From 8dfa3cf4a82b2b07bc1491c8f11097169c09813c Mon Sep 17 00:00:00 2001 From: Emil Abramov Date: Tue, 21 Jul 2026 14:50:07 +0200 Subject: [PATCH] sec: attempt explicit zeroization --- x-wing/src/lib.rs | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/x-wing/src/lib.rs b/x-wing/src/lib.rs index 666fccd..8d45628 100644 --- a/x-wing/src/lib.rs +++ b/x-wing/src/lib.rs @@ -281,11 +281,17 @@ fn expand_key( shaker.update(sk); let mut expanded: Shake256Reader = shaker.finalize_xof(); - let seed = read_from(&mut expanded).into(); + #[allow(unused_mut)] + let mut seed = read_from(&mut expanded).into(); let (sk_m, pk_m) = MlKem768::from_seed(&seed); - - let sk_x = read_from(&mut expanded); - let sk_x = StaticSecret::from(sk_x); + #[cfg(feature = "zeroize")] + seed.zeroize(); + + #[allow(unused_mut)] + let mut sk_x_raw = read_from(&mut expanded); + let sk_x = StaticSecret::from(sk_x_raw); + #[cfg(feature = "zeroize")] + sk_x_raw.zeroize(); let pk_x = PublicKey::from(&sk_x); (sk_m, sk_x, pk_m, pk_x)