@blamejs/pki 0.4.13 → 0.4.15

package/lib/key.js

@@ -120,11 +120,23 @@ async function encrypt(privateKey, password, opts) {
   var iterations = pbes2.assertIterations(opts.iterations == null ? 600000 : opts.iterations, _err, "key");
   var salt = opts.salt != null ? pbes2.assertSalt(guard.bytes.view(opts.salt, KeyError, "key/bad-input", "salt"), _err, "key") : nodeCrypto.randomBytes(16);
   var iv = nodeCrypto.randomBytes(16);
-  var dk = nodeCrypto.pbkdf2Sync(pbes2.passwordBytes(password, _err, "key"), salt, iterations, keyBits / 8, prfNode);
-  var ciphertext = pbes2.cbcEncrypt(dk, iv, der, keyBits);
-  var epki = b.sequence([pbes2.pbes2AlgId(salt, iterations, prf, cipherName, iv), b.octetString(ciphertext)]);
-  pkcs8.parseEncrypted(epki);   // self-check: the produced EncryptedPrivateKeyInfo re-parses
-  return opts.pem ? pkcs8.pemEncode(epki, "ENCRYPTED PRIVATE KEY") : epki;
+  // The derived key protects a PRIVATE KEY, so it is cleared as soon as the encryption is done. The
+  // caller's password is untouched -- passwordBytes returns a supplied Buffer as-is.
+  // A string / Uint8Array password is encoded into a buffer THIS toolkit allocated -- a credential
+  // copy -- so it is cleared once the derivation has consumed it. A caller-supplied Buffer is
+  // borrowed and left intact.
+  var pwK = pbes2.passwordBytesOwned(password, _err, "key");
+  var dk;
+  try { dk = nodeCrypto.pbkdf2Sync(pwK.bytes, salt, iterations, keyBits / 8, prfNode); }
+  finally { if (pwK.owned) guard.secret.zeroize(pwK.bytes, KeyError, "key/bad-input", "the password encoding"); }
+  try {
+    var ciphertext = pbes2.cbcEncrypt(dk, iv, der, keyBits);
+    var epki = b.sequence([pbes2.pbes2AlgId(salt, iterations, prf, cipherName, iv), b.octetString(ciphertext)]);
+    pkcs8.parseEncrypted(epki);   // self-check: the produced EncryptedPrivateKeyInfo re-parses
+    return opts.pem ? pkcs8.pemEncode(epki, "ENCRYPTED PRIVATE KEY") : epki;
+  } finally {
+    guard.secret.zeroize(dk, KeyError, "key/bad-input", "the password-derived encryption key");
+  }
 }
 
 /**
@@ -176,7 +188,13 @@ function _decryptPbes2(encAlg, ciphertext, password, opts) {
   // The shared PBES2 decrypt home (strict params + the uniform decrypt-failed on a wrong key / bad pad). The
   // plaintext re-parse below is the MAC-less PBES2-CBC integrity check (RFC 8018 sec. 8): a bad pad and a
   // valid pad whose plaintext is not a PrivateKeyInfo are indistinguishable, and it MUST run (never skipped).
-  var plaintext = pbes2.pbes2Decrypt(pbes2.passwordBytes(password, _err, "key"), encAlg.parameters, ciphertext, opts, _err, "key");
+  // A string / Uint8Array password is encoded into a buffer THIS toolkit allocated -- a credential
+  // copy -- so it is cleared once the derivation has consumed it. A caller-supplied Buffer is
+  // borrowed and left intact.
+  var pwD = pbes2.passwordBytesOwned(password, _err, "key");
+  var plaintext;
+  try { plaintext = pbes2.pbes2Decrypt(pwD.bytes, encAlg.parameters, ciphertext, opts, _err, "key"); }
+  finally { if (pwD.owned) guard.secret.zeroize(pwD.bytes, KeyError, "key/bad-input", "the password encoding"); }
   try { pkcs8.parse(plaintext); }
   catch (_e) { throw _err("key/decrypt-failed", "decryption failed"); }
   return plaintext;