digest: use ZeroizeOnDrop of the underlying types

Author: baloo

Cargo.lock

@@ -16,3 +16,6 @@ members = [
 [patch.crates-io]
 digest = { path = "digest" }
 signature = { path = "signature" }
+
+# https://github.com/RustCrypto/utils/pull/1192
+block-buffer = { git = "https://github.com/RustCrypto/utils.git" }

Cargo.toml

@@ -39,21 +39,6 @@ macro_rules! buffer_fixed {
             const OID: $crate::const_oid::ObjectIdentifier =
                 $crate::const_oid::ObjectIdentifier::new_unwrap($oid);
         }
-
-        impl$(< $( $lt $( : $clt $(+ $dlt )* )? ),+ >)? Drop for $name$(< $( $lt ),+ >)? {
-            #[inline]
-            fn drop(&mut self) {
-                #[cfg(feature = "zeroize")]
-                {
-                    use $crate::zeroize::Zeroize;
-                    self.core.zeroize();
-                    self.buffer.zeroize();
-                }
-            }
-        }
-
-        #[cfg(feature = "zeroize")]
-        impl$(< $( $lt $( : $clt $(+ $dlt )* )? ),+ >)? $crate::zeroize::ZeroizeOnDrop for $name$(< $( $lt ),+ >)? {}
     };
 
     // Terminates `impl_inner` sequences.
@@ -75,7 +60,7 @@ macro_rules! buffer_fixed {
         $crate::buffer_fixed!(
             impl_inner: $name$(< $( $lt $( : $clt $(+ $dlt )* )? ),+ >)?($core_ty);
             BaseFixedTraits AlgorithmName Default Clone HashMarker
-            Reset FixedOutputReset SerializableState $($trait_name)*;
+            Reset FixedOutputReset SerializableState ZeroizeOnDrop $($trait_name)*;
         );
     };
 
@@ -198,8 +183,8 @@ macro_rules! buffer_fixed {
                 Self { core, buffer }
             }
             fn decompose(self) -> (Self::Core, $crate::block_api::Buffer<Self::Core>) {
-                let Self { ref core, ref buffer } = self;
-                (core.clone(), buffer.clone())
+                let Self { core, buffer } = self;
+                (core, buffer)
             }
         }
 
@@ -491,5 +476,30 @@ macro_rules! buffer_fixed {
         }
 
         $crate::buffer_fixed!(impl_inner: $name$(< $( $lt $( : $clt $(+ $dlt )* )? ),+ >)?($core_ty); $($trait_name)*;);
-    }
+    };
+
+    // Implements `ZeroizeOnDrop`
+    (
+        impl_inner: $name:ident
+        $(< $( $lt:tt $( : $clt:tt $(+ $dlt:tt )* )? ),+ >)?
+        ($core_ty:ty);
+        ZeroizeOnDrop $($trait_name:ident)*;
+    ) => {
+        // Verify that `$core_ty` and `Bufer<$core_ty>` implement `ZeroizeOnDrop`
+        #[cfg(feature = "zeroize")]
+        const _: () = {
+            fn check_core$(< $( $lt $( : $clt $(+ $dlt )* )? ),+ >)?(v: &$core_ty) {
+                v as &dyn $crate::zeroize::ZeroizeOnDrop;
+            }
+
+            fn check_buffer$(< $( $lt $( : $clt $(+ $dlt )* )? ),+ >)?(v: &$crate::block_api::Buffer<$core_ty>) {
+                v as &dyn $crate::zeroize::ZeroizeOnDrop;
+            }
+        };
+
+        #[cfg(feature = "zeroize")]
+        impl$(< $( $lt $( : $clt $(+ $dlt )* )? ),+ >)? $crate::zeroize::ZeroizeOnDrop for $name$(< $( $lt ),+ >)? {}
+
+        $crate::buffer_fixed!(impl_inner: $name$(< $( $lt $( : $clt $(+ $dlt )* )? ),+ >)?($core_ty); $($trait_name)*;);
+    };
 }

digest/src/buffer_macros/fixed.rs

@@ -77,11 +77,15 @@ mod block_api {
     }
 
     #[cfg(feature = "zeroize")]
-    impl zeroize::Zeroize for FixedHashCore {
-        fn zeroize(&mut self) {
-            self.state.zeroize()
+    impl Drop for FixedHashCore {
+        fn drop(&mut self) {
+            use zeroize::Zeroize;
+            self.state.zeroize();
         }
     }
+
+    #[cfg(feature = "zeroize")]
+    impl zeroize::ZeroizeOnDrop for FixedHashCore {}
 }
 
 digest::buffer_fixed!(
@@ -106,3 +110,11 @@ digest::buffer_fixed!(
     oid: "0.1.2.3.4.5";
     impl: FixedHashTraits;
 );
+
+#[cfg(feature = "zeroize")]
+/// check for `ZeroizeOnDrop` implementations
+const _: () = {
+    const fn check_zeroize<T: zeroize::ZeroizeOnDrop>() {}
+    check_zeroize::<FixedHashWithSer>();
+    check_zeroize::<FixedHashWithOidSer>();
+};