Zeroize in BLST

[paulhauner]

Description

I understand that BLST doesn't Zeroize secret keys. We make good effort to Zeroize other secret keys, so we should do the same here.

[sean-sn]

We added the zeroize attribute to SecretKey in the latest blst crate (v0.3.1). Let us know if that helps or if more should be done.

        #[derive(Default, Debug, Clone, Zeroize)]
        #[zeroize(drop)]
        pub struct SecretKey {
            value: blst_scalar,
        }

Some tests made separately by @pawanjay176 and myself suggest that we may want to be a bit more aggresive and drop the variables before the end of scope.

lighthouse/remote_signer/backend/src/zeroize_string.rs

Lines 73 to 95 in c6baa0e

	#[test]
	fn v_u8_zeroized() {
	// Create from `hex_string_to_bytes`, and record the pointer to its buffer.
	let mut decoded_bytes = hex_string_to_bytes(&SECRET_KEY_1.to_string()).unwrap();
	let old_pointer = decoded_bytes.as_ptr() as usize;
	// Do something with the borrowed vector, and zeroize.
	let _ = SecretKey::deserialize(&decoded_bytes)
	.map_err(|e| format!("{:?}", e))
	.unwrap();
	decoded_bytes.zeroize();
	// Check it is pointing to the same buffer, and that it was deleted.
	assert_eq!(old_pointer as usize, decoded_bytes.as_ptr() as usize);
	assert!(decoded_bytes.is_empty());
	// Check if the underlying bytes were zeroized.
	for i in 0..SECRET_KEY_1.len() / 2 {
	unsafe {
	assert_eq!(*((old_pointer + i) as *const u8), 0);
	}
	}
	}

lighthouse/remote_signer/backend/src/zeroize_string.rs

Lines 121 to 158 in c6baa0e

	#[test]
	fn zeroized_after_drop() {
	let some_scope = |s: &str| -> usize {
	// Convert our literal into a String, then store the pointer
	// to the first byte of its slice.
	let s: String = s.to_string();
	let s_ptr = s.as_ptr();
	// Just to make sure that the pointer of the string is NOT
	// the same as the pointer of the underlying buffer.
	assert_ne!(&s as *const String as usize, s_ptr as usize);
	let z = ZeroizeString::from(s);
	// Get the pointer to the underlying buffer,
	// We want to make sure is the same as the received string literal.
	// That is, no copies of the contents.
	let ptr_to_buf = z.as_ref().as_ptr();
	assert_eq!(ptr_to_buf, s_ptr);
	// We exit this scope, returning to the caller the pointer to
	// the buffer, that we'll use to verify the zeroization.
	ptr_to_buf as usize
	};
	// Call the closure.
	let ptr_to_buf = some_scope(SECRET_KEY_1);
	// Check if the underlying bytes were zeroized.
	// At this point the first half is already reclaimed and assigned,
	// so we will just examine the other half.
	for i in SECRET_KEY_1.len() / 2..SECRET_KEY_1.len() {
	unsafe {
	assert_eq!(*((ptr_to_buf + i) as *const u8), 0);
	}
	}
	}
	}