gh-Mbed-TLS/TF-PSA-Crypto

Watch

Fork 0

fix: zeroize stack buffer containing private key in deterministic ECDSA #798

Open

ChakshuGupta13 wants to merge 1 commit from ChakshuGupta13/fix/ecdsa-zeroize-stack-key into development

ChakshuGupta13 commented

2026-05-31 09:30:41 -05:00

(Migrated from github.com)

Summary

In mbedtls_ecdsa_sign_det_restartable(), the local stack buffer data[2 * MBEDTLS_ECP_MAX_BYTES] holds the raw ECDSA private key d (written via mbedtls_mpi_write_binary()) for HMAC-DRBG seeding per RFC 6979. After use, the buffer is not cleared in the cleanup path, leaving up to 66 bytes of key material on the stack until overwritten by subsequent calls.

Fix

Add mbedtls_platform_zeroize(data, sizeof(data)) to the cleanup path, before mbedtls_hmac_drbg_free().

Rationale

This brings ecdsa.c to parity with peer modules:

hmac_drbg.c: zeroes K[], seed[], buf[] at cleanup (5 call sites)
rsa.c: zeroes buf[], mask[], lhash[] at cleanup (4 call sites)
ecdsa.c: currently has zero uses of mbedtls_platform_zeroize in the entire file

Scope

Defense-in-depth hardening. The threat model (SECURITY.md) excludes direct local memory access, so this is not classified as a vulnerability fix — it is a missing cleanup consistent with existing project conventions.

Checklist

Signed-off-by matching author email
ChangeLog entry in ChangeLog.d/zeroize-ecdsa-stack.txt
Based on development branch
Tests: no functional behavior change; existing test suites cover ECDSA signing correctness

## Summary In `mbedtls_ecdsa_sign_det_restartable()`, the local stack buffer `data[2 * MBEDTLS_ECP_MAX_BYTES]` holds the raw ECDSA private key `d` (written via `mbedtls_mpi_write_binary()`) for HMAC-DRBG seeding per RFC 6979. After use, the buffer is not cleared in the cleanup path, leaving up to 66 bytes of key material on the stack until overwritten by subsequent calls. ## Fix Add `mbedtls_platform_zeroize(data, sizeof(data))` to the cleanup path, before `mbedtls_hmac_drbg_free()`. ## Rationale This brings `ecdsa.c` to parity with peer modules: - `hmac_drbg.c`: zeroes `K[]`, `seed[]`, `buf[]` at cleanup (5 call sites) - `rsa.c`: zeroes `buf[]`, `mask[]`, `lhash[]` at cleanup (4 call sites) - `ecdsa.c`: currently has **zero** uses of `mbedtls_platform_zeroize` in the entire file ## Scope Defense-in-depth hardening. The threat model (SECURITY.md) excludes direct local memory access, so this is not classified as a vulnerability fix — it is a missing cleanup consistent with existing project conventions. ## Checklist - [x] Signed-off-by matching author email - [x] ChangeLog entry in `ChangeLog.d/zeroize-ecdsa-stack.txt` - [x] Based on `development` branch - [ ] Tests: no functional behavior change; existing test suites cover ECDSA signing correctness

This pull request is broken due to missing fork information.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin 'ChakshuGupta13/fix/ecdsa-zeroize-stack-key:ChakshuGupta13/fix/ecdsa-zeroize-stack-key'

git switch 'ChakshuGupta13/fix/ecdsa-zeroize-stack-key'

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch 'development'

git merge --no-ff 'ChakshuGupta13/fix/ecdsa-zeroize-stack-key'

git switch 'ChakshuGupta13/fix/ecdsa-zeroize-stack-key'

git rebase 'development'

git switch 'development'

git merge --ff-only 'ChakshuGupta13/fix/ecdsa-zeroize-stack-key'

git switch 'ChakshuGupta13/fix/ecdsa-zeroize-stack-key'

git rebase 'development'

git switch 'development'

git merge --no-ff 'ChakshuGupta13/fix/ecdsa-zeroize-stack-key'

git switch 'development'

git merge --squash 'ChakshuGupta13/fix/ecdsa-zeroize-stack-key'

git switch 'development'

git merge --ff-only 'ChakshuGupta13/fix/ecdsa-zeroize-stack-key'

git switch 'development'

git merge 'ChakshuGupta13/fix/ecdsa-zeroize-stack-key'

git push origin 'development'

No reviewers

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

gh-Mbed-TLS/TF-PSA-Crypto!798

No description provided.

Rows
Columns