Skip to content

ml-kem: zeroize seed value of DecapsulationKey on drop#206

Merged
tarcieri merged 2 commits intoRustCrypto:masterfrom
MGibson1:ml-kem/decapsulation-key-zeroizing
Jan 29, 2026
Merged

ml-kem: zeroize seed value of DecapsulationKey on drop#206
tarcieri merged 2 commits intoRustCrypto:masterfrom
MGibson1:ml-kem/decapsulation-key-zeroizing

Conversation

@MGibson1
Copy link
Contributor

FIPS 203 section 3.3 Destruction of intermediate values:

The seed (𝑑, 𝑧) generated in steps 1 and 2 of ML-KEM.KeyGen can be stored for later
expansion using ML-KEM.KeyGen_internal. As this seed can be used to compute the
decapsulation key, it is sensitive data and shall be treated with the same safeguards as a
decapsulation key (see SP 800-227 [1]).

Since decapsulation keys are zeroized on drop, 𝑑 should be, to

FIPS 203 section 3.3 "Destruction of intermediate values" specifies that
both parts of the seed (z, d) should be treated in the same manner at
the decapsulation key itself, which is to zeroize.
@tarcieri tarcieri changed the title ML-KEM: Zeroize both seed values on drop of ecapsulation key ml-kem: zeroize seed value of DecapsulationKey on drop Jan 29, 2026
@tarcieri
Copy link
Member

Good find, thanks

@tarcieri tarcieri merged commit d7da47a into RustCrypto:master Jan 29, 2026
23 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants