sha1_hmac(), sha256_hmac() and the mbedTLS sha1 shim build the HMAC key schedule in local arrays and clear it with memset() before returning; sm3_update() and sm3_final() do the same with the SM3 message schedule. Those buffers die with the frame, so the stores are dead and GCC removes them from -O1 up.
Patch 1 takes memzero_explicit() from the Linux kernel and uses it for the three HMAC key schedules, where the buffer holds the caller's key. Patch 2 does the same for the SM3 message schedule, whose clear sits under the "Zeroize sensitive information." comment. In U-Boot the caller is the TPM 1.2 code, where the key is the usage auth of a TPM key. Reading it back requires something that reads the stack afterwards, so this is the lifetime of the secret rather than a direct read. Measured against main (211de43) with GCC 13.3.0, each file compiled on its own with -fdump-tree-dse-details: the dead store pass removes the clears in all four files before the series and none of them after it. checkpatch reports no errors and no warnings. Changes in v2: - memzero_explicit() is now the Linux kernel version - a static inline in include/linux/string.h - rather than a function added to lib/string.c - shorter commit messages, and function names instead of line numbers Xiaoyi Suo (2): lib: add memzero_explicit() and use it for the HMAC key schedules lib: use memzero_explicit() for the SM3 message schedule include/linux/string.h | 21 +++++++++++++++++++++ lib/mbedtls/sha1.c | 8 ++++---- lib/sha1.c | 8 ++++---- lib/sha256.c | 10 +++++----- lib/sm3.c | 4 ++-- 5 files changed, 36 insertions(+), 15 deletions(-) -- 2.43.0
