diff --git a/ChangeLog.d/zeroizations_of_sensitive_data_in_PKCS5_and_SHA.txt b/ChangeLog.d/zeroizations_of_sensitive_data_in_PKCS5_and_SHA.txt index f8445615c..320bb0e86 100644 --- a/ChangeLog.d/zeroizations_of_sensitive_data_in_PKCS5_and_SHA.txt +++ b/ChangeLog.d/zeroizations_of_sensitive_data_in_PKCS5_and_SHA.txt @@ -1,5 +1,6 @@ Security * Zeroising of local buffers and variables which are used for calculations - in mbedtls_pkcs5_pbkdf2_hmac() and mbedtls_internal_sha*_process() + in mbedtls_pkcs5_pbkdf2_hmac(), mbedtls_internal_sha*_process(), + mbedtls_internal_md*_process() and mbedtls_internal_ripemd160_process() functions to erase sensitive data from memory. Reported by Johan Malmgren and Johan Uppman Bruce from Sectra. diff --git a/library/md2.c b/library/md2.c index 293ada304..eb4d0d03f 100644 --- a/library/md2.c +++ b/library/md2.c @@ -181,6 +181,9 @@ int mbedtls_internal_md2_process( mbedtls_md2_context *ctx ) t = ctx->cksum[i]; } + /* Zeroise variables to clear sensitive data from memory. */ + mbedtls_zeroize( &t, sizeof( t ) ); + return( 0 ); } diff --git a/library/md4.c b/library/md4.c index 69825595f..28e81c81d 100644 --- a/library/md4.c +++ b/library/md4.c @@ -247,6 +247,13 @@ int mbedtls_internal_md4_process( mbedtls_md4_context *ctx, ctx->state[2] += C; ctx->state[3] += D; + /* Zeroise variables to clear sensitive data from memory. */ + mbedtls_zeroize( &X, sizeof( X ) ); + mbedtls_zeroize( &A, sizeof( A ) ); + mbedtls_zeroize( &B, sizeof( B ) ); + mbedtls_zeroize( &C, sizeof( C ) ); + mbedtls_zeroize( &D, sizeof( D ) ); + return( 0 ); } diff --git a/library/md5.c b/library/md5.c index 009a013ef..9c75caeec 100644 --- a/library/md5.c +++ b/library/md5.c @@ -266,6 +266,13 @@ int mbedtls_internal_md5_process( mbedtls_md5_context *ctx, ctx->state[2] += C; ctx->state[3] += D; + /* Zeroise variables to clear sensitive data from memory. */ + mbedtls_zeroize( &X, sizeof( X ) ); + mbedtls_zeroize( &A, sizeof( A ) ); + mbedtls_zeroize( &B, sizeof( B ) ); + mbedtls_zeroize( &C, sizeof( C ) ); + mbedtls_zeroize( &D, sizeof( D ) ); + return( 0 ); } diff --git a/library/ripemd160.c b/library/ripemd160.c index aee112311..f58507773 100644 --- a/library/ripemd160.c +++ b/library/ripemd160.c @@ -325,6 +325,19 @@ int mbedtls_internal_ripemd160_process( mbedtls_ripemd160_context *ctx, ctx->state[4] = ctx->state[0] + B + Cp; ctx->state[0] = C; + /* Zeroise variables to clear sensitive data from memory. */ + mbedtls_zeroize( &A, sizeof( A ) ); + mbedtls_zeroize( &B, sizeof( B ) ); + mbedtls_zeroize( &C, sizeof( C ) ); + mbedtls_zeroize( &D, sizeof( D ) ); + mbedtls_zeroize( &E, sizeof( E ) ); + mbedtls_zeroize( &Ap, sizeof( Ap ) ); + mbedtls_zeroize( &Bp, sizeof( Bp ) ); + mbedtls_zeroize( &Cp, sizeof( Cp ) ); + mbedtls_zeroize( &Dp, sizeof( Dp ) ); + mbedtls_zeroize( &Ep, sizeof( Ep ) ); + mbedtls_zeroize( &X, sizeof( X ) ); + return( 0 ); }