From 97d6ebac994a598d0fb5fcdd841bd2a51023bb3f Mon Sep 17 00:00:00 2001
From: Sachymetsu <sachymetsu@tutamail.com>
Date: Tue, 14 Apr 2026 10:48:11 +0200
Subject: [PATCH] Zeroize important stuff

---
 Cargo.lock     | 23 +++++++++++++++++++++++
 Cargo.toml     |  4 ++++
 src/keccakf.rs |  6 ++++++
 src/opflags.rs |  6 ++++++
 src/strobe.rs  | 24 ++++++++++++++++++++++--
 5 files changed, 61 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 23667aa..a8f16cf 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -38,6 +38,15 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
+[[package]]
+name = "hybrid-array"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3944cf8cf766b40e2a1a333ee5e9b563f854d5fa49d6a8ca2764e97c6eddb214"
+dependencies = [
+ "typenum",
+]
+
 [[package]]
 name = "itoa"
 version = "1.0.18"
@@ -52,6 +61,7 @@ checksum = "9e24a010dd405bd7ed803e5253182815b41bf2e6a80cc3bfc066658e03a198aa"
 dependencies = [
  "cfg-if",
  "cpufeatures",
+ "hybrid-array",
 ]
 
 [[package]]
@@ -147,6 +157,12 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "typenum"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
@@ -163,8 +179,15 @@ dependencies = [
  "serde",
  "serde-big-array",
  "serde_json",
+ "zeroize",
 ]
 
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+
 [[package]]
 name = "zmij"
 version = "1.0.21"
diff --git a/Cargo.toml b/Cargo.toml
index 2ea9412..cf14d38 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -6,9 +6,13 @@ repository = "https://tangled.org/sachy.dev/wharrgarbl"
 version = "0.1.0"
 edition = "2024"
 
+[features]
+parallel = ["keccak/parallel"]
+
 [dependencies]
 keccak = "0.2"
 ctutils = { version = "0.4.2", default-features = false }
+zeroize = { version = "1.8.2", default-features = false }
 
 [dev-dependencies]
 serde_json = "1"
diff --git a/src/keccakf.rs b/src/keccakf.rs
index f978234..89b966f 100644
--- a/src/keccakf.rs
+++ b/src/keccakf.rs
@@ -12,6 +12,12 @@ pub(crate) const KECCAK_BUFFER_SIZE: usize = SIZE * KECCAK_BLOCK_SIZE;
 #[repr(align(8))]
 pub(crate) struct KeccakF1600(pub(crate) [u8; KECCAK_BUFFER_SIZE]);
 
+impl zeroize::Zeroize for KeccakF1600 {
+    fn zeroize(&mut self) {
+        self.0.zeroize();
+    }
+}
+
 impl KeccakF1600 {
     fn copy_into(&self, dst: &mut [u64; KECCAK_BLOCK_SIZE]) {
         assert_eq!(self.0.len(), dst.len() * SIZE);
diff --git a/src/opflags.rs b/src/opflags.rs
index 83d4c72..a252724 100644
--- a/src/opflags.rs
+++ b/src/opflags.rs
@@ -57,6 +57,12 @@ impl Default for OpFlags {
     }
 }
 
+impl zeroize::Zeroize for OpFlags {
+    fn zeroize(&mut self) {
+        self.0.zeroize();
+    }
+}
+
 impl core::fmt::Debug for OpFlags {
     fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
         write!(f, "OpFlags({:#08b})", self.0)
diff --git a/src/strobe.rs b/src/strobe.rs
index 052e217..bce7f54 100644
--- a/src/strobe.rs
+++ b/src/strobe.rs
@@ -1,4 +1,5 @@
 use ctutils::{Choice, CtAssign, CtEq, CtLt, CtSelect};
+use zeroize::Zeroize;
 
 use crate::{
     GarbledError, STROBE_VERSION,
@@ -59,7 +60,7 @@ macro_rules! define_mut_operations {
             let more = prev_flags.ct_eq(&flags);
             self.operate(flags, data, more);
         }
-    )*
+        )*
     };
 }
 
@@ -75,10 +76,29 @@ macro_rules! define_non_mut_operations {
             let more = prev_flags.ct_eq(&flags);
             self.operate_no_mutate(flags, data, more);
         }
-    )*
+        )*
     };
 }
 
+impl Zeroize for StrobeState {
+    fn zeroize(&mut self) {
+        self.state.zeroize();
+        self.rate.zeroize();
+        self.position.zeroize();
+        self.start.zeroize();
+        self.role.zeroize();
+        self.prev_flags.zeroize();
+    }
+}
+
+impl zeroize::ZeroizeOnDrop for StrobeState {}
+
+impl Drop for StrobeState {
+    fn drop(&mut self) {
+        self.zeroize();
+    }
+}
+
 impl core::fmt::Display for StrobeState {
     fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
         f.write_str("Strobe-Keccak-")?;
-- 
2.51.2