@amritk/nish-x86_64-linux 0.15.0 → 0.17.0

package/std/crypto/hmac.ts

@@ -24,6 +24,12 @@
  * which HMAC does not keep secret; a received tag is compared with
  * `timingSafeEqual`, never `===`.
  *
+ * `HmacSha256Scratch` and `HmacSha384Scratch` are the same computation in
+ * hashers the caller allocates once: `begin` keys them again in place and
+ * `finishInto` writes the tag into the caller's array, so a loop of them
+ * stores nothing of its own and an arena scope around it releases all it
+ * allocated (see "Caller-owned scratch" below).
+ *
  * Written from RFC 2104, not ported from another implementation.
  */
 import { SHA256_BLOCK, SHA256_SIZE, Sha256, sha256 } from "nish/crypto/sha256"
@@ -40,25 +46,33 @@ const HMAC_OPAD: i32 = 0x5c
 const HMAC_FROM: i32 = 0
 
 /**
- * `key XOR pad` over a whole block of `blockSize` bytes, with `key` already no
- * longer than a block: the key's bytes XOR `pad`, then `pad` alone where the
- * zero padding of RFC 2104 §2 step (1) would be.
+ * `key[off .. off + len) XOR pad` over a whole block, `out`, with the key
+ * already no longer than the block: the key's bytes XOR `pad`, then `pad`
+ * alone where the zero padding of RFC 2104 §2 step (1) would be.
  */
-const hmacPadBlock = (key: u8[], blockSize: i32, pad: i32): u8[] => {
+const hmacPadInto = (out: u8[], key: u8[], off: i32, len: i32, pad: i32): void => {
   const padByte: u8 = toU8(pad)
-  const out: u8[] = new Array<u8>(blockSize)
   const outLength: i32 = toI32(out.length)
   const keyLength: i32 = toI32(key.length)
   // Bounded by both lengths, so both indices are proved in range.
   let i: i32 = 0
-  while (i < keyLength && i < outLength) {
-    out[i] = key[i] ^ padByte
+  while (i < len && i < outLength && off + i >= 0 && off + i < keyLength) {
+    out[i] = key[off + i] ^ padByte
     i += 1
   }
   while (i < outLength) {
     out[i] = padByte
     i += 1
   }
+}
+
+/**
+ * `key XOR pad` over a whole block of `blockSize` bytes, in a fresh array, with
+ * `key` already no longer than a block (`hmacPadInto`).
+ */
+const hmacPadBlock = (key: u8[], blockSize: i32, pad: i32): u8[] => {
+  const out: u8[] = new Array<u8>(blockSize)
+  hmacPadInto(out, key, HMAC_FROM, toI32(key.length), pad)
   return out
 }
 
@@ -127,15 +141,31 @@ export class HmacSha384 {
   }
 }
 
-/** The HMAC-SHA-256 of all of `data` under `key`, as a fresh 32-byte array. */
+/**
+ * The HMAC-SHA-256 of all of `data` under `key`, as a fresh 32-byte array.
+ *
+ * `data` longer than 2^31 - 1 bytes panics, as `sha256` does and for its
+ * reason: under `--number-mode f64` the tag would be of a prefix, and a tag
+ * that verifies every message sharing that prefix is a forgery. A key that
+ * long reaches `sha256` in the constructor and panics there.
+ */
 export const hmacSha256 = (key: u8[], data: u8[]): u8[] => {
+  if (data.length > 2147483647) {
+    panic("hmacSha256: a message longer than 2^31 - 1 bytes")
+  }
   const mac = new HmacSha256(key)
   mac.update(data, HMAC_FROM, toI32(data.length))
   return mac.digest()
 }
 
-/** The HMAC-SHA-384 of all of `data` under `key`, as a fresh 48-byte array. */
+/**
+ * The HMAC-SHA-384 of all of `data` under `key`, as a fresh 48-byte array.
+ * `data` longer than 2^31 - 1 bytes panics, as in `hmacSha256`.
+ */
 export const hmacSha384 = (key: u8[], data: u8[]): u8[] => {
+  if (data.length > 2147483647) {
+    panic("hmacSha384: a message longer than 2^31 - 1 bytes")
+  }
   const mac = new HmacSha384(key)
   mac.update(data, HMAC_FROM, toI32(data.length))
   return mac.digest()
@@ -153,3 +183,289 @@ export const hmacSha256Verify = (key: u8[], data: u8[], tag: u8[]): boolean =>
 /** Whether `tag` is the HMAC-SHA-384 of `data` under `key`, compared as `hmacSha256Verify` does. */
 export const hmacSha384Verify = (key: u8[], data: u8[], tag: u8[]): boolean =>
   timingSafeEqual(hmacSha384(key, data), tag)
+
+// ---- Caller-owned scratch --------------------------------------------------
+//
+// `HmacSha256` makes its two hashers in its constructor, and the one-shot
+// functions above make an `HmacSha256` and a fresh tag on every call, so all
+// of them store allocations of their own: memory no automatic arena scope and
+// no `using a = arena()` block may release around them (docs/LANGUAGE.md,
+// "`using a = arena()`", NL2424). The scratch below is the same computation in
+// hashers the caller allocates once and keeps: `begin` keys it again by
+// rewriting their state in place, and `finishInto` writes the tag into the
+// caller's array. What it allocates on the way — the two digests a hasher
+// answers — dies with the call that made it, so a caller may run it a
+// thousand times inside one arena scope and leave the arena where it was.
+
+/**
+ * Makes `to` the hasher `from` is — the same point in the same message, as
+ * `Sha256.copy` makes it — in a hasher the caller already holds, so that
+ * nothing is allocated. Copying from a hasher nothing has been fed starts `to`
+ * again. It is here rather than beside `Sha256` because the scratch below and
+ * the TLS transcript are what need it, and HMAC is the module both sit on.
+ */
+export const hmacCopySha256 = (from: Sha256, to: Sha256): void => {
+  const fromState: u32[] = from.state
+  const toState: u32[] = to.state
+  for (let i: i32 = 0; i < toI32(fromState.length) && i < toI32(toState.length); i += 1) {
+    toState[i] = fromState[i]
+  }
+  const fromBlock: u8[] = from.block
+  const toBlock: u8[] = to.block
+  for (let i: i32 = 0; i < from.fill && i < toI32(fromBlock.length) && i < toI32(toBlock.length); i += 1) {
+    toBlock[i] = fromBlock[i]
+  }
+  to.fill = from.fill
+  to.total = from.total
+  to.finished = from.finished
+}
+
+/** `hmacCopySha256` for SHA-384: `to` made the hasher `from` is, in place. */
+export const hmacCopySha384 = (from: Sha384, to: Sha384): void => {
+  const fromState: u64[] = from.engine.state
+  const toState: u64[] = to.engine.state
+  for (let i: i32 = 0; i < toI32(fromState.length) && i < toI32(toState.length); i += 1) {
+    toState[i] = fromState[i]
+  }
+  const fromBlock: u8[] = from.engine.block
+  const toBlock: u8[] = to.engine.block
+  for (
+    let i: i32 = 0;
+    i < from.engine.filled && i < toI32(fromBlock.length) && i < toI32(toBlock.length);
+    i += 1
+  ) {
+    toBlock[i] = fromBlock[i]
+  }
+  to.engine.filled = from.engine.filled
+  to.engine.count = from.engine.count
+  to.engine.finished = from.engine.finished
+}
+
+/**
+ * Zeroes everything `h` holds of the message it was fed: the pending block
+ * with `secureZero`, and the hash value and message schedule, which are words
+ * `secureZero` does not take, with ordinary stores. Those stand because the
+ * hasher stays reachable for the next `begin`. The hasher is left finished, so
+ * that feeding it before it is started again panics.
+ */
+const hmacWipeSha256 = (h: Sha256): void => {
+  secureZero(h.block)
+  const state: u32[] = h.state
+  for (let i: i32 = 0; i < toI32(state.length); i += 1) {
+    state[i] = toU32(0)
+  }
+  const schedule: u32[] = h.schedule
+  for (let i: i32 = 0; i < toI32(schedule.length); i += 1) {
+    schedule[i] = toU32(0)
+  }
+  h.fill = 0
+  h.total = 0
+  h.finished = true
+}
+
+/** `hmacWipeSha256` for SHA-384. */
+const hmacWipeSha384 = (h: Sha384): void => {
+  secureZero(h.engine.block)
+  const state: u64[] = h.engine.state
+  for (let i: i32 = 0; i < toI32(state.length); i += 1) {
+    state[i] = toU64(0)
+  }
+  const schedule: u64[] = h.engine.schedule
+  for (let i: i32 = 0; i < toI32(schedule.length); i += 1) {
+    schedule[i] = toU64(0)
+  }
+  h.engine.filled = 0
+  h.engine.count = toU64(0)
+  h.engine.finished = true
+}
+
+/** Whether `[off, off + len)` is a window inside an array of `length` elements. */
+const hmacWindowFits = (length: i32, off: i32, len: i32): boolean =>
+  off >= 0 && len >= 0 && off <= length - len
+
+/**
+ * HMAC-SHA-256 over hashers the caller owns: allocate one, then for each tag
+ * `begin` with the key, `update` with the message, and `finishInto` the
+ * caller's array. The tag is the one `hmacSha256` answers.
+ *
+ *     const mac = new HmacSha256Scratch();          // once, outside the loop
+ *     mac.begin(key, 0, key.length);
+ *     mac.update(message, 0, message.length);
+ *     mac.finishInto(tag, 0);                       // 32 bytes at tag[0]
+ *
+ * The key block is wiped with `secureZero` once both hashers have absorbed
+ * it, and so is every digest on the way; `wipe` zeroes the hashers too, for a
+ * caller done with the key. A key or tag window outside its array panics, as
+ * a message window does in `Sha256.update`.
+ */
+export class HmacSha256Scratch {
+  /** H(K XOR ipad, …): keyed by `begin`, fed the message by `update`. */
+  inner: Sha256
+  /** H(K XOR opad, …): keyed by `begin`, fed the inner digest by `finishInto`. */
+  outer: Sha256
+  /** A hasher nothing is ever fed: the initial hash value `begin` copies from. */
+  fresh: Sha256
+  /** One key block XOR a pad, wiped as soon as it is absorbed. */
+  pad: u8[]
+  /** The SHA-256 of a key longer than a block, which RFC 2104 §2 keys with instead; wiped once used. */
+  keyHash: u8[]
+
+  constructor() {
+    this.inner = new Sha256()
+    this.outer = new Sha256()
+    this.fresh = new Sha256()
+    this.pad = new Array<u8>(SHA256_BLOCK)
+    this.keyHash = new Array<u8>(SHA256_SIZE)
+  }
+
+  /** Keys a new computation with `key[off .. off + len)`, a key longer than 64 bytes by its SHA-256 (RFC 2104 §2). */
+  begin(key: u8[], off: i32, len: i32): void {
+    if (!hmacWindowFits(toI32(key.length), off, len)) {
+      panic("HmacSha256Scratch: the key window is outside its array")
+    }
+    if (len <= SHA256_BLOCK) {
+      this.keyBlocks(key, off, len)
+      return
+    }
+    hmacCopySha256(this.fresh, this.inner)
+    this.inner.update(key, off, len)
+    const digest: u8[] = this.inner.digest()
+    for (let i: i32 = 0; i < toI32(digest.length) && i < toI32(this.keyHash.length); i += 1) {
+      this.keyHash[i] = digest[i]
+    }
+    secureZero(digest)
+    this.keyBlocks(this.keyHash, HMAC_FROM, SHA256_SIZE)
+    secureZero(this.keyHash)
+  }
+
+  /**
+   * Absorbs `key[off .. off + len)`, no longer than a block, XOR ipad into the
+   * inner hasher and XOR opad into the outer one, each started again, and
+   * wipes the block. A method of its own so that `begin` never keeps the
+   * caller's key in a local it reassigns, which would make the key look
+   * stored to the arena analysis.
+   */
+  keyBlocks(key: u8[], off: i32, len: i32): void {
+    hmacPadInto(this.pad, key, off, len, HMAC_IPAD)
+    hmacCopySha256(this.fresh, this.inner)
+    this.inner.update(this.pad, HMAC_FROM, SHA256_BLOCK)
+    hmacPadInto(this.pad, key, off, len, HMAC_OPAD)
+    hmacCopySha256(this.fresh, this.outer)
+    this.outer.update(this.pad, HMAC_FROM, SHA256_BLOCK)
+    secureZero(this.pad)
+  }
+
+  /** Absorbs `data[off .. off + len)`; a window outside `data` panics in `Sha256.update`. */
+  update(data: u8[], off: i32, len: i32): void {
+    this.inner.update(data, off, len)
+  }
+
+  /** Writes the 32-byte tag at `out[at]` and ends the computation; a window outside `out` panics. */
+  finishInto(out: u8[], at: i32): void {
+    if (!hmacWindowFits(toI32(out.length), at, SHA256_SIZE)) {
+      panic("HmacSha256Scratch: the tag window is outside its array")
+    }
+    const innerDigest: u8[] = this.inner.digest()
+    this.outer.update(innerDigest, HMAC_FROM, SHA256_SIZE)
+    secureZero(innerDigest)
+    const tag: u8[] = this.outer.digest()
+    for (let i: i32 = 0; i < SHA256_SIZE && i < toI32(tag.length) && at + i < toI32(out.length); i += 1) {
+      out[at + i] = tag[i]
+    }
+    secureZero(tag)
+  }
+
+  /** Zeroes both keyed hashers, for a caller done with the key; `begin` starts again. */
+  wipe(): void {
+    hmacWipeSha256(this.inner)
+    hmacWipeSha256(this.outer)
+  }
+}
+
+/**
+ * HMAC-SHA-384 over hashers the caller owns, with `HmacSha256Scratch`'s
+ * methods. The block is 128 bytes and the tag 48.
+ */
+export class HmacSha384Scratch {
+  /** H(K XOR ipad, …): keyed by `begin`, fed the message by `update`. */
+  inner: Sha384
+  /** H(K XOR opad, …): keyed by `begin`, fed the inner digest by `finishInto`. */
+  outer: Sha384
+  /** A hasher nothing is ever fed: the initial hash value `begin` copies from. */
+  fresh: Sha384
+  /** One key block XOR a pad, wiped as soon as it is absorbed. */
+  pad: u8[]
+  /** The SHA-384 of a key longer than a block; wiped once used. */
+  keyHash: u8[]
+
+  constructor() {
+    this.inner = new Sha384()
+    this.outer = new Sha384()
+    this.fresh = new Sha384()
+    this.pad = new Array<u8>(SHA512_BLOCK)
+    this.keyHash = new Array<u8>(SHA384_SIZE)
+  }
+
+  /** Keys a new computation with `key[off .. off + len)`, a key longer than 128 bytes by its SHA-384 (RFC 2104 §2). */
+  begin(key: u8[], off: i32, len: i32): void {
+    if (!hmacWindowFits(toI32(key.length), off, len)) {
+      panic("HmacSha384Scratch: the key window is outside its array")
+    }
+    if (len <= SHA512_BLOCK) {
+      this.keyBlocks(key, off, len)
+      return
+    }
+    hmacCopySha384(this.fresh, this.inner)
+    this.inner.update(key, off, len)
+    const digest: u8[] = this.inner.digest()
+    for (let i: i32 = 0; i < toI32(digest.length) && i < toI32(this.keyHash.length); i += 1) {
+      this.keyHash[i] = digest[i]
+    }
+    secureZero(digest)
+    this.keyBlocks(this.keyHash, HMAC_FROM, SHA384_SIZE)
+    secureZero(this.keyHash)
+  }
+
+  /**
+   * Absorbs `key[off .. off + len)`, no longer than a block, XOR ipad into the
+   * inner hasher and XOR opad into the outer one, each started again, and
+   * wipes the block. A method of its own so that `begin` never keeps the
+   * caller's key in a local it reassigns, which would make the key look
+   * stored to the arena analysis.
+   */
+  keyBlocks(key: u8[], off: i32, len: i32): void {
+    hmacPadInto(this.pad, key, off, len, HMAC_IPAD)
+    hmacCopySha384(this.fresh, this.inner)
+    this.inner.update(this.pad, HMAC_FROM, SHA512_BLOCK)
+    hmacPadInto(this.pad, key, off, len, HMAC_OPAD)
+    hmacCopySha384(this.fresh, this.outer)
+    this.outer.update(this.pad, HMAC_FROM, SHA512_BLOCK)
+    secureZero(this.pad)
+  }
+
+  /** Absorbs `data[off .. off + len)`; a window outside `data` panics in the hasher. */
+  update(data: u8[], off: i32, len: i32): void {
+    this.inner.update(data, off, len)
+  }
+
+  /** Writes the 48-byte tag at `out[at]` and ends the computation; a window outside `out` panics. */
+  finishInto(out: u8[], at: i32): void {
+    if (!hmacWindowFits(toI32(out.length), at, SHA384_SIZE)) {
+      panic("HmacSha384Scratch: the tag window is outside its array")
+    }
+    const innerDigest: u8[] = this.inner.digest()
+    this.outer.update(innerDigest, HMAC_FROM, SHA384_SIZE)
+    secureZero(innerDigest)
+    const tag: u8[] = this.outer.digest()
+    for (let i: i32 = 0; i < SHA384_SIZE && i < toI32(tag.length) && at + i < toI32(out.length); i += 1) {
+      out[at + i] = tag[i]
+    }
+    secureZero(tag)
+  }
+
+  /** Zeroes both keyed hashers, for a caller done with the key; `begin` starts again. */
+  wipe(): void {
+    hmacWipeSha384(this.inner)
+    hmacWipeSha384(this.outer)
+  }
+}

package/std/crypto/p256.ts

@@ -4,8 +4,10 @@
  *
  *     import { p256PublicKey, p256SignSha256, p256VerifySha256 } from "nish/crypto/p256";
  *
+ *     const priv: Secret<u8[]> = secret(readKey());              // nish:secret
  *     const pub: u8[] | null = p256PublicKey(priv);             // 65 bytes, 0x04 || X || Y
  *     const sig: u8[] | null = p256SignSha256(priv, message);   // 64 bytes, r || s
+ *     wipe(priv);
  *     const ok: boolean = p256VerifySha256(pub, message, sig);
  *
  * A private key is 32 big-endian bytes holding a scalar in [1, n); a public
@@ -73,12 +75,21 @@
  *
  * Verification multiplies only public values, and uses the same routine.
  *
+ * **The private key is a `Secret`** (`nish:secret`, docs/LANGUAGE.md
+ * "Secrets"). `p256PublicKey` and `p256Sign` read it only inside `expose` /
+ * `exposeWith`, whose function the checker holds to reaching no I/O and no C,
+ * and every intermediate the key or the nonce reaches is wiped before the
+ * signature is returned (ECC-2, docs/security/crypto-ecc.md). That is why RFC
+ * 6979's HMAC is written out over `Sha256` here (`p256Mac`) rather than taken
+ * from `nish/crypto/hmac`: its key blocks and hasher state have to be this
+ * module's to wipe.
+ *
  * Private names carry the `p256` prefix because a `std/` module's private
  * functions share the importing program's flat symbol namespace
  * (`docs/wp26-stdlib.md` §3e).
  */
-import { HmacSha256, hmacSha256 } from "nish/crypto/hmac"
-import { sha256 } from "nish/crypto/sha256"
+import { Secret, expose, exposeWith, wipe } from "nish:secret"
+import { Sha256, sha256 } from "nish/crypto/sha256"
 import { timingSafeEqual } from "nish/crypto/ct"
 
 /** The length in bytes of a private key: one scalar, big-endian. */
@@ -3784,6 +3795,23 @@ class P256PointScratch {
   }
 }
 
+/** Zero `p`'s three coordinates, with the store `nish:secret` keeps from the optimiser (ECC-2). */
+const p256WipePoint = (p: P256ProjectivePoint): void => {
+  wipe(p.x)
+  wipe(p.y)
+  wipe(p.z)
+}
+
+/** Zero every temporary a point operation left in `s`; `b` is the curve's public constant. */
+const p256WipeScratch = (s: P256PointScratch): void => {
+  wipe(s.t0)
+  wipe(s.t1)
+  wipe(s.t2)
+  wipe(s.t3)
+  wipe(s.t4)
+  p256WipePoint(s.sum)
+}
+
 /** `out = p`, coordinate by coordinate. */
 const p256PointCopy = (out: P256ProjectivePoint, p: P256ProjectivePoint): void => {
   p256Copy(out.x, p.x)
@@ -3948,17 +3976,18 @@ const p256TableBuild = (table: u32[], p: P256ProjectivePoint, s: P256PointScratc
  * way, at an offset that is the caller's loop position, never the secret.
  */
 const p256TableMove = (out: u32[], table: u32[], at: i32, hit: u32): void => {
+  const p: u32 = toU32(at)
   if (toI32(out.length) < 8 || at < 0 || at > toI32(table.length) - 8) {
     return
   }
-  out[0] = p256FiatCmovznzU32(hit, out[0], table[at])
-  out[1] = p256FiatCmovznzU32(hit, out[1], table[at + 1])
-  out[2] = p256FiatCmovznzU32(hit, out[2], table[at + 2])
-  out[3] = p256FiatCmovznzU32(hit, out[3], table[at + 3])
-  out[4] = p256FiatCmovznzU32(hit, out[4], table[at + 4])
-  out[5] = p256FiatCmovznzU32(hit, out[5], table[at + 5])
-  out[6] = p256FiatCmovznzU32(hit, out[6], table[at + 6])
-  out[7] = p256FiatCmovznzU32(hit, out[7], table[at + 7])
+  out[0] = p256FiatCmovznzU32(hit, out[0], table[p])
+  out[1] = p256FiatCmovznzU32(hit, out[1], table[p + 1])
+  out[2] = p256FiatCmovznzU32(hit, out[2], table[p + 2])
+  out[3] = p256FiatCmovznzU32(hit, out[3], table[p + 3])
+  out[4] = p256FiatCmovznzU32(hit, out[4], table[p + 4])
+  out[5] = p256FiatCmovznzU32(hit, out[5], table[p + 5])
+  out[6] = p256FiatCmovznzU32(hit, out[6], table[p + 6])
+  out[7] = p256FiatCmovznzU32(hit, out[7], table[p + 7])
 }
 
 /**
@@ -4014,6 +4043,11 @@ const p256ScalarMult = (
     p256PointAdd(acc, acc, entry, s)
   }
   p256PointCopy(out, acc)
+  // The accumulator and the selected entry follow the scalar's digits, and a
+  // signature's scalar is its nonce: both are wiped, and the table with them.
+  wipe(table)
+  p256WipePoint(acc)
+  p256WipePoint(entry)
 }
 
 /** The base point G (SEC 2 §2.4.2), in the Montgomery domain with Z = 1. */
@@ -4133,6 +4167,7 @@ const p256ScalarInRange = (bytes: u8[]): boolean => {
   p256LimbsFromBytes(a, bytes, 0)
   const below: u32 = p256Below(a, p256Order())
   const zero: u32 = ctEq(p256FiatNonzero(a), 0) & 1
+  wipe(a) // a private key's limbs, when `bytes` is one
   return (below & (zero ^ 1)) === 1
 }
 
@@ -4155,19 +4190,72 @@ const p256DigestScalar = (out: u32[], digest: u8[]): void => {
   p256ReduceOnce(out, a, p256Order())
 }
 
+/** RFC 2104's key block for SHA-256: `k` zero-extended to 64 bytes, each byte XOR `pad`. */
+const p256PadBlock = (k: u8[], pad: u8): u8[] => {
+  const out: u8[] = new Array<u8>(64)
+  const outLength: i32 = toI32(out.length)
+  const keyLength: i32 = toI32(k.length)
+  for (let i: i32 = 0; i < outLength; i++) {
+    if (i < keyLength) {
+      out[i] = k[i] ^ pad
+    } else {
+      out[i] = pad
+    }
+  }
+  return out
+}
+
+/** Zero what a SHA-256 in progress holds: its chaining value, its pending block and its schedule. */
+const p256WipeHash = (h: Sha256): void => {
+  wipe(h.state)
+  wipe(h.block)
+  wipe(h.schedule)
+}
+
+/**
+ * HMAC-SHA-256 keyed by `k` over `a || b || c || d` (RFC 2104), the one MAC
+ * RFC 6979 runs. It is written out over `Sha256` here rather than taken from
+ * `nish/crypto/hmac` so that every buffer the key reaches — the two key
+ * blocks, both hashers' state, block and schedule, and the inner digest — is
+ * this function's to wipe before it returns (ECC-2). `k` is always 32 bytes,
+ * under SHA-256's 64-byte block, so it is never hashed first.
+ */
+const p256Mac = (k: u8[], a: u8[], b: u8[], c: u8[], d: u8[]): u8[] => {
+  const ipad: u8[] = p256PadBlock(k, 0x36)
+  const opad: u8[] = p256PadBlock(k, 0x5c)
+  const inner = new Sha256()
+  inner.update(ipad, P256_FROM, toI32(ipad.length))
+  inner.update(a, P256_FROM, toI32(a.length))
+  inner.update(b, P256_FROM, toI32(b.length))
+  inner.update(c, P256_FROM, toI32(c.length))
+  inner.update(d, P256_FROM, toI32(d.length))
+  const innerDigest: u8[] = inner.digest()
+  const outer = new Sha256()
+  outer.update(opad, P256_FROM, toI32(opad.length))
+  outer.update(innerDigest, P256_FROM, toI32(innerDigest.length))
+  const tag: u8[] = outer.digest()
+  wipe(ipad)
+  wipe(opad)
+  wipe(innerDigest)
+  p256WipeHash(inner)
+  p256WipeHash(outer)
+  return tag
+}
+
 /**
  * HMAC_K(V || sep || x || h), the key update of RFC 6979 §3.2 steps d and f
  * (with `sep` 0 and then 1) and, with `x` and `h` empty, step h.3.
  */
 const p256NonceKey = (k: u8[], v: u8[], sep: u8, x: u8[], h: u8[]): u8[] => {
-  const mac = new HmacSha256(k)
   const separator: u8[] = new Array<u8>(1)
   separator[0] = sep
-  mac.update(v, P256_FROM, toI32(v.length))
-  mac.update(separator, P256_FROM, toI32(separator.length))
-  mac.update(x, P256_FROM, toI32(x.length))
-  mac.update(h, P256_FROM, toI32(h.length))
-  return mac.digest()
+  return p256Mac(k, v, separator, x, h)
+}
+
+/** HMAC_K(V), RFC 6979 §3.2 steps e, g and h.2. */
+const p256NonceValue = (k: u8[], v: u8[]): u8[] => {
+  const empty: u8[] = new Array<u8>(0)
+  return p256Mac(k, v, empty, empty, empty)
 }
 
 /**
@@ -4192,10 +4280,20 @@ const p256SignScalar = (priv: u8[], z: u32[]): u8[] => {
   for (let i: i32 = 0; i < 32; i++) {
     v[i] = 1
   }
-  k = p256NonceKey(k, v, 0, priv, h1) // step d
-  v = hmacSha256(k, v) // step e
-  k = p256NonceKey(k, v, 1, priv, h1) // step f
-  v = hmacSha256(k, v) // step g
+  // Each K and V is wiped as the next replaces it (ECC-2): both are derived
+  // from the private key, and the last V is the nonce.
+  let next: u8[] = p256NonceKey(k, v, 0, priv, h1) // step d
+  wipe(k)
+  k = next
+  next = p256NonceValue(k, v) // step e
+  wipe(v)
+  v = next
+  next = p256NonceKey(k, v, 1, priv, h1) // step f
+  wipe(k)
+  k = next
+  next = p256NonceValue(k, v) // step g
+  wipe(v)
+  v = next
 
   const dM: u32[] = p256Limbs()
   p256LimbsFromBytes(dM, priv, 0)
@@ -4208,7 +4306,9 @@ const p256SignScalar = (priv: u8[], z: u32[]): u8[] => {
   const kM: u32[] = p256Limbs()
   const s: u32[] = p256Limbs()
   while (true) {
-    v = hmacSha256(k, v) // step h.2
+    next = p256NonceValue(k, v) // step h.2
+    wipe(v)
+    v = next
     if (p256ScalarInRange(v)) {
       p256ScalarMult(point, v, g, scratch)
       p256AffineX(x, point)
@@ -4226,11 +4326,23 @@ const p256SignScalar = (priv: u8[], z: u32[]): u8[] => {
         const sig: u8[] = new Array<u8>(64)
         p256LimbsToBytes(sig, 0, r)
         p256LimbsToBytes(sig, 32, s)
+        // ECC-2: the private key's limbs, the nonce and its inverse, RFC
+        // 6979's K and V, the nonce point and the scratch it was built in.
+        wipe(k)
+        wipe(v)
+        wipe(dM)
+        wipe(kM)
+        p256WipePoint(point)
+        p256WipeScratch(scratch)
         return sig
       }
     }
-    k = p256NonceKey(k, v, 0, empty, empty) // step h.3
-    v = hmacSha256(k, v)
+    next = p256NonceKey(k, v, 0, empty, empty) // step h.3
+    wipe(k)
+    k = next
+    next = p256NonceValue(k, v)
+    wipe(v)
+    v = next
   }
 }
 
@@ -4239,12 +4351,17 @@ const p256SignScalar = (priv: u8[], z: u32[]): u8[] => {
  * encoding. Answers `null` unless `priv` is `P256_SCALAR_SIZE` bytes holding a
  * scalar in [1, n) — 0 and n and everything above are not private keys.
  */
-export const p256PublicKey = (priv: u8[]): u8[] | null => {
+export const p256PublicKey = (priv: Secret<u8[]>): u8[] | null => expose(priv, p256PublicKeyExposed)
+
+/** `p256PublicKey` on the plain key, for `expose` to run: the scratch the key's digits steered is wiped. */
+const p256PublicKeyExposed = (priv: u8[]): u8[] | null => {
   if (!p256ScalarInRange(priv)) {
     return null
   }
   const point = new P256ProjectivePoint()
-  p256ScalarMult(point, priv, p256Generator(), new P256PointScratch())
+  const scratch = new P256PointScratch()
+  p256ScalarMult(point, priv, p256Generator(), scratch)
+  p256WipeScratch(scratch)
   return p256EncodePoint(point)
 }
 
@@ -4256,7 +4373,11 @@ export const p256PublicKey = (priv: u8[]): u8[] | null => {
  * not normalised to the lower half. Answers `null` for a private key
  * `p256PublicKey` would refuse.
  */
-export const p256Sign = (priv: u8[], digest: u8[]): u8[] | null => {
+export const p256Sign = (priv: Secret<u8[]>, digest: u8[]): u8[] | null =>
+  exposeWith(priv, digest, p256SignExposed)
+
+/** `p256Sign` on the plain key, for `exposeWith` to run. */
+const p256SignExposed = (priv: u8[], digest: u8[]): u8[] | null => {
   if (!p256ScalarInRange(priv)) {
     return null
   }
@@ -4273,6 +4394,11 @@ export const p256Sign = (priv: u8[], digest: u8[]): u8[] | null => {
  * that is not a point on the curve, and a sum that is the identity all answer
  * `false`. Every value here is public, so the answer may be reached by
  * branches; the multiplications are the constant-time ones all the same.
+ *
+ * ECDSA is malleable, and so is this: when `(r, s)` verifies, `(r, n - s)`
+ * verifies too, as FIPS 186-4 and SEC 1 have it. Nothing here asks for the
+ * lower `s`, so a protocol that needs one signature per message and key (a
+ * signature used as an identifier, say) has to refuse the upper half itself.
  */
 export const p256Verify = (pub: u8[], digest: u8[], sig: u8[]): boolean => {
   if (toI32(sig.length) !== 64) {
@@ -4330,7 +4456,7 @@ export const p256Verify = (pub: u8[], digest: u8[], sig: u8[]): boolean => {
 }
 
 /** `p256Sign` of the SHA-256 of `msg`: ECDSA with SHA-256 over the whole message. */
-export const p256SignSha256 = (priv: u8[], msg: u8[]): u8[] | null => p256Sign(priv, sha256(msg))
+export const p256SignSha256 = (priv: Secret<u8[]>, msg: u8[]): u8[] | null => p256Sign(priv, sha256(msg))
 
 /** `p256Verify` of the SHA-256 of `msg`. */
 export const p256VerifySha256 = (pub: u8[], msg: u8[], sig: u8[]): boolean =>