Skip to content

openpgp: Zero the stack after nettle's ed25519::public_key

Ryan Heywood requested to merge ryan/zero-stack-ed25519-pubkey into main

libgmp, a dependency of nettle, does not appropriately zero the input after calling mpn_mul_n. Because of this, it is possible for an ed25519 private key to be kept on the stack. This only occurs on some systems and may depend on the optimization of the compiler building libgmp.

Fixes: #1080 (closed)

Merge request reports