Re: [PATCH 1/6] crypto: Provide wrapper functions for zeroizing aes_cmac_key and aes_cmac_ctx

[Eric Biggers <ebiggers@kernel.org>]

On Wed, Aug 05, 2026 at 04:36:04PM +0200, Thomas Huth wrote:
> crypto: Provide wrapper functions for zeroizing aes_cmac_key and aes_cmac_ctx

    lib/crypto: aes-cmac: Add zeroization functions

> +/**
> + * aes_cmac_zeroize_key - Clear a aes_cmac_key structure

aes_cmac_zeroize_key() - Zeroize an aes_cmac_key structure

> + * @ctx: The location of the key structure that should be zeroized
> + *
> + * Explicitly fills the aes_cmac_key with zeroes. This should be done once
> + * the key is not required anymore to avoid that its contents are leaked
> + * on the stack or heap.

The mention of "heap" is kind of misleading, since normally
kfree_sensitive() would be used in that case.  Maybe add: "Only required
if not using kfree_sensitive()."

> + */
> +static inline void aes_cmac_zeroize_key(struct aes_cmac_key *key)
> +{
> +	memzero_explicit(key, sizeof(*key));
> +}

Also maybe put the function definition right after the definition of
struct aes_cmac_key itself, and likewise for struct aes_cmac_ctx.  Then
they would be closely paired with the corresponding structs.

> /**                                                                              
> * aes_cmac_zeroize_ctx - Clear a aes_cmac_ctx structure   

aes_cmac_zeroize_ctx() - Zeroize an aes_cmac_ctx structure

Could we also get notes in the kerneldoc for aes_cmac_preparekey() and
aes_cmac_init()?  For example:

    "On success, the caller should ensure that the prepared key is
    zeroized at the end of its lifetime, e.g. by calling
    aes_cmac_zeroize_key() or kfree_sensitive()."

and

    "The caller should ensure that the context is zeroized at the end of
    its lifetime, e.g. by calling aes_cmac_final() or
    aes_cmac_zeroize_ctx()."

- Eric