Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Zeroize to fields and elliptic curves #106

Merged
merged 4 commits into from
Dec 3, 2020
Merged

Add Zeroize to fields and elliptic curves #106

merged 4 commits into from
Dec 3, 2020

Conversation

ValarDragon
Copy link
Member

@ValarDragon ValarDragon commented Dec 3, 2020

Description

This PR implements Zeroize for the Field, AffineGroup, and ProjectiveGroup traits.

Why Zeroize is helpful:

If you operate in the threat model of an attacker getting user space memory leakage (E.g. Heartbleed, cold boot attacks, DMA attacks), then a method to hopefully lower the probability of a succesful attack is to reduce the amount of time secrets are in memory.

This is pretty hard to do in the ideal sense, as you'd want all associated temporaries to be wiped as soon as possible (including register spills, the thread being switched etc.).

However if you have all temporaries be created in stack, then you can get some level of memory wiping by Zero'ing out your secret itself and everything on heap when you are done with them, and then hoping that everything that was created on stack gets written over relatively soon (or manually doing that with unsafe / some other method)

Adding Zeroize gives end application developers more of an ability to do the above, since they can now zeroize secrets, and use the secret trait, to allocate secrets on heap and have them be zero'd out when they're done.

cref: arkworks-rs/snark#111


Before we can merge this PR, please make sure that all the following items have been
checked off. If any of the checklist items are not applicable, please leave them but
write a little note why.

  • Targeted PR against correct branch (main)
  • Linked to Github issue with discussion and accepted design OR have an explanation in the PR that describes this work.
  • Wrote unit tests
  • Updated relevant documentation in the code
  • Added a relevant changelog entry to the Pending section in CHANGELOG.md
  • Re-reviewed Files changed in the Github PR explorer

@Pratyush
Copy link
Member

Pratyush commented Dec 3, 2020

Amazing, thanks!

@ValarDragon ValarDragon merged commit 4df2d24 into master Dec 3, 2020
@ValarDragon ValarDragon deleted the zeroize branch December 3, 2020 21:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants