[ROS] Improve sanitization of sensitive data in memory after use #634
Description
See RPG-024 in 2024 ROS Evaluation for more detail.
The ROS evaluation recommends zeroize annotations on:
- Passphrase strings
- Secret keys derived by the String-to-Key (S2K) mechanism
And for the upcoming 0.11 RustCrypto releases:
- enable
zeroizefor the sha1 and sha2 crates (and potentially other hash libraries)
Finally, the report also recommends:
Improve the public documentation on what rPGP considers sensitive.
Activity
[-]Consider further mitigation of resource exhaustion with excessive argon2 parameters[/-][+][ROS] Consider further mitigation of resource exhaustion with excessive argon2 parameters[/+][-][ROS] Consider further mitigation of resource exhaustion with excessive argon2 parameters[/-][+][ROS] Improve sanitization of sensitive data in memory after use[/+]invd commentedon Feb 13, 2026
Partially related: #669, which motivated some improvements in #694.
ros-cr commentedon Apr 9, 2026
Some relevant improvements: #745
ros-cr commentedon Apr 9, 2026
The
0.11versions of the RustCrypto sha crates are still not stable. Relevant open PR on the rpgp side: #573.