Delete the hash context before return in compute_rand_i_j
What the developer wrote
Authored by Salvatore Ingala
Delete the hash context before return in compute_rand_i_j
Defense-in-depth: once partial signatures are known, rand_i_j is
sensitive data, and the hash context might allow retrieving it if
leaked.
What changed, and why it matters
This commit adds a memory wipe of a cryptographic hash context after it is used to derive a secret random value in the Ledger Bitcoin app's MuSig multi-signature code. The change is described by the developer as a 'defense-in-depth' measure: once partial signatures are public, the internal randomness used to create them becomes sensitive, and leftover data in memory could theoretically help an attacker if they later gained access to the device's memory. There is no evidence this issue was exploited or publicly disclosed as a security vulnerability.
Treat as a low-risk hardening improvement. Review whether other MuSig/Musig2 functions that handle signing nonces, secret shares, or hash contexts perform similar explicit zeroing. No urgent user action is indicated.
Security signals we found
explicit_bzero added to clear sensitive cryptographic context
MuSig signing randomness treated as sensitive after partial signatures are known
Defense-in-depth memory hygiene patch
No bug fix, CVE, or exploit mechanism described in commit
Evidence from the diff
In compute_rand_i_j() in src/musig/musig_sessions.c, the function derives a 32-byte randomizer rand_i_j for MuSig2/MuSig signing sessions by hashing session data. Previously, the local hash_context stack variable was left uninitialized/explicitly-zeroed after crypto_hash_digest(). The patch adds explicit_bzero(&hash_context, sizeof(hash_context)) before returning. This prevents potential leakage of intermediate hash state or derived randomness through stack memory if the device is later compromised or if memory is dumped. The change is small, localized, and preventive rather than fixing an active bug or exploit path.
Changed components
src/musig/musig_sessions.ccompute_rand_i_j()MuSig signing session randomizer derivationInspect captured patch +3 / −0
### src/musig/musig_sessions.c
@@ -86,6 +86,9 @@ void compute_rand_i_j(const musig_psbt_session_t *psbt_session,
crypto_hash_update_u32(&hash_context.header, (uint32_t) i);
crypto_hash_update_u32(&hash_context.header, (uint32_t) j);
crypto_hash_digest(&hash_context.header, out, 32);
+
+ // avoid leaving sensitive randomness traces in memory
+ explicit_bzero(&hash_context, sizeof(hash_context));
}
void musigsession_initialize_signing_state(musig_signing_state_t *musig_signing_state) {Why this scored 33/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.