From: Chris Duncan <chris@codecow.com>
Date: Wed, 5 Aug 2026 05:40:05 +0000 (-0700)
Subject: Clear copied key parts after use.
X-Git-Url: https://git.codecow.com/?a=commitdiff_plain;h=dfee5bea0c5fdb9bc9de4ea9c104fe82b6e76feb;p=libnemo.git

Clear copied key parts after use.
---

diff --git a/src/lib/vault/vault-worker.ts b/src/lib/vault/vault-worker.ts
index fd69f78..2e8773b 100644
--- a/src/lib/vault/vault-worker.ts
+++ b/src/lib/vault/vault-worker.ts
@@ -248,8 +248,11 @@ function sign (index?: number, data?: ArrayBuffer): Promise<Record<string, Array
 		return _ckd(index).then(result => {
 			const prv = new Uint8Array(result)
 			const pub = nano25519_derive(prv)
-			const sig = nano25519_sign(new Uint8Array(data), new Uint8Array([...prv, ...pub]))
+			const sk = new Uint8Array([...prv, ...pub])
 			prv.fill(0)
+			pub.fill(0)
+			const sig = nano25519_sign(new Uint8Array(data), sk)
+			sk.fill(0)
 			_timer = new VaultTimer(_autolock, _timeout)
 			return { signature: sig.buffer }
 		})