From 23ab7a46a3c983e524ebe538320b84f0a67f2abb Mon Sep 17 00:00:00 2001 From: Jerry Yu Date: Wed, 8 Dec 2021 14:34:10 +0800 Subject: [PATCH] move zeroize master secrets Signed-off-by: Jerry Yu --- library/ssl_tls13_client.c | 3 +-- library/ssl_tls13_keys.c | 3 +++ 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c index 2e263844d..f21958692 100644 --- a/library/ssl_tls13_client.c +++ b/library/ssl_tls13_client.c @@ -1646,8 +1646,7 @@ static int ssl_tls13_flush_buffers( mbedtls_ssl_context *ssl ) */ static int ssl_tls13_handshake_wrapup( mbedtls_ssl_context *ssl ) { - mbedtls_platform_zeroize( &ssl->handshake->tls13_master_secrets, - sizeof(ssl->handshake->tls13_master_secrets)); + mbedtls_platform_zeroize( &ssl->handshake->tls13_hs_secrets, sizeof(ssl->handshake->tls13_hs_secrets)); diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c index 45f328735..765b7fdb8 100644 --- a/library/ssl_tls13_keys.c +++ b/library/ssl_tls13_keys.c @@ -1164,6 +1164,9 @@ int mbedtls_ssl_tls13_generate_application_keys( handshake->tls13_master_secrets.app, transcript, transcript_len, app_secrets ); + /* Erase master secrets*/ + mbedtls_platform_zeroize( &ssl->handshake->tls13_master_secrets, + sizeof(ssl->handshake->tls13_master_secrets)); if( ret != 0 ) { MBEDTLS_SSL_DEBUG_RET( 1,