search

axelarnetwork / tofn

A threshold cryptography library in Rust
Apache License 2.0
112 stars 23 forks source link

[Blocked upstream] Don't use unsafe code to zeroize SigningKey #183

Closed ggutoski closed 3 years ago

ggutoski commented 3 years ago

I used unsafe Rust to hack an impl of Zeroize for k256_serde::SigningKey. That's bad. This issue needs to be fixed upstream.

[EDIT: it's already fixed upstream. All we need to do is wait for the next minor version of k256.]

https://github.com/axelarnetwork/tofn/blob/43592321837c670d7b6f62f746c06df3484cb39e/src/crypto_tools/k256_serde.rs#L101-L111

_Originally posted by @ggutoski in https://github.com/axelarnetwork/tofn/pull/182#discussion_r728440648_

tarcieri commented 3 years ago

It was fixed upstream here:

https://github.com/RustCrypto/elliptic-curves/pull/449

Unfortunately it won't be available until the next minor version.