cunicu / go-rosenpass

A port of Rosenpass post-quantum key-exchange protocol to Go.
Apache License 2.0
18 stars 1 forks source link

Zero-ize secrets #46

Open stv0g opened 1 year ago

stv0g commented 1 year ago

By @koraa in https://github.com/stv0g/go-rosenpass/issues/27#issuecomment-1604344997

Severity: 3 (Dangerous): No zeroization is attempted.

https://github.com/golang/go/issues/21865

stv0g commented 1 year ago

This is difficult to some degree as liboqs-go as well as circl to allocate []byte-slices for storing secrets themselves:

Related to #1