Additional zeroization/defense-in-depth + CI fixes

Author: nadimkobeissi

.github/workflows/ci.yml

@@ -118,4 +118,4 @@ jobs:
         with:
           tool: cargo-fuzz
       - name: cargo fuzz run ${{ matrix.target }}
-        run: cargo fuzz run ${{ matrix.target }} -- -max_total_time=60 -rss_limit_mb=4096
+        run: cargo fuzz run --target "$(rustc -vV | sed -n 's/^host: //p')" ${{ matrix.target }} -- -max_total_time=60 -rss_limit_mb=4096

Cargo.lock

@@ -21,6 +21,9 @@ shake            = { version = "0.1",  default-features = false, optional = true
 aead             = { version = "0.5",  default-features = false, features = ["alloc"] }
 aes-gcm          = { version = "0.10", default-features = false, features = ["aes", "alloc", "zeroize"] }
 chacha20poly1305 = { version = "0.10", default-features = false, features = ["alloc"] }
+aes              = { version = "0.8",  default-features = false, features = ["zeroize"] }
+ghash            = { version = "0.5",  default-features = false, features = ["zeroize"] }
+polyval          = { version = "0.6",  default-features = false, features = ["zeroize"] }
 x25519-dalek     = { version = "3",    default-features = false, features = ["zeroize", "static_secrets"] }
 ed448-goldilocks = { version = "0.14.0-pre.12", default-features = false }
 p256             = { version = "0.14", default-features = false, features = ["arithmetic", "ecdh"] }

Cargo.toml

@@ -288,6 +288,15 @@ mod tests {
 		assert_eq!(r.err(), Some(HpkeError::AeadInitError));
 	}
 
+	/// Guards the `aes/zeroize` entry in `Cargo.toml`: `aes_gcm::AesGcm` has no
+	/// `Drop`, so without it the cached round keys survive in freed memory.
+	#[test]
+	fn aes_round_keys_are_scrubbed_on_drop() {
+		fn assert_zeroize_on_drop<T: zeroize::ZeroizeOnDrop>() {}
+		assert_zeroize_on_drop::<aes::Aes128>();
+		assert_zeroize_on_drop::<aes::Aes256>();
+	}
+
 	#[test]
 	fn export_only_implements_aead_only() {
 		fn assert_aead<A: Aead>() {}

src/aead.rs

@@ -2,6 +2,8 @@
 
 use core::fmt;
 
+use subtle::ConstantTimeEq;
+
 use crate::HpkeError;
 
 /// Minimum accepted PSK length in bytes.
@@ -32,12 +34,21 @@ pub const MIN_PSK_LEN: usize = 32;
 /// assert_eq!(Psk::new(b"hunter2", b"my-psk-id"), Err(HpkeError::InsecurePsk));
 /// # Ok::<_, HpkeError>(())
 /// ```
-#[derive(Clone, Copy, PartialEq, Eq)]
+#[derive(Clone, Copy)]
 pub struct Psk<'a> {
 	secret: &'a [u8],
 	id: &'a [u8],
 }
 
+/// Constant-time in the secret; the identifier is public and compared normally.
+impl PartialEq for Psk<'_> {
+	fn eq(&self, other: &Self) -> bool {
+		self.id == other.id && bool::from(self.secret.ct_eq(other.secret))
+	}
+}
+
+impl Eq for Psk<'_> {}
+
 impl<'a> Psk<'a> {
 	/// Bundle a PSK with its identifier.
 	///
@@ -121,6 +132,16 @@ mod tests {
 		assert_eq!(psk.id(), b"the-id");
 	}
 
+	#[test]
+	fn equality_compares_both_fields() {
+		let a = [0x11u8; MIN_PSK_LEN];
+		let mut b = a;
+		b[MIN_PSK_LEN - 1] ^= 1;
+		assert_eq!(Psk::new(&a, b"id").unwrap(), Psk::new(&a, b"id").unwrap());
+		assert_ne!(Psk::new(&a, b"id").unwrap(), Psk::new(&b, b"id").unwrap());
+		assert_ne!(Psk::new(&a, b"id").unwrap(), Psk::new(&a, b"id-x").unwrap());
+	}
+
 	#[test]
 	fn debug_redacts_the_secret() {
 		let psk = Psk::new(&[0xAAu8; MIN_PSK_LEN], b"the-id").unwrap();