From 2f91028f2d299b92e4e76e12547a342972227146 Mon Sep 17 00:00:00 2001 From: Sean Parkinson Date: Wed, 18 May 2022 08:47:57 +1000 Subject: [PATCH] TLS 1.3: pre-master secret zeroizing --- src/internal.c | 1 + src/tls13.c | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/src/internal.c b/src/internal.c index cf2294991..2c1925a96 100644 --- a/src/internal.c +++ b/src/internal.c @@ -6697,6 +6697,7 @@ void FreeArrays(WOLFSSL* ssl, int keep) ssl->session->sessionIDSz = ssl->arrays->sessionIDSz; } if (ssl->arrays->preMasterSecret) { + ForceZero(ssl->arrays->preMasterSecret, ssl->arrays->preMasterSz); XFREE(ssl->arrays->preMasterSecret, ssl->heap, DYNAMIC_TYPE_SECRET); ssl->arrays->preMasterSecret = NULL; } diff --git a/src/tls13.c b/src/tls13.c index 18ec5e398..2b8b5e214 100644 --- a/src/tls13.c +++ b/src/tls13.c @@ -7164,6 +7164,8 @@ static int SendTls13Finished(WOLFSSL* ssl) /* Can send application data now. */ if ((ret = DeriveMasterSecret(ssl)) != 0) return ret; + /* Last use of preMasterSecret - zeroize as soon as possible. */ + ForceZero(ssl->arrays->preMasterSecret, ssl->arrays->preMasterSz); #ifdef WOLFSSL_EARLY_DATA if ((ret = DeriveTls13Keys(ssl, traffic_key, ENCRYPT_SIDE_ONLY, 1)) != 0) { @@ -8425,6 +8427,9 @@ int DoTls13HandShakeMsgType(WOLFSSL* ssl, byte* input, word32* inOutIdx, if (type == finished) { if ((ret = DeriveMasterSecret(ssl)) != 0) return ret; + /* Last use of preMasterSecret - zeroize as soon as possible. */ + ForceZero(ssl->arrays->preMasterSecret, + ssl->arrays->preMasterSz); #ifdef WOLFSSL_EARLY_DATA if ((ret = DeriveTls13Keys(ssl, traffic_key, ENCRYPT_AND_DECRYPT_SIDE,