aboutsummaryrefslogtreecommitdiffstats
path: root/src/eap_peer/eap_pwd.c
diff options
context:
space:
mode:
authorFlorent Daigniere <nextgens@freenetproject.org>2014-06-27 09:59:45 (GMT)
committerJouni Malinen <j@w1.fi>2014-07-24 16:35:07 (GMT)
commit26c10f797cced4eab68590accc96508d70325ff7 (patch)
tree2abd6ca6a341a3a12a831b2fdd1a3bb936f565f4 /src/eap_peer/eap_pwd.c
parent3248071dc3165719a087b401f12fef732b0c4e64 (diff)
downloadhostap-26c10f797cced4eab68590accc96508d70325ff7.zip
hostap-26c10f797cced4eab68590accc96508d70325ff7.tar.gz
hostap-26c10f797cced4eab68590accc96508d70325ff7.tar.bz2
OpenSSL: Use EC_POINT_clear_free instead of EC_POINT_free
This changes OpenSSL calls to explicitly clear the EC_POINT memory allocations when freeing them. This adds an extra layer of security by avoiding leaving potentially private keys into local memory after they are not needed anymore. While some of these variables are not really private (e.g., they are sent in clear anyway), the extra cost of clearing them is not significant and it is simpler to just clear these explicitly rather than review each possible code path to confirm where this does not help. Signed-off-by: Florent Daigniere <nextgens@freenetproject.org>
Diffstat (limited to 'src/eap_peer/eap_pwd.c')
-rw-r--r--src/eap_peer/eap_pwd.c10
1 files changed, 5 insertions, 5 deletions
diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c
index b9eae37..089aec3 100644
--- a/src/eap_peer/eap_pwd.c
+++ b/src/eap_peer/eap_pwd.c
@@ -153,14 +153,14 @@ static void eap_pwd_deinit(struct eap_sm *sm, void *priv)
BN_clear_free(data->my_scalar);
BN_clear_free(data->k);
BN_CTX_free(data->bnctx);
- EC_POINT_free(data->my_element);
- EC_POINT_free(data->server_element);
+ EC_POINT_clear_free(data->my_element);
+ EC_POINT_clear_free(data->server_element);
os_free(data->id_peer);
os_free(data->id_server);
bin_clear_free(data->password, data->password_len);
if (data->grp) {
EC_GROUP_free(data->grp->group);
- EC_POINT_free(data->grp->pwe);
+ EC_POINT_clear_free(data->grp->pwe);
BN_clear_free(data->grp->order);
BN_clear_free(data->grp->prime);
os_free(data->grp);
@@ -474,8 +474,8 @@ fin:
BN_clear_free(x);
BN_clear_free(y);
BN_clear_free(cofactor);
- EC_POINT_free(K);
- EC_POINT_free(point);
+ EC_POINT_clear_free(K);
+ EC_POINT_clear_free(point);
if (data->outbuf == NULL)
eap_pwd_state(data, FAILURE);
else