Skip to content

Use only established secure zeroize APIs #232

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
GuruprasadBhatL wants to merge 6 commits into
base: main
Choose a base branch
from
+165 −169
Open

Use only established secure zeroize APIs #232

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
7306fd6
Use only established secure zeroize APIs
Sep 11, 2026
5436bc2
Cross reference target lebel renamed
Sep 15, 2026
81280e1
Merge branch 'main' into feature/secure_zeroize_for_qnx_7+
GuruprasadBhatL Sep 15, 2026
9f964a3
Rename module from 'score_crypto' to 'score_security_crypto'
GuruprasadBhatL Sep 17, 2026
40faa0b
Merge branch 'main' into feature/secure_zeroize_for_qnx_7+
GuruprasadBhatL Sep 17, 2026
262c50d
Update MODULE.bazel.lock
Sep 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion MODULE.bazel
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
#
# SPDX-License-Identifier: Apache-2.0
# *******************************************************************************
module(name = "score_crypto")
module(name = "score_security_crypto")

@se-lo se-lo Sep 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need any further adjustments with this change?

E.g. Shall we update the upload name in .github/workflows/test_linux.yml


bazel_dep(name = "rules_python", version = "2.3.1")
single_version_override(
Expand Down
318 changes: 159 additions & 159 deletions MODULE.bazel.lock
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion score/crypto/docs/architecture/index.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
# SPDX-License-Identifier: Apache-2.0
# *******************************************************************************

.. _component_architecture_template:
.. _crypto_architecture:

Component Architecture
======================
Expand Down
12 changes: 4 additions & 8 deletions score/crypto/src/daemon/common/secure_memory.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,11 @@
#include <sys/neutrino.h> // _NTO_VERSION
#if _NTO_VERSION >= 700
#include <string.h> // memset_s
#else
#error "QNX versions lesser than 7.0 are not supported"
#endif
#else
#error "Unsupported platform: secure memory is supported only on Linux and QNX 7.0+"
#endif

namespace score::crypto::daemon::common
Expand All @@ -35,7 +39,6 @@ namespace score::crypto::daemon::common
/// Uses platform-specific primitives:
/// - Linux: explicit_bzero
/// - QNX 7.0+: memset_s
/// - Fallback: manual loop with volatile ptr
///
/// No provider dependencies (no OpenSSL, PKCS#11, etc.).
inline void SecureZeroize(void* ptr, std::size_t len) noexcept
Expand All @@ -48,13 +51,6 @@ inline void SecureZeroize(void* ptr, std::size_t len) noexcept
explicit_bzero(ptr, len);
#elif defined(__QNX__) && (_NTO_VERSION >= 700)
memset_s(ptr, len, 0, len);
#else
// Volatile pointer prevents compiler from optimizing away the memset
volatile unsigned char* p = static_cast<volatile unsigned char*>(ptr);
while (len-- > 0U)
{
*p++ = 0;
}
#endif
}

Expand Down
Loading