keygen_xmss: zeroize XmssKey after free

danielinux · danielinux · commit 76f0b3cba965 · 2026-04-14T14:32:45.000+02:00
F/2590
diff --git a/tools/keytools/keygen.c b/tools/keytools/keygen.c
@@ -1048,6 +1048,7 @@ static void keygen_xmss(const char *priv_fname, uint32_t id_mask)
     keystore_add(AUTH_KEY_XMSS, xmss_pub, KEYSTORE_PUBKEY_SIZE_XMSS, priv_fname, id_mask);
 
     wc_XmssKey_Free(&key);
+    wc_ForceZero(&key, sizeof(key));
 }
 
 

Original file line number	Diff line number	Diff line change
`@@ -1048,6 +1048,7 @@ static void keygen_xmss(const char *priv_fname, uint32_t id_mask)`
`1048`	`1048`	`keystore_add(AUTH_KEY_XMSS, xmss_pub, KEYSTORE_PUBKEY_SIZE_XMSS, priv_fname, id_mask);`
`1049`	`1049`
`1050`	`1050`	`wc_XmssKey_Free(&key);`
	`1051`	`+ wc_ForceZero(&key, sizeof(key));`
`1051`	`1052`	`}`
`1052`	`1053`
`1053`	`1054`