The ECDSA/SM2 signing nonce k is allocated with BN_new() in uadk_pkey_get_rand() and uadk_prov_pkey_get_rand(). Since leaking the nonce allows recovery of the private key, it should use BN_secure_new() and BN_clear_free() to keep it in secure memory and zero it on free. Signed-off-by: Weili Qian <qianweili@huawei.com> --- src/uadk_pkey.c | 4 ++-- src/uadk_prov_pkey.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/uadk_pkey.c b/src/uadk_pkey.c index 4f29f5e..9bb6a80 100644 --- a/src/uadk_pkey.c +++ b/src/uadk_pkey.c @@ -496,7 +496,7 @@ int uadk_ecc_get_rand(char *out, size_t out_len, void *usr) return -1; } - k = BN_new(); + k = BN_secure_new(); if (!k) return -ENOMEM; @@ -520,7 +520,7 @@ int uadk_ecc_get_rand(char *out, size_t out_len, void *usr) if (count < 0) ret = -1; err: - BN_free(k); + BN_clear_free(k); return ret; } diff --git a/src/uadk_prov_pkey.c b/src/uadk_prov_pkey.c index 41d0102..68750bd 100644 --- a/src/uadk_prov_pkey.c +++ b/src/uadk_prov_pkey.c @@ -134,7 +134,7 @@ int uadk_prov_ecc_get_rand(char *out, size_t out_len, void *usr) return UADK_P_INVALID; } - k = BN_new(); + k = BN_secure_new(); if (k == NULL) return -ENOMEM; @@ -158,7 +158,7 @@ int uadk_prov_ecc_get_rand(char *out, size_t out_len, void *usr) if (count < 0) ret = UADK_P_INVALID; err: - BN_free(k); + BN_clear_free(k); return ret; } -- 2.43.0