-
Notifications
You must be signed in to change notification settings - Fork 708
Open
Description
Hello,
The finalizing function of hash algorithms doesn't clean up their previously used buffers, as a result, anyone is able to read the data from the context. This is a bad thing as if it's being used to create private hashes, it might be possible that someone can snoop the context and retrieve the hash later.
A small solution would be purging everything with explicit memset function after calling the final function, and only keeping the hash to its target location.
Something like: memset(ctx, 0, sizeof(*ctx));
at the end of the final function.
Metadata
Metadata
Assignees
Labels
No labels