search

dalek-cryptography / curve25519-dalek

A pure-Rust implementation of group operations on Ristretto and Curve25519
Other
853 stars 422 forks source link

`Debug` implementation of `SigningKey` will print secret key material #591

Closed Erik1000 closed 8 months ago

Erik1000 commented 8 months ago

Since the Debug implementation of SigningKey is derived, the secret_key is being printed and because SecretKey is just a type alias for [u8; 32], it uses the std debug implementation for [T; N]:

https://github.com/dalek-cryptography/curve25519-dalek/blob/598695c4007d7ee3f48760668c47cf89b9aefb67/ed25519-dalek/src/signing.rs#L61-L64

I think in order to protect users from leaking their secret key, this should be omitted in the Debug output.

tarcieri commented 8 months ago

Opened #592 to address this