469,25 +468,3 @@ where
self.mac.clone()
}
}
//////////////////////////
// Test Implementations //
//===================== //
//////////////////////////
#[cfg(test)]
use crate::serialization::AssertZeroized;
#[cfg(test)]
impl<H: OutputSizeUser> AssertZeroized for Ke2State<H> {
fn assert_zeroized(&self) {
let Self {
session_key,
expected_mac,
} = self;
for byte in session_key.iter().chain(expected_mac) {
assert_eq!(byte, &0);
}
}
}