From fdba31a3cc73f5a70127872e739a5694bc91f394 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kyle=20=F0=9F=90=86?= Date: Thu, 16 Jul 2026 12:16:46 -0400 Subject: [PATCH] keep-core: zeroize NIP-49 ncryptsec assembly buffer on drop --- keep-core/src/keys.rs | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/keep-core/src/keys.rs b/keep-core/src/keys.rs index 9f795d81..5476ab22 100644 --- a/keep-core/src/keys.rs +++ b/keep-core/src/keys.rs @@ -322,7 +322,11 @@ pub mod nip49 { .encrypt(&XNonce::from(nonce), payload) .map_err(|_| CryptoError::encryption("NIP-49 encryption failed"))?; - let mut concat = Vec::with_capacity(91); + // Zeroize the assembled buffer on drop. It holds only the salt, nonce, + // and ciphertext (the plaintext key never enters it), but the salt and + // nonce are still worth clearing from memory. `with_capacity(91)` is the + // exact ncryptsec length, so no reallocation leaves an un-zeroed copy. + let mut concat = Zeroizing::new(Vec::with_capacity(91)); concat.push(VERSION); concat.push(log_n); concat.extend_from_slice(&salt);