Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
During a recent code audit on another project, I noticed that the
argon2
,balloon-hash
andbcrypt-pbkdf
crates implemented in this code repository do not explicitly declare theirzeroize
feature variants for memory sanitization behavior.Fix this by adding explicit
Cargo.toml
[feature]
entries for thiszeroize
flag.By my current understanding, the relevant optional security hardening functionality which is gated by this feature flag can already be used by other crates today if they opt-in to its use in their
[dependencies]
reference, without requiring this patch because the relevant functionality gets picked up as an "implicit feature".However, by not explicitly announcing this optional security feature, some consumers will either miss that it exists, or do not regard it as a reliable stable functionality (which this PR assumes it is). See also Rust RFC3491 which will remove this implicit feature behavior in the future.
Prior example of this change: see sha1-checked.
Thanks to @hko-s for helping to debug this.
I do not consider this a direct security issue (as covered by
SECURITY.md
), because the hardening effect of memory sanitization is optional anyway and not guaranteed in existing documentation.