ikev2: Wipe (optional) shared secret during CHILD_SA key derivation
authorTobias Brunner <tobias@strongswan.org>
Wed, 6 Nov 2013 09:30:27 +0000 (10:30 +0100)
committerTobias Brunner <tobias@strongswan.org>
Thu, 23 Jan 2014 08:54:18 +0000 (09:54 +0100)
src/libcharon/sa/ikev2/keymat_v2.c

index 85f891f..8c7ba8d 100644 (file)
@@ -453,17 +453,6 @@ METHOD(keymat_v2_t, derive_child_keys, bool,
        chunk_t seed, secret = chunk_empty;
        prf_plus_t *prf_plus;
 
-       if (dh)
-       {
-               if (dh->get_shared_secret(dh, &secret) != SUCCESS)
-               {
-                       return FALSE;
-               }
-               DBG4(DBG_CHD, "DH secret %B", &secret);
-       }
-       seed = chunk_cata("mcc", secret, nonce_i, nonce_r);
-       DBG4(DBG_CHD, "seed %B", &seed);
-
        if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM,
                                                                &enc_alg, &enc_size))
        {
@@ -530,7 +519,21 @@ METHOD(keymat_v2_t, derive_child_keys, bool,
        {
                return FALSE;
        }
+
+       if (dh)
+       {
+               if (dh->get_shared_secret(dh, &secret) != SUCCESS)
+               {
+                       return FALSE;
+               }
+               DBG4(DBG_CHD, "DH secret %B", &secret);
+       }
+       seed = chunk_cata("scc", secret, nonce_i, nonce_r);
+       DBG4(DBG_CHD, "seed %B", &seed);
+
        prf_plus = prf_plus_create(this->prf, TRUE, seed);
+       memwipe(seed.ptr, seed.len);
+
        if (!prf_plus)
        {
                return FALSE;