From fbabe53462ca284d85b85bbc744853269e6044c2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Tue, 31 Mar 2026 10:18:08 +0200 Subject: [PATCH] ECDH: Everest: Fix private key managment (static) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Wiping out our private key is OK if we're only doing ephemeral ECDH, but our API also supports static Diffie-Hellman, where our private key is long term and should not be wiped out on first use... Found accidentally with the new test that try calling `calc_secret()` again with a larger output buffer and expect the same result. Signed-off-by: Manuel Pégourié-Gonnard --- 3rdparty/everest/library/x25519.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/3rdparty/everest/library/x25519.c b/3rdparty/everest/library/x25519.c index 83064dc619..68b636f487 100644 --- a/3rdparty/everest/library/x25519.c +++ b/3rdparty/everest/library/x25519.c @@ -131,12 +131,16 @@ int mbedtls_x25519_calc_secret( mbedtls_x25519_context *ctx, size_t *olen, if( blen < *olen ) return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ); - Hacl_Curve25519_crypto_scalarmult( buf, ctx->our_secret, ctx->peer_point); + /* scalarmult modifies this input, let's make a copy... */ + unsigned char secret[MBEDTLS_X25519_KEY_SIZE_BYTES]; + memcpy(secret, ctx->our_secret, sizeof(secret)); - /* Wipe the DH secret and don't let the peer chose a small subgroup point */ - mbedtls_platform_zeroize( ctx->our_secret, MBEDTLS_X25519_KEY_SIZE_BYTES ); + Hacl_Curve25519_crypto_scalarmult( buf, secret, ctx->peer_point); - if( memcmp( buf, ctx->our_secret, MBEDTLS_X25519_KEY_SIZE_BYTES) == 0 ) + /* Wipe the copy and don't let the peer chose a small subgroup point */ + mbedtls_platform_zeroize( secret, MBEDTLS_X25519_KEY_SIZE_BYTES ); + + if( memcmp( buf, secret, MBEDTLS_X25519_KEY_SIZE_BYTES) == 0 ) return MBEDTLS_ERR_ECP_RANDOM_FAILED; return( 0 );