chore: erase ephemeral secrets from memory in schnorr and aes

barretenberg/cpp/src/barretenberg/crypto/aes128/aes128.cpp

@@ -6,13 +6,12 @@
 
 #include "aes128.hpp"
 
+#include "barretenberg/crypto/hmac/hmac.hpp"
 #include "memory.h"
 #include <array>
 #include <cstddef>
 #include <cstdint>
 
-#include <iostream>
-
 namespace {
 
 static constexpr uint8_t round_constants[11] = { 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36 };
@@ -248,6 +247,7 @@ void aes128_encrypt_buffer_cbc(uint8_t* buffer, uint8_t* iv, const uint8_t* key,
         memcpy((void*)(buffer + (i * 16)), (void*)block_state, 16);
         memcpy((void*)iv, (void*)block_state, 16);
     }
+    secure_erase_bytes(round_key, sizeof(round_key));
 }
 
 void aes128_decrypt_buffer_cbc(uint8_t* buffer, uint8_t* iv, const uint8_t* key, const size_t length)
@@ -266,6 +266,7 @@ void aes128_decrypt_buffer_cbc(uint8_t* buffer, uint8_t* iv, const uint8_t* key,
         memcpy((void*)(buffer + (i * 16)), (void*)block_state, 16);
         memcpy((void*)iv, (void*)next_iv, 16);
     }
+    secure_erase_bytes(round_key, sizeof(round_key));
 }
 
 } // namespace bb::crypto

barretenberg/cpp/src/barretenberg/crypto/schnorr/schnorr.tcc

@@ -88,7 +88,6 @@ schnorr_signature schnorr_construct_signature(const std::string& message, const
     // method is overloaded to utilise a suitable entropy source
     // (see https://github.com/WebAssembly/WASI/blob/main/phases/snapshot/docs.md)
     //
-    // TODO(https://github.com/AztecProtocol/barretenberg/issues/895): securely erase `k`
     Fr k = Fr::random_element();
 
     typename G1::affine_element R(G1::one * k);
@@ -97,6 +96,7 @@ schnorr_signature schnorr_construct_signature(const std::string& message, const
     // the conversion from e_raw results in a biased field element e
     Fr e = Fr::serialize_from_buffer(&e_raw[0]);
     Fr s = k - (private_key * e);
+    secure_erase_bytes(&k, sizeof(k));
 
     // we serialize e_raw rather than e, so that no binary conversion needs to be
     // performed during verification.