Poly1305 one-time key (poly_key) left unzeroed on stack after _chacha20poly1305_init returns
Summary
_chacha20poly1305_init at chachapoly.c:52 declares uint8_t poly_key[CHACHA20POLY1305_KEY_SIZE=32]; pre-bzero at :56; generates ChaCha20 block 0 (the Poly1305 one-time key per RFC 8439 2.6) at :69-72; seeds poly1305_init at :75; returns at :79 with NO explicit_bzero(poly_key). Rest of file is disciplined: ctx explicit_bzero at :192/196, derived_key explicit_bzero at :274/295. poly_key is the only secret escaping zeroization. Per-message one-time key so leaking N does not reveal master key or enable passive decryption of other messages; useful only with separate nonce-reuse bug. Defense-in-depth/consistency. Fix: explicit_bzero(poly_key, sizeof poly_key) after poly1305_init.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0970 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Poly1305 one-time key (poly_key) left unzeroed on stack after _chacha20poly1305_ | 335 B | view raw |
Fix verification
fixedfix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/crypto/chachapoly.c:52: Poly1305 one-time key left unzeroed on stack after init (DSE)
Verified recommended fix
Source-confirmed at sys/crypto/chachapoly.c:52: Poly1305 one-time key left unzeroed on stack after init (DSE)
Verdict
Source-confirmed at sys/crypto/chachapoly.c:52: Poly1305 one-time key left unzeroed on stack after init (DSE)
No comments yet.