From 98a78d7a58707ef37d9705cc2441e50f63b78066 Mon Sep 17 00:00:00 2001
From: Henry de Valence <hdevalence@hdevalence.ca>
Date: Tue, 28 Nov 2017 14:40:50 -0800
Subject: [PATCH] Clear scalar digits from memory in multiscalar_mult

---
 Cargo.toml     |  6 +++++-
 build.rs       |  1 +
 src/edwards.rs | 12 +++++++++---
 src/lib.rs     |  2 ++
 4 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 470d7e5..8355dd5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -39,6 +39,9 @@ version = "0.6"
 version = "^0.3"
 default-features = false
 
+[dependencies.clear_on_drop]
+version = "=0.2.3"
+
 [dependencies.generic-array]
 # same version that digest depends on
 version = "^0.8"
@@ -55,13 +58,14 @@ rand = "0.3"
 generic-array = "^0.8"
 digest = "0.6"
 arrayref = "0.3.4"
+clear_on_drop = "=0.2.3"
 
 [build-dependencies.serde]
 version = "1.0"
 optional = true
 
 [features]
-nightly = ["radix_51", "subtle/nightly"]
+nightly = ["radix_51", "subtle/nightly", "clear_on_drop/nightly"]
 default = ["std"]
 std = ["rand", "subtle/std"]
 alloc = []
diff --git a/build.rs b/build.rs
index 13d9715..7fa55da 100644
--- a/build.rs
+++ b/build.rs
@@ -8,6 +8,7 @@ extern crate subtle;
 extern crate rand;
 extern crate digest;
 extern crate generic_array;
+extern crate clear_on_drop;
 
 use std::env;
 use std::fs::File;
diff --git a/src/edwards.rs b/src/edwards.rs
index f8101df..bd639ae 100644
--- a/src/edwards.rs
+++ b/src/edwards.rs
@@ -235,7 +235,7 @@ impl Equal for ExtendedPoint {
 // ------------------------------------------------------------------------
 
 impl ExtendedPoint {
-    /// Convert to a `ProjectiveNielsPoint`
+    /// Convert to a ProjectiveNielsPoint
     pub(crate) fn to_projective_niels(&self) -> ProjectiveNielsPoint {
         ProjectiveNielsPoint{
             Y_plus_X:  &self.Y + &self.X,
@@ -519,9 +519,15 @@ pub fn multiscalar_mult<'a, 'b, I, J>(scalars: I, points: J) -> ExtendedPoint
     //    s_i = s_{i,0} + s_{i,1}*16^1 + ... + s_{i,63}*16^63,
     //
     // with `-8 ≤ s_{i,j} < 8` for `0 ≤ j < 63` and `-8 ≤ s_{i,63} ≤ 8`.
-    let scalar_digits_list: Vec<_> = scalars.into_iter()
+    let scalar_digits_vec: Vec<_> = scalars.into_iter()
         .map(|c| c.to_radix_16()).collect();
 
+    // This above puts the scalar digits into a heap-allocated Vec.
+    // To ensure that these are erased, pass ownership of the Vec into a
+    // ClearOnDrop wrapper.
+    use clear_on_drop::ClearOnDrop;
+    let scalar_digits = ClearOnDrop::new(scalar_digits_vec);
+
     // Compute s_1*P_1 + ... + s_n*P_n: since
     //
     //    s_i*P_i = P_i*(s_{i,0} +     s_{i,1}*16^1 + ... +     s_{i,63}*16^63)
@@ -545,7 +551,7 @@ pub fn multiscalar_mult<'a, 'b, I, J>(scalars: I, points: J) -> ExtendedPoint
     // XXX this impl makes no effort to be cache-aware; maybe it could be improved?
     for j in (0..64).rev() {
         Q = Q.mult_by_pow_2(4);
-        let it = scalar_digits_list.iter().zip(lookup_tables.iter());
+        let it = scalar_digits.iter().zip(lookup_tables.iter());
         for (s_i, lookup_table_i) in it {
             // R_i = s_{i,j} * P_i
             let R_i = select_precomputed_point(s_i[j], lookup_table_i);
diff --git a/src/lib.rs b/src/lib.rs
index 2756376..51364f0 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -47,6 +47,8 @@ extern crate rand;
 #[cfg(feature = "alloc")]
 extern crate alloc;
 
+extern crate clear_on_drop;
+
 #[cfg(all(test, feature = "bench"))]
 extern crate test;