[PATCH] lib/crypto: Add a sentence about zeroizing raw key structures

[PATCH] lib/crypto: Add a sentence about zeroizing raw key structures

[Thomas Huth]

Let's make it clear that raw key material has to be zeroized, too.

Suggested-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 Suggested here:
 https://lore.kernel.org/linux-crypto/20260930201434.GA61218@google.com/

 Documentation/crypto/libcrypto-zeroization.rst | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Documentation/crypto/libcrypto-zeroization.rst b/Documentation/crypto/libcrypto-zeroization.rst
index 76b6506711634..fe9f94413d1f2 100644
--- a/Documentation/crypto/libcrypto-zeroization.rst
+++ b/Documentation/crypto/libcrypto-zeroization.rst
@@ -47,7 +47,9 @@ The following types of structures hold sensitive material and should be
 zeroized after use:
 
 - **Key structures** (e.g. ``struct aes_key``, ``struct hmac_sha256_key``):
-  contain expanded round keys or prepared key material.
+  contain expanded round keys or prepared key material. Note: Arrays and
+  structures that contain raw key material (e.g. raw AES keys) of course
+  need to be zeroized as well as soon as the data is not required anymore.
 
 - **HMAC/MAC context structures** (e.g. ``struct hmac_sha256_ctx``,
   ``struct aes_cmac_ctx``): contain inner and outer hash states derived from
-- 
2.56.0