Zuse's key seeds are left in stack memory on the failure paths #176

New Issue

2026-11-11T21:33:29Z

rajames commented

2026-11-11 21:33:29 +00:00

Found

kernel/src/v4/sk_v4_mint.c wipes seed and rseed only on success; every return failed() after the mint (line 127 on) leaves them. kernel/src/v4/sk_v4_identity.c:244 sk_v4_genesis never wipes seed/rseed, while sk_v4_real_zuse_arrived wipes its seed. The seed is also kept in g_zuse_seed by design, so this is hygiene, not a leak path that can be shown.

Done when

Every exit of the three functions wipes the seeds it read, with one helper

🤖 Filed with Claude Code -- the code review of 2026-11-11, at 4d42d25c (Captain Bob, 2026-11-11: "File the review findings as issues"). Read, not run: each is to be confirmed by a test written first and seen to fail.

### Found `kernel/src/v4/sk_v4_mint.c` wipes `seed` and `rseed` only on success; every `return failed()` after the mint (line 127 on) leaves them. `kernel/src/v4/sk_v4_identity.c:244` `sk_v4_genesis` never wipes `seed`/`rseed`, while `sk_v4_real_zuse_arrived` wipes its `seed`. The seed is also kept in `g_zuse_seed` by design, so this is hygiene, not a leak path that can be shown. ### Done when - [ ] Every exit of the three functions wipes the seeds it read, with one helper 🤖 Filed with [Claude Code](https://claude.com/claude-code) -- the code review of 2026-11-11, at `4d42d25c` (Captain Bob, 2026-11-11: "File the review findings as issues"). Read, not run: each is to be confirmed by a test written first and seen to fail.

rajames added the area/kernel

labels 2026-11-11 21:33:30 +00:00

Sign in to join this conversation.