The key schedule arrays in sha1_hmac() are locals, and they are cleared right before the function returns. Nothing reads them again, so GCC removes the stores from -O1 up and the caller's key is left in the frame as 0x36 ^ key and 0x5c ^ key.
The only caller in U-Boot is the TPM 1.2 code, where the key is a TPM key's usage auth. Cc: Tom Rini <[email protected]> Signed-off-by: Xiaoyi Suo <[email protected]> --- lib/sha1.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/sha1.c b/lib/sha1.c index be502c612..94f20fb40 100644 --- a/lib/sha1.c +++ b/lib/sha1.c @@ -373,10 +373,10 @@ void sha1_hmac(const unsigned char *key, int keylen, sha1_update (&ctx, tmpbuf, 20); sha1_finish (&ctx, output); - memset (k_ipad, 0, 64); - memset (k_opad, 0, 64); - memset (tmpbuf, 0, 20); - memset (&ctx, 0, sizeof (sha1_context)); + memzero_explicit(k_ipad, 64); + memzero_explicit(k_opad, 64); + memzero_explicit(tmpbuf, 20); + memzero_explicit(&ctx, sizeof(sha1_context)); } #ifdef SELF_TEST -- 2.43.0
