feat(cryptoops/handshaker): wipe ephemeral private key memory after handshake
Add wipeMemory calls for ephemeralPriv in both ClientHandshake and ServerHandshake functions to securely erase sensitive key material from memory immediately after handshake completion, enhancing security against potential key leakage.
lemon-mint committed
Oct 27, 2025 at 14:42 UTC
6c0d2041294d5836e249ed0a4c5a7bfb73937a27
1 file changed
+4
relaydns/core/cryptoops/handshaker.go
+4
@@ -298,6 +298,8 @@ func (h *Handshaker) ClientHandshake(conn io.ReadWriteCloser, alpn string) (*Sec
298
return nil, err
299
}
300
301
+ wipeMemory(ephemeralPriv)
302
+
303
// Create secure connection
304
return h.createSecureConnection(conn, clientEncryptKey, clientDecryptKey)
305
}
@@ -375,6 +377,8 @@ func (h *Handshaker) ServerHandshake(conn io.ReadWriteCloser, alpns []string) (*
377
return nil, err
378
}
379
380
+ wipeMemory(ephemeralPriv)
381
+
382
// Send server init message
383
serverInitBytes, err := proto.Marshal(serverInit)
384
if err != nil {