Securely zero key material before freeing memory

[ilammy]

It is a good security practice to wipe sensitive data from memory as soon as it no longer needed. Obviously, the data has to be in memory for some time but we should not keep it around for more than absolutely necessary. The data in a memory region is not erased when the memory is freed so we have to make sure it's gone ourselves.

Initially I was overconfident and tried writing my own zeroing. Don't do this, kids. There's a whole load of issues that need to be resolved in order to securely zero out a memory region. You can read the implementation details in the source code of "zeroize" or elsewhere.

Therefore we use a dedicated library for the task. It makes sure that the compiler does not optimize away the code that tries its best to write zeros into the main memory (not the caches). Currently zeroize does not use these fancy functions like memset_s(), explicit_bzero(), RtlSecureZeroMemory(), etc. but it might it the future.

There's also a test to verify that the memory is indeed zeroed out. By definition, the test contains some technically unsafe code, but it's unlikely to crash or misbehave.

@Lagovas was concerned about this feature in cossacklabs/themis#340. These changes will be included in the next bulk PR into the main Themis repository (along with other stuff).

[vixentael]

Wow, didn't expect it to be so complicated to zero value in memory.

[ilammy]

Well, I also thought that a simple destructor like this

impl Drop for KeyBytes {
    fn drop(&mut self) {
        for byte in self.0.iter_mut() {
            *byte = 0;
        }
    }
}

will do just fine (and it kinda does: at least, the test passes with this, even in release mode).

But then I got curious about all the fuss around secure zeroing, looked around a bit, and the reasoning behind those complications makes sense now. The test may pass, but that's probably because it's running in a single threaded environment and the compiler may actually see the pointer aliasing (I did not study LLVM's output to say for sure).