commit 7ca30547954e483816ff70db8fcec584d1738d5d
author Jerry Yu <jerry.h.yu@arm.com> Wed Dec 08 15:57:57 2021 +0800
committer Jerry Yu <jerry.h.yu@arm.com> Fri Dec 10 10:33:27 2021 +0800
tree 697b16f5107f18fab4486579164cf492f8a65d45
parent 23ab7a46a3c983e524ebe538320b84f0a67f2abb

move zerioize tls13_hs_secrets

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>

library/ssl_tls13_client.c

diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c
index f219586..88f240e 100644
--- a/library/ssl_tls13_client.c
+++ b/library/ssl_tls13_client.c
@@ -1647,9 +1647,6 @@
 static int ssl_tls13_handshake_wrapup( mbedtls_ssl_context *ssl )
 {
 
-    mbedtls_platform_zeroize( &ssl->handshake->tls13_hs_secrets,
-                              sizeof(ssl->handshake->tls13_hs_secrets));
-
     MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to application keys for inbound traffic" ) );
     mbedtls_ssl_set_inbound_transform ( ssl, ssl->transform_application );
 

library/ssl_tls13_generic.c

diff --git a/library/ssl_tls13_generic.c b/library/ssl_tls13_generic.c
index 066147a..49256ec 100644
--- a/library/ssl_tls13_generic.c
+++ b/library/ssl_tls13_generic.c
@@ -1060,10 +1060,14 @@
                     sizeof( ssl->handshake->state_local.finished_out.digest ),
                     &ssl->handshake->state_local.finished_out.digest_len,
                     ssl->conf->endpoint );
-
+    if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
+    {
+        mbedtls_platform_zeroize( &ssl->handshake->tls13_hs_secrets,
+                                  sizeof(ssl->handshake->tls13_hs_secrets));
+    }
     if( ret != 0 )
     {
-         MBEDTLS_SSL_DEBUG_RET( 1, "calculate_verify_data failed", ret );
+        MBEDTLS_SSL_DEBUG_RET( 1, "calculate_verify_data failed", ret );
         return( ret );
     }