Lock secret key on import

erayd · May 27, 2015 · 78716eb · 78716eb
1 parent 032e418
commit 78716eb
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/libec/cert/export.c b/src/libec/cert/export.c
@@ -143,6 +143,8 @@ ec_cert_t *ec_import(unsigned char *src, size_t length, size_t *consumed) {
   //field buffers
   c->pk = ec_record_buf(c, "_cert", "pk", crypto_sign_PUBLICKEYBYTES, EC_RECORD_SIGNED);
   c->sk = ec_record_buf(c, "_cert", "sk", crypto_sign_SECRETKEYBYTES, 0);
+  if(c->sk)
+    sodium_mlock(c->sk, crypto_sign_SECRETKEYBYTES);
   c->salt = ec_record_buf(c, "_cert", "salt", crypto_pwhash_scryptsalsa208sha256_SALTBYTES, 0);
   c->signer_id = ec_record_buf(c, "_cert", "signer_id", EC_CERT_ID_BYTES, EC_RECORD_SIGNED);
   c->signature = ec_record_buf(c, "_cert", "signature", crypto_sign_BYTES, 0);