fix(crypto): add missing memzero to `ed25519.c`
What the developer wrote
Authored by M1nd3r
fix(crypto): add missing memzero to `ed25519.c`
[no changelog]
What changed, and why it matters
This commit fixes a small cleanup bug in the code that creates Ed25519 digital signatures in Trezor hardware wallets. When a certain rare mathematical check fails, the function now securely wipes two temporary secret values from memory before returning an error. Without the fix, those temporary secrets could remain in memory longer than intended. This is a defense-in-depth improvement rather than a confirmed exploitable vulnerability.
Treat as a low-risk hardening fix. Include in routine firmware updates. No urgent advisory is required unless the vendor's own security review identifies a concrete exploit path.
Security signals we found
Missing secure wipe (memzero) on early error return
Sensitive local variables: extended secret key and nonce scalar
Ed25519/CoSi signing context
Defense-in-depth memory hygiene fix
Evidence from the diff
In ed25519_cosi_sign() in crypto/ed25519-donna/ed25519.c, the early-return path taken when is_reduced256_modm(r) is false previously did not clear the local variables extsk (extended secret key) and r (nonce scalar). The patch adds memzero() calls for both before returning -1. The normal successful path already performs equivalent cleanup elsewhere. The change reduces the window in which sensitive intermediate material could persist in stack or register state after a signing failure.
Changed components
crypto/ed25519-donna/ed25519.ced25519_cosi_sign functionInspect captured patch +4 / −1
diff --git a/crypto/ed25519-donna/ed25519.c b/crypto/ed25519-donna/ed25519.c
index 97e18fbb..adc608d3 100644
--- a/crypto/ed25519-donna/ed25519.c
+++ b/crypto/ed25519-donna/ed25519.c
@@ -77,8 +77,11 @@ ED25519_FN(ed25519_cosi_sign) (const unsigned char *m, size_t mlen, const ed2551
/* r */
expand_raw256_modm(r, nonce);
- if (!is_reduced256_modm(r))
+ if (!is_reduced256_modm(r)) {
+ memzero(&extsk, sizeof(extsk));
+ memzero(&r, sizeof(r));
return -1;
+ }
/* S = H(R,A,m).. */
ed25519_hram(hram, R, pk, m, mlen);
Why this scored 42/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.