Re: [PATCH net-next 2/5] net/rxrpc: Use local FCrypt-PCBC implementation

[Eric Biggers <ebiggers@kernel.org>]

On Fri, Oct 30, 2026 at 04:53:35AM +0000, sashiko-bot@kernel.org wrote:
> Does this code leave the cryptographic key material on the stack?
> 
> The local struct fcrypt_key cipher is allocated on the stack and initialized
> with the session key schedule via fcrypt_preparekey(). After the decryption is
> complete, the function returns without securely erasing this key schedule from
> the stack.
> 
> Could we call memzero_explicit(&cipher, sizeof(cipher)) before returning to
> ensure the key material is cleared?

The old code left the key on the stack as well (in 'iv', since the key
is reused as the IV here...), and I didn't aim to change that in this
patch.  And FCrypt is not secure anyway.  Only real reason to add this
would be so that LLMs don't complain.

- Eric