Refactor secret buffers to enable proper zeroing.

diff --git a/src/lib/vault/vault-worker.ts b/src/lib/vault/vault-worker.ts
index cce418173cade79f718d2f680d4d6ff26a18c36f..4364f482699f35ae29517317f08fc257eff3f649 100644 (file)
--- a/src/lib/vault/vault-worker.ts
+++ b/src/lib/vault/vault-worker.ts
@@ -188,12 +188,18 @@ function derive (index?: number | Uint32Array): Promise<Record<string, number |
                const promises = []
                const values = typeof index === 'number' ? [index] : index.values()
                for (const i of values) {
-                       promises.push(_ckd(i).then(result => {
-                               const prv = new Uint8Array(result)
-                               const pub = nano25519_derive(prv)
-                               prv.fill(0)
-                               return { index: i, publicKey: pub.buffer }
-                       }))
+                       const prv = new Uint8Array(32)
+                       promises.push(_ckd(i)
+                               .then(result => {
+                                       prv.set(result)
+                                       result.fill(0)
+                                       const pub = nano25519_derive(prv)
+                                       return { index: i, publicKey: pub.buffer }
+                               })
+                               .finally(() => {
+                                       prv.fill(0)
+                               })      
+                       )
                }
                return Promise.all(promises)
                        .then(results => {
@@ -269,10 +275,11 @@ function sign (index?: Uint32Array, data?: ArrayBuffer): Promise<Record<string,
                }
                if (data == null) {
                        throw new VaultError('Data to sign not found')
-               }
+               const prv = new Uint8Array(32)
                return _ckd(index[0])
                        .then(result => {
-                               const prv = new Uint8Array(result)
+                               prv.set(result)
+                               result.fill(0)
                                const pub = nano25519_derive(prv)
                                const sk = new Uint8Array([...prv, ...pub])
                                prv.fill(0)
@@ -287,6 +294,9 @@ function sign (index?: Uint32Array, data?: ArrayBuffer): Promise<Record<string,
                                _timer.resume()
                                throw new VaultError('Failed to sign message', { cause: err })
                        })
+                       .finally (() => {
+                               prv.fill(0)
+                       })
        } catch (err) {
                console.error(err)
                _timer.resume()