Clear copied key parts after use.

diff --git a/src/lib/vault/vault-worker.ts b/src/lib/vault/vault-worker.ts
index fd69f785f7c06b01ebd4acc8b4a634504d65d8f2..2e8773b64b0d45d1a91c615aefff5ed25e72f1f7 100644 (file)
--- a/src/lib/vault/vault-worker.ts
+++ b/src/lib/vault/vault-worker.ts
@@ -248,8 +248,11 @@ function sign (index?: number, data?: ArrayBuffer): Promise<Record<string, Array
                return _ckd(index).then(result => {
                        const prv = new Uint8Array(result)
                        const pub = nano25519_derive(prv)
-                       const sig = nano25519_sign(new Uint8Array(data), new Uint8Array([...prv, ...pub]))
+                       const sk = new Uint8Array([...prv, ...pub])
                        prv.fill(0)
+                       pub.fill(0)
+                       const sig = nano25519_sign(new Uint8Array(data), sk)
+                       sk.fill(0)
                        _timer = new VaultTimer(_autolock, _timeout)
                        return { signature: sig.buffer }
                })