From b8b7d464265a69c23ab59362c6a8f9d54c8f8f74 Mon Sep 17 00:00:00 2001
From: Chris Duncan <chris@zoso.dev>
Date: Sat, 15 Aug 2026 00:08:13 -0700
Subject: [PATCH] Eliminate redundant buffer clearing.

---
 src/lib/nano25519.ts | 49 ++++++++++++++++++++++----------------------
 1 file changed, 24 insertions(+), 25 deletions(-)

diff --git a/src/lib/nano25519.ts b/src/lib/nano25519.ts
index 288bd41..e876fc8 100644
--- a/src/lib/nano25519.ts
+++ b/src/lib/nano25519.ts
@@ -80,14 +80,12 @@ export const nano25519_init = (bytes: number[]): { derive: typeof derive, sign:
 			for (let i = 0; i < 32; i++) {
 				buffer.setUint8(inPtr + i, privateKey[i])
 			}
-			privateKey.fill(0)
 			exports.derive()
 			const outPtr = exports.getOutputPointer()
 			buffer = new DataView(exports.memory.buffer)
 			for (let i = 0; i < 32; i++) {
 				out[i] = buffer.getUint8(outPtr + i)
 			}
-			clear(buffer)
 			if (typeof pub === 'undefined') {
 				return
 			} else if (typeof prv === 'string') {
@@ -118,7 +116,6 @@ export const nano25519_init = (bytes: number[]): { derive: typeof derive, sign:
 			for (let i = 0; i < 64; i++) {
 				buffer.setUint8(inPtr + i, secretKey[i])
 			}
-			secretKey.fill(0)
 			const message = normalize('message', 0, 32768, m)
 			let mPtr = exports.getMessagePointer()
 			for (let i = 0; i < message.byteLength; i++) {
@@ -130,7 +127,6 @@ export const nano25519_init = (bytes: number[]): { derive: typeof derive, sign:
 			for (let i = 0; i < 64; i++) {
 				s[i] = buffer.getUint8(outPtr + i)
 			}
-			clear(buffer)
 			return typeof k === 'string'
 				? [...s].map(b => b.toString(16).padStart(2, '0')).join('')
 				: s
@@ -141,29 +137,32 @@ export const nano25519_init = (bytes: number[]): { derive: typeof derive, sign:
 	}
 
 	function verify (s: unknown, m: unknown, k: unknown): boolean {
-		const signature = normalize('signature', 64, 64, s)
-		const message = normalize('message', 0, 32768, m)
-		const publicKey = normalize('public key', 32, 32, k)
 		let buffer: DataView | undefined = new DataView(exports.memory.buffer)
-		let mPtr = exports.getMessagePointer()
-		let inPtr = exports.getInputPointer()
-		for (let i = 0; i < message.byteLength; i++) {
-			buffer.setUint8(mPtr + i, message[i])
+		try {
+			const signature = normalize('signature', 64, 64, s)
+			const message = normalize('message', 0, 32768, m)
+			const publicKey = normalize('public key', 32, 32, k)
+			let mPtr = exports.getMessagePointer()
+			let inPtr = exports.getInputPointer()
+			for (let i = 0; i < message.byteLength; i++) {
+				buffer.setUint8(mPtr + i, message[i])
+			}
+			for (let i = 0; i < 64; i++) {
+				buffer.setUint8(inPtr + i, signature[i])
+			}
+			inPtr += 64
+			for (let i = 0; i < 32; i++) {
+				buffer.setUint8(inPtr + i, publicKey[i])
+			}
+			exports.verify(message.byteLength)
+			const outPtr = exports.getOutputPointer()
+			const v = new Uint8Array(1)
+			buffer = new DataView(exports.memory.buffer)
+			v[0] = buffer.getUint8(outPtr)
+			return v[0] === 0
+		} finally {
+			clear(buffer)
 		}
-		for (let i = 0; i < 64; i++) {
-			buffer.setUint8(inPtr + i, signature[i])
-		}
-		inPtr += 64
-		for (let i = 0; i < 32; i++) {
-			buffer.setUint8(inPtr + i, publicKey[i])
-		}
-		exports.verify(message.byteLength)
-		const outPtr = exports.getOutputPointer()
-		const v = new Uint8Array(1)
-		buffer = new DataView(exports.memory.buffer)
-		v[0] = buffer.getUint8(outPtr)
-		clear(buffer)
-		return v[0] === 0
 	}
 
 	function clear (buffer: DataView): void {
-- 
2.52.0