From a0384be8fcb9d7e41c325fe73354975e32257354 Mon Sep 17 00:00:00 2001
From: Tony Arcieri <bascule@gmail.com>
Date: Tue, 20 Dec 2022 02:28:20 -0700
Subject: [PATCH] Impl `Drop`/`ZeroizeOnDrop` for `SigningKey` (#247)

- Zeros out `SigningKey::secret_key` on drop
- Adds the `ZeroizeOnDrop` marker trait to `SigningKey`
---
 Cargo.toml     |  2 +-
 src/signing.rs | 10 +++++++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 6040fb4..a23d71d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -32,7 +32,7 @@ rand_core = { version = "0.6", default-features = false, optional = true }
 serde_crate = { package = "serde", version = "1.0", default-features = false, optional = true }
 serde_bytes = { version = "0.11", optional = true }
 sha2 = { version = "0.10", default-features = false }
-zeroize = { version = "1", default-features = false }
+zeroize = { version = "1.5", default-features = false }
 
 [dev-dependencies]
 hex = "^0.4"
diff --git a/src/signing.rs b/src/signing.rs
index 07d5553..1f6a4eb 100644
--- a/src/signing.rs
+++ b/src/signing.rs
@@ -32,7 +32,7 @@ use curve25519_dalek::scalar::Scalar;
 
 use ed25519::signature::{KeypairRef, Signer, Verifier};
 
-use zeroize::Zeroize;
+use zeroize::{Zeroize, ZeroizeOnDrop};
 
 use crate::constants::*;
 use crate::errors::*;
@@ -512,6 +512,14 @@ impl TryFrom<&[u8]> for SigningKey {
     }
 }
 
+impl Drop for SigningKey {
+    fn drop(&mut self) {
+        self.secret_key.zeroize();
+    }
+}
+
+impl ZeroizeOnDrop for SigningKey {}
+
 #[cfg(feature = "pkcs8")]
 impl DecodePrivateKey for SigningKey {}