Zeroize memory in SHA3 implementation (#2171)

* Add OQS_MEM_aligned_secure_free convenience fn

Signed-off-by: Aiden Fox Ivey <[email protected]>

* Rewrite SHA3 aligned frees to zeroize

Signed-off-by: Aiden Fox Ivey <[email protected]>

---------

Signed-off-by: Aiden Fox Ivey <[email protected]>

Author: aidenfoxivey

src/common/common.c

@@ -411,6 +411,11 @@ void OQS_MEM_aligned_free(void *ptr) {
 #endif
 }
 
+void OQS_MEM_aligned_secure_free(void *ptr, size_t len) {
+	OQS_MEM_cleanse(ptr, len);
+	OQS_MEM_aligned_free(ptr);
+}
+
 OQS_API void *OQS_MEM_malloc(size_t size) {
 #if defined(OQS_USE_OPENSSL)
 	return OSSL_FUNC(CRYPTO_malloc)(size, OPENSSL_FILE, OPENSSL_LINE);

src/common/common.h

@@ -274,6 +274,11 @@ void *OQS_MEM_aligned_alloc(size_t alignment, size_t size);
  */
 void OQS_MEM_aligned_free(void *ptr);
 
+/**
+ * Free and zeroize memory allocated with OQS_MEM_aligned_alloc.
+ */
+void OQS_MEM_aligned_secure_free(void *ptr, size_t len);
+
 #if defined(__cplusplus)
 } // extern "C"
 #endif

src/common/sha3/xkcp_sha3.c

@@ -224,7 +224,7 @@ static void SHA3_sha3_256_inc_finalize(uint8_t *output, OQS_SHA3_sha3_256_inc_ct
 }
 
 static void SHA3_sha3_256_inc_ctx_release(OQS_SHA3_sha3_256_inc_ctx *state) {
-	OQS_MEM_aligned_free(state->ctx);
+	OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES);
 }
 
 static void SHA3_sha3_256_inc_ctx_clone(OQS_SHA3_sha3_256_inc_ctx *dest, const OQS_SHA3_sha3_256_inc_ctx *src) {
@@ -260,7 +260,7 @@ static void SHA3_sha3_384_inc_finalize(uint8_t *output, OQS_SHA3_sha3_384_inc_ct
 }
 
 static void SHA3_sha3_384_inc_ctx_release(OQS_SHA3_sha3_384_inc_ctx *state) {
-	OQS_MEM_aligned_free(state->ctx);
+	OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES);
 }
 
 static void SHA3_sha3_384_inc_ctx_clone(OQS_SHA3_sha3_384_inc_ctx *dest, const OQS_SHA3_sha3_384_inc_ctx *src) {
@@ -297,7 +297,7 @@ static void SHA3_sha3_512_inc_finalize(uint8_t *output, OQS_SHA3_sha3_512_inc_ct
 }
 
 static void SHA3_sha3_512_inc_ctx_release(OQS_SHA3_sha3_512_inc_ctx *state) {
-	OQS_MEM_aligned_free(state->ctx);
+	OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES);
 }
 
 static void SHA3_sha3_512_inc_ctx_clone(OQS_SHA3_sha3_512_inc_ctx *dest, const OQS_SHA3_sha3_512_inc_ctx *src) {
@@ -344,7 +344,7 @@ static void SHA3_shake128_inc_ctx_clone(OQS_SHA3_shake128_inc_ctx *dest, const O
 }
 
 static void SHA3_shake128_inc_ctx_release(OQS_SHA3_shake128_inc_ctx *state) {
-	OQS_MEM_aligned_free(state->ctx);
+	OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES);
 }
 
 static void SHA3_shake128_inc_ctx_reset(OQS_SHA3_shake128_inc_ctx *state) {
@@ -383,7 +383,7 @@ static void SHA3_shake256_inc_squeeze(uint8_t *output, size_t outlen, OQS_SHA3_s
 }
 
 static void SHA3_shake256_inc_ctx_release(OQS_SHA3_shake256_inc_ctx *state) {
-	OQS_MEM_aligned_free(state->ctx);
+	OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES);
 }
 
 static void SHA3_shake256_inc_ctx_clone(OQS_SHA3_shake256_inc_ctx *dest, const OQS_SHA3_shake256_inc_ctx *src) {

src/common/sha3/xkcp_sha3x4.c

@@ -197,7 +197,7 @@ static void SHA3_shake128_x4_inc_ctx_clone(OQS_SHA3_shake128_x4_inc_ctx *dest, c
 }
 
 static void SHA3_shake128_x4_inc_ctx_release(OQS_SHA3_shake128_x4_inc_ctx *state) {
-	OQS_MEM_aligned_free(state->ctx);
+	OQS_MEM_aligned_secure_free(state->ctx, KECCAK_X4_CTX_BYTES);
 }
 
 static void SHA3_shake128_x4_inc_ctx_reset(OQS_SHA3_shake128_x4_inc_ctx *state) {
@@ -240,7 +240,7 @@ static void SHA3_shake256_x4_inc_ctx_clone(OQS_SHA3_shake256_x4_inc_ctx *dest, c
 }
 
 static void SHA3_shake256_x4_inc_ctx_release(OQS_SHA3_shake256_x4_inc_ctx *state) {
-	OQS_MEM_aligned_free(state->ctx);
+	OQS_MEM_aligned_secure_free(state->ctx, KECCAK_X4_CTX_BYTES);
 }
 
 static void SHA3_shake256_x4_inc_ctx_reset(OQS_SHA3_shake256_x4_inc_ctx *state) {