Wipe the KEX shared secret once keys are derived - #1275
ejohnstown wants to merge 1 commit into
Conversation
DoKexDhReply() and SendKexDhReply() zero all of ssh->k and reset kSz on every exit, so K does not outlive the key exchange. GenerateKeys() zeroes both handshake key sets when a derivation fails. - the full-buffer wipe clears CreateMpint and ML-KEM hybrid leftovers - tests/regress.c checks K after each KEX, the hybrids included - tests/regress.c checks a failed derivation leaves no keys Issue: F-8845, F-11680, F-11681, F-8843, F-11682, F-14001
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Cleanup misses some exit paths and occurs too late before packet sending.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
Open (2)
What changed in this PR
Wipes KEX shared secrets and failed handshake key material earlier, with regression coverage.
Changes:
- Clears
ssh->kand resetskSz. - Clears handshake key sets when derivation fails.
- Adds KEX and failure-path tests.
| File | Summary |
|---|---|
tests/regress.c |
Verifies wiping behavior across handshakes and failures. |
src/internal.c |
Implements secret and key-material cleanup. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| /* K is only needed to derive the keys. Wipe all of it, success or not. */ | ||
| WS_FORCEZERO(ssh->k, sizeof(ssh->k)); | ||
| ssh->kSz = 0; |
| #ifndef WOLFSSH_NO_CURVE25519_MLKEM768_SHA256 | ||
| "mlkem768x25519-sha256", | ||
| #endif | ||
| NULL |
|
@wolfSSL-Fenrir-bot review |
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1275
Scan targets checked: wolfssh-src, wolfssh-bugs
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
Review tier: Lite
The KEX shared secret K stayed in ssh->k until the session was freed. It is now wiped as soon as the session keys are derived, whether the exchange succeeds or fails.