Zeroize internal buffers and variables in PKCS and SHA

Zeroising of local buffers and variables which are used for calculations in
mbedtls_pkcs5_pbkdf2_hmac() and mbedtls_internal_sha*_process() functions
to erase sensitive data from memory.
Checked all function for possible missing zeroisation in PKCS and SHA.

Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
This commit is contained in:
gabor-mezei-arm 2020-07-30 16:41:25 +02:00
parent 8ed8694199
commit 76749aea78
No known key found for this signature in database
GPG key ID: 106F5A41ECC305BD
5 changed files with 30 additions and 0 deletions

View file

@ -0,0 +1,5 @@
Security
* Zeroising of local buffers and variables which are used for calculations
in mbedtls_pkcs5_pbkdf2_hmac() and mbedtls_internal_sha*_process()
functions to erase sensitive data from memory. Reported by
Johan Malmgren and Johan Uppman Bruce from Sectra.

View file

@ -290,6 +290,10 @@ int mbedtls_pkcs5_pbkdf2_hmac( mbedtls_md_context_t *ctx,
break;
}
/* Zeroise buffers to clear sensitive data from memory. */
mbedtls_platform_zeroize( work, MBEDTLS_MD_MAX_SIZE );
mbedtls_platform_zeroize( md1, MBEDTLS_MD_MAX_SIZE );
return( 0 );
}

View file

@ -285,6 +285,15 @@ int mbedtls_internal_sha1_process( mbedtls_sha1_context *ctx,
ctx->state[3] += D;
ctx->state[4] += E;
/* Zeroise buffers and variables to clear sensitive data from memory. */
mbedtls_platform_zeroize( &A, sizeof( A ) );
mbedtls_platform_zeroize( &B, sizeof( B ) );
mbedtls_platform_zeroize( &C, sizeof( C ) );
mbedtls_platform_zeroize( &D, sizeof( D ) );
mbedtls_platform_zeroize( &E, sizeof( E ) );
mbedtls_platform_zeroize( &W, sizeof( W ) );
mbedtls_platform_zeroize( &temp, sizeof( temp ) );
return( 0 );
}

View file

@ -253,6 +253,12 @@ int mbedtls_internal_sha256_process( mbedtls_sha256_context *ctx,
for( i = 0; i < 8; i++ )
ctx->state[i] += A[i];
/* Zeroise buffers and variables to clear sensitive data from memory. */
mbedtls_platform_zeroize( &A, sizeof( A ) );
mbedtls_platform_zeroize( &W, sizeof( W ) );
mbedtls_platform_zeroize( &temp1, sizeof( temp1 ) );
mbedtls_platform_zeroize( &temp2, sizeof( temp2 ) );
return( 0 );
}

View file

@ -311,6 +311,12 @@ int mbedtls_internal_sha512_process( mbedtls_sha512_context *ctx,
for( i = 0; i < 8; i++ )
ctx->state[i] += A[i];
/* Zeroise buffers and variables to clear sensitive data from memory. */
mbedtls_platform_zeroize( &A, sizeof( A ) );
mbedtls_platform_zeroize( &W, sizeof( W ) );
mbedtls_platform_zeroize( &temp1, sizeof( temp1 ) );
mbedtls_platform_zeroize( &temp2, sizeof( temp2 ) );
return( 0 );
}