Tweak zeroization

ghash/Cargo.toml

@@ -18,11 +18,8 @@ as in the AES-GCM authenticated encryption cipher.
 [dependencies]
 polyval = { version = "0.7", features = ["hazmat"] }
 
-# optional dependencies
-zeroize = { version = "1", optional = true, default-features = false }
-
 [features]
-zeroize = ["polyval/zeroize", "dep:zeroize"]
+zeroize = ["polyval/zeroize"]
 
 [dev-dependencies]
 hex-literal = "1"

ghash/src/lib.rs

@@ -15,9 +15,6 @@ use universal_hash::{
     consts::U16,
 };
 
-#[cfg(feature = "zeroize")]
-use zeroize::Zeroize;
-
 /// GHASH keys (16-bytes)
 pub type Key = universal_hash::Key<GHash>;
 
@@ -42,13 +39,8 @@ impl GHash {
     /// Initialize GHASH with the given `H` field element as the key.
     #[inline]
     pub fn new(h: &Key) -> Self {
-        #[allow(unused_mut)]
-        let mut h_polyval = FieldElement::from(*h).reverse().mulx();
-        #[allow(clippy::let_and_return)]
-        let result = Self(Polyval::new(&h_polyval.into()));
-        #[cfg(feature = "zeroize")]
-        h_polyval.zeroize();
-        result
+        let h_polyval = FieldElement::from(*h).reverse().mulx();
+        Self(Polyval::new(&h_polyval.into()))
     }
 }
 

poly1305/src/backend/autodetect.rs

@@ -1,7 +1,7 @@
 //! Autodetection support for AVX2 CPU intrinsics on x86 CPUs, with fallback
 //! to the "soft" backend when it's unavailable.
 
-use universal_hash::{UhfClosure, UniversalHash, common::BlockSizeUser, consts::U16};
+use universal_hash::{UhfClosure, consts::U16};
 
 use crate::{Block, Key, Tag, backend};
 use core::mem::ManuallyDrop;
@@ -18,10 +18,6 @@ union Inner {
     soft: ManuallyDrop<backend::soft::State>,
 }
 
-impl BlockSizeUser for State {
-    type BlockSize = U16;
-}
-
 impl State {
     /// Initialize Poly1305 [`State`] with the given key
     #[inline]
@@ -50,24 +46,20 @@ impl State {
             unsafe { (*self.inner.soft).compute_block(block, partial) }
         }
     }
-}
 
-impl UniversalHash for State {
-    fn update_with_backend(&mut self, f: impl UhfClosure<BlockSize = Self::BlockSize>) {
+    pub(crate) fn update_with_backend(&mut self, f: impl UhfClosure<BlockSize = U16>) {
         if self.token.get() {
             unsafe { f.call(&mut *self.inner.avx2) }
         } else {
             unsafe { f.call(&mut *self.inner.soft) }
         }
     }
 
-    /// Finalize output producing a [`Tag`]
-    #[inline]
-    fn finalize(mut self) -> Tag {
+    pub(crate) fn finalize(&mut self) -> Tag {
         if self.token.get() {
             unsafe { (*self.inner.avx2).finalize() }
         } else {
-            unsafe { (*self.inner.soft).finalize_mut() }
+            unsafe { (*self.inner.soft).finalize() }
         }
     }
 }
@@ -90,13 +82,3 @@ impl Clone for State {
         }
     }
 }
-
-#[cfg(feature = "zeroize")]
-impl Drop for State {
-    fn drop(&mut self) {
-        use zeroize::Zeroize;
-        const SIZE: usize = size_of::<State>();
-        let state = unsafe { &mut *core::ptr::from_mut::<State>(self).cast::<[u8; SIZE]>() };
-        state.zeroize();
-    }
-}

poly1305/src/backend/soft.rs

@@ -13,7 +13,7 @@
 // https://github.com/floodyberry/poly1305-donna
 
 use universal_hash::{
-    UhfBackend, UhfClosure, UniversalHash,
+    UhfBackend, UhfClosure,
     common::{BlockSizeUser, ParBlocksSizeUser},
     consts::{U1, U16},
 };
@@ -139,8 +139,13 @@ impl State {
         self.h[4] = h4;
     }
 
+    #[allow(unused, reason = "this method is used by some targets")]
+    pub(crate) fn update_with_backend(&mut self, f: impl UhfClosure<BlockSize = U16>) {
+        f.call(self);
+    }
+
     /// Finalize output producing a [`Tag`]
-    pub(crate) fn finalize_mut(&mut self) -> Tag {
+    pub(crate) fn finalize(&mut self) -> Tag {
         // fully carry h
         let mut h0 = self.h[0];
         let mut h1 = self.h[1];
@@ -232,16 +237,6 @@ impl State {
     }
 }
 
-#[cfg(feature = "zeroize")]
-impl Drop for State {
-    fn drop(&mut self) {
-        use zeroize::Zeroize;
-        self.r.zeroize();
-        self.h.zeroize();
-        self.pad.zeroize();
-    }
-}
-
 impl BlockSizeUser for State {
     type BlockSize = U16;
 }
@@ -255,14 +250,3 @@ impl UhfBackend for State {
         self.compute_block(block, false);
     }
 }
-
-impl UniversalHash for State {
-    fn update_with_backend(&mut self, f: impl UhfClosure<BlockSize = Self::BlockSize>) {
-        f.call(self);
-    }
-
-    /// Finalize output producing a [`Tag`]
-    fn finalize(mut self) -> Tag {
-        self.finalize_mut()
-    }
-}

poly1305/src/fuzz.rs

@@ -1,5 +1,3 @@
-use universal_hash::UniversalHash;
-
 use crate::{Block, Key, backend};
 
 /// Helper function for fuzzing the AVX2 backend.

poly1305/src/lib.rs

@@ -85,7 +85,7 @@ impl UniversalHash for Poly1305 {
     }
 
     /// Get the hashed output
-    fn finalize(self) -> Tag {
+    fn finalize(mut self) -> Tag {
         self.state.finalize()
     }
 }
@@ -119,6 +119,16 @@ impl Debug for Poly1305 {
     }
 }
 
+impl Drop for Poly1305 {
+    fn drop(&mut self) {
+        // SAFETY: `Poly1305` satisfies the safety conditions of `zeroize_flat_type`
+        #[cfg(feature = "zeroize")]
+        unsafe {
+            zeroize::zeroize_flat_type(self);
+        }
+    }
+}
+
 #[cfg(all(
     any(target_arch = "x86", target_arch = "x86_64"),
     not(poly1305_backend = "soft"),

polyval/src/backend/intrinsics.rs

@@ -10,9 +10,6 @@ use crate::{Block, Key, ParBlocks, Tag, field_element::FieldElement};
 mod intrinsics_impl;
 use intrinsics_impl::InitToken;
 
-#[cfg(feature = "zeroize")]
-use zeroize::Zeroize;
-
 /// State of a POLYVAL hash operation.
 #[derive(Clone)]
 pub(crate) struct State {
@@ -88,14 +85,6 @@ impl State {
     }
 }
 
-#[cfg(feature = "zeroize")]
-impl Zeroize for State {
-    fn zeroize(&mut self) {
-        self.expanded_key.zeroize();
-        self.acc.zeroize();
-    }
-}
-
 /// Precomputed key material for POLYVAL using R/F algorithm
 ///
 /// Stores H and D values for each power, where D = swap(H) ⊕ (H0 × P1)
@@ -118,17 +107,3 @@ pub(crate) struct ExpandedKey {
     /// D^4
     d4: FieldElement,
 }
-
-#[cfg(feature = "zeroize")]
-impl Zeroize for ExpandedKey {
-    fn zeroize(&mut self) {
-        self.h1.zeroize();
-        self.d1.zeroize();
-        self.h2.zeroize();
-        self.d2.zeroize();
-        self.h3.zeroize();
-        self.d3.zeroize();
-        self.h4.zeroize();
-        self.d4.zeroize();
-    }
-}

polyval/src/backend/soft.rs

@@ -5,9 +5,6 @@
 
 use crate::{Block, Key, ParBlocks, Tag, field_element::FieldElement};
 
-#[cfg(feature = "zeroize")]
-use zeroize::Zeroize;
-
 /// State of a POLYVAL hash operation.
 #[derive(Clone)]
 #[allow(missing_copy_implementations)]
@@ -49,11 +46,3 @@ impl State {
         self.y = FieldElement::default();
     }
 }
-
-#[cfg(feature = "zeroize")]
-impl Zeroize for State {
-    fn zeroize(&mut self) {
-        self.h.zeroize();
-        self.y.zeroize();
-    }
-}

polyval/src/field_element.rs

@@ -39,9 +39,6 @@ use core::{
     ops::{Add, BitAnd, BitOr, BitXor, Mul, MulAssign, Shl},
 };
 
-#[cfg(feature = "zeroize")]
-use zeroize::Zeroize;
-
 /// An element in POLYVAL's field.
 ///
 /// This type represents an element of the binary field GF(2^128) modulo the irreducible polynomial
@@ -165,13 +162,6 @@ impl MulAssign for FieldElement {
     }
 }
 
-#[cfg(feature = "zeroize")]
-impl Zeroize for FieldElement {
-    fn zeroize(&mut self) {
-        self.0.zeroize();
-    }
-}
-
 /// Multiplication in GF(2)[X], implemented generically for use with `u32` and `u64`.
 ///
 /// Uses "holes" (sequences of zeroes) to avoid carry spilling, as specified in the mask operand