diff mbox series

[Openvpn-devel,v1] crypto: Wipe the struct key_parameters copies after use

Message ID 20261105093736.11814-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v1] crypto: Wipe the struct key_parameters copies after use |

Commit Message

Gert Doering Nov. 5, 2026, 9:37 a.m. UTC 
  From: Hansaem Wi <hansaemw@gmail.com>

init_key_ctx_bi() and tls_crypt_v2_init_server_key() convert the key
into a struct key_parameters on the stack and return without clearing
it. init_key_ctx_bi() sets up the data channel keys (when epoch keys
are not used), tls-auth, tls-crypt and static keys, so the cipher and
HMAC keys stay on the stack after every key setup.
epoch_init_send_key() and epoch_init_recv_key() already clear their
struct key_parameters after use; do the same in these two places.

Assisted-by: Claude Code:claude-opus-5-5
Change-Id: Ic4243377c96a3b460d69050386cddcb30535de27
Signed-off-by: Hansaem Wi <hansaemw@gmail.com>
Acked-by: Steffan Karger <steffan@karger.me>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2078
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2078
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Steffan Karger <steffan@karger.me>

Comments

Gert Doering Nov. 5, 2026, 5:03 p.m. UTC | #1 
.. and the last one in this series ;-) - missed 2.7.9 release, due to
"day too short" issues, but 2.7.10 will come...

Your patch has been applied to the master and release/2.7 branch.

commit 09fd5ac8e4f679a58b02ed2f883ebf4a4d7205a7 (master)
commit 4608daa51451fd63c52cc2e44371608604259a99 (release/2.7)
Author: Hansaem Wi
Date:   Thu Nov 5 10:37:30 2026 +0100

     crypto: Wipe the struct key_parameters copies after use

     Signed-off-by: Hansaem Wi <hansaemw@gmail.com>
     Acked-by: Steffan Karger <steffan@karger.me>
     Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2078
     Message-Id: <20261105093736.11814-1-gert@greenie.muc.de>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg40749.html
     Signed-off-by: Gert Doering <gert@greenie.muc.de>


--
kind regards,

Gert Doering
diff mbox series

Patch

diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
index 3d3ab0c..a5d4a38 100644
--- a/src/openvpn/crypto.c
+++ b/src/openvpn/crypto.c
@@ -1075,6 +1075,9 @@ 
     init_key_bi_ctx_send(&ctx->encrypt, &send_key, kt, name);
     init_key_bi_ctx_recv(&ctx->decrypt, &recv_key, kt, name);
     ctx->initialized = true;
+
+    secure_memzero(&send_key, sizeof(send_key));
+    secure_memzero(&recv_key, sizeof(recv_key));
 }
 
 void
diff --git a/src/openvpn/tls_crypt.c b/src/openvpn/tls_crypt.c
index 23c7975..1ac25ce 100644
--- a/src/openvpn/tls_crypt.c
+++ b/src/openvpn/tls_crypt.c
@@ -359,6 +359,7 @@ 
 
     init_key_ctx(key_ctx, &srv_key_params, &kt, encrypt, "tls-crypt-v2 server key");
     secure_memzero(&srv_key, sizeof(srv_key));
+    secure_memzero(&srv_key_params, sizeof(srv_key_params));
 }
 
 static bool