From 731013033374f7d6b00e188764828c64ff565434 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Fri, 16 Aug 2024 12:52:19 +0200 Subject: [PATCH] psa: zeroize static key buffer content when key slot is freed Signed-off-by: Valerio Setti --- tf-psa-crypto/core/psa_crypto.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tf-psa-crypto/core/psa_crypto.c b/tf-psa-crypto/core/psa_crypto.c index b2e33fc77..0bd58206f 100644 --- a/tf-psa-crypto/core/psa_crypto.c +++ b/tf-psa-crypto/core/psa_crypto.c @@ -1183,7 +1183,11 @@ static psa_status_t psa_get_and_lock_transparent_key_slot_with_policy( psa_status_t psa_remove_key_data_from_memory(psa_key_slot_t *slot) { -#if !defined(MBEDTLS_PSA_STATIC_KEY_SLOTS) +#if defined(MBEDTLS_PSA_STATIC_KEY_SLOTS) + if (slot->key.bytes > 0) { + mbedtls_platform_zeroize(slot->key.data, MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE); + } +#else if (slot->key.data != NULL) { mbedtls_zeroize_and_free(slot->key.data, slot->key.bytes); }