Skip to content
This repository was archived by the owner on Nov 15, 2023. It is now read-only.
This repository was archived by the owner on Nov 15, 2023. It is now read-only.

Ensure proper memory clean-up for secret in libsecp256k1 dependency. #9870

@Slesarew

Description

@Slesarew

Two other upstream crypto libraries are using zeroize to clear memory used for storing secrets (see https://docs.rs/ed25519-dalek/1.0.1/src/ed25519_dalek/secret.rs.html#43 and https://docs.rs/schnorrkel/0.9.1/src/schnorrkel/keys.rs.html#680), but libsecp256k1 apparently does not. This will normally not be a severe issue in substrate as this algorithm is not used much, but it might cause all secrets to memory leak in the Signer, which depends on sp-core and uses all 3 crypto algorithms to maximize future compatibility.

As discussed with @kirushik and @burdges in PM, so tagging them here as well.

Metadata

Metadata

Assignees

No one assigned

    Labels

    J2-unconfirmedIssue might be valid, but it’s not yet known.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions