crypto: cleanse HMAC hasher state and MuSig2 signing keypair #36537

pull fametrano wants to merge 2 commits into bitcoin:master from fametrano:crypto-cleanse-hmac-musig changing 5 files +17 −3
  1. fametrano commented at 7:11 AM on October 15, 2026: contributor

    CHMAC_SHA256 and CHMAC_SHA512 do not wipe their two hasher objects when they are destroyed. After Finalize() these still hold the HMAC output and the last bytes of the message, so CExtKey::SetSeed() leaves the seed and the master key behind, and BIP32Hash() for a hardened child leaves the parent private key. CreateMuSig2PartialSig() also leaves a secp256k1_keypair, which contains the secret key, on the stack.

    I add destructors to both HMAC classes that memory_cleanse() the two hashers, following #35254, which cleansed rkey and temp in the same files. The MuSig2 keypair now comes from CKey::ComputeKeyPair(), which keeps it in secure memory. I checked with a small program, built from these files, that the seed and key bytes are in the HMAC object after Finalize() and gone after its destructor.

  2. crypto: cleanse HMAC hasher state on destruction
    CHMAC_SHA256 and CHMAC_SHA512 do not cleanse their two hasher objects
when they are destroyed. After Finalize(), the outer hasher's state
holds the HMAC output, and the inner hasher's buffer still holds the
last bytes of the message. For CExtKey::SetSeed() these are the master
key and the seed. For BIP32Hash() on a hardened child, they are the
child key tweak and the parent private key.

Add destructors that cleanse both hashers with memory_cleanse(), as
the ChaCha20 classes do. This completes the cleansing of rkey and temp
done in the same files by #35254.
    736aafeb97
  3. musig: use KeyPair for the partial signing keypair
    CreateMuSig2PartialSig() builds a secp256k1_keypair, which holds the
secret key, on the stack and leaves it there on every return path.
Build it with CKey::ComputeKeyPair() instead. KeyPair keeps it in
secure memory, which is cleansed when the function returns.
    14b3cb5780
  4. DrahtBot added the label Utils/log/libs on Oct 15, 2026
  5. DrahtBot commented at 7:11 AM on October 15, 2026: contributor

    <!--e57a25ab6845829454e8d69fc972939a-->

    The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

    <!--006a51241073e994b41acfe9ec718e94-->

    External sites

    <!--021abf342d371248e50ceaed478a90ca-->

    Reviews

    See the guideline and AI policy for information on the review process. A summary of reviews will appear here.

    <!--5faf32d7da4f0f540f40219e4f7537a3-->

  6. DrahtBot added the label CI failed on Oct 15, 2026
  7. fametrano commented at 2:11 PM on October 15, 2026: contributor

    The "i686, no IPC" failure looks unrelated: it is p2p_initial_headers_sync.py (test_noban_peer_timeout), and this PR only touches the HMAC and MuSig2 code. The same job passes on master. Could someone re-run it?

  8. maflcko commented at 3:48 PM on October 15, 2026: member

    The "i686, no IPC" failure looks unrelated: it is p2p_initial_headers_sync.py (test_noban_peer_timeout), and this PR only touches the HMAC and MuSig2 code. The same job passes on master. Could someone re-run it?

    Fixed in https://github.com/bitcoin/bitcoin/pull/36545

  9. maflcko closed this on Oct 15, 2026
  10. maflcko reopened this on Oct 15, 2026
  11. DrahtBot removed the label CI failed on Oct 15, 2026
Contributors
fametranoDrahtBotmaflcko
Labels
Utils/log/libs
Linked (view graph)
#35254 crypto: cleanse HMAC stack buffers after use and ChainCode
github-metadata-mirror

This is a metadata mirror of the GitHub repository bitcoin/bitcoin. This site is not affiliated with GitHub. Content is generated from a GitHub metadata backup.
generated: 2026-10-18 11:51 UTC
This site is hosted by @0xB10C
More mirrored repositories can be found on mirror.b10c.me