From a986e9faac963b57c3ce1b238402d93db80554c0 Mon Sep 17 00:00:00 2001 From: Jerry Yu Date: Thu, 2 Dec 2021 17:00:52 +0800 Subject: [PATCH] Clean handshake secrets Signed-off-by: Jerry Yu --- library/ssl_tls13_client.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c index 1874d4fde9..ff448de705 100644 --- a/library/ssl_tls13_client.c +++ b/library/ssl_tls13_client.c @@ -1646,6 +1646,11 @@ static int ssl_tls13_flush_buffers( mbedtls_ssl_context *ssl ) */ static int ssl_tls13_handshake_wrapup( mbedtls_ssl_context *ssl ) { + mbedtls_platform_zeroize( &ssl->handshake->tls1_3_master_secrets, + sizeof(ssl->handshake->tls1_3_master_secrets)); + mbedtls_platform_zeroize( &ssl->handshake->tls13_hs_secrets, + sizeof(ssl->handshake->tls13_hs_secrets)); + MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to application keys for inbound traffic" ) ); mbedtls_ssl_set_inbound_transform ( ssl, ssl->transform_application );