crypto-algorithms icon indicating copy to clipboard operation
crypto-algorithms copied to clipboard

Context doesn't get cleaned up after being used

Open rilysh opened this issue 1 year ago • 0 comments

Hello, The finalizing function of hash algorithms doesn't clean up their previously used buffers, as a result, anyone is able to read the data from the context. This is a bad thing as if it's being used to create private hashes, it might be possible that someone can snoop the context and retrieve the hash later.

A small solution would be purging everything with explicit memset function after calling the final function, and only keeping the hash to its target location.

Something like: memset(ctx, 0, sizeof(*ctx)); at the end of the final function.

rilysh avatar Nov 17 '23 13:11 rilysh