Module zeroize 

Secret wiping: the Zeroize trait, the ZeroizeOnDrop marker and the Zeroizing guard.

This module mirrors the API of the zeroize crate (minus its derive macro) so that users of purecrypto need not pull in a second dependency to wipe key material. The crate’s own secret-holding types are wiped through it.

Contract

Zeroize::zeroize overwrites a value with zeros using volatile stores followed by a compiler_fence, so the optimizer cannot treat the writes as dead stores and drop them, even when the value is never read again (the usual situation in a destructor).

What it does not do, and honestly cannot: reach copies of the secret the compiler or operating system made elsewhere. Values that lived in registers, were spilled to the stack by the compiler, were moved (a Rust move is a bit-copy that leaves the source intact), were copied by a reallocating Vec, or were paged out to swap are outside its reach. Treat wiping as hygiene that shrinks the window in which secrets linger, not as a guarantee against an attacker who can read process memory.

Example

use purecrypto::zeroize::{Zeroize, Zeroizing};

// Explicit wipe.
let mut key = [0x42u8; 32];
key.zeroize();
assert_eq!(key, [0u8; 32]);

// Wipe on drop: `Zeroizing<T>` derefs to `T` and zeroes it when it goes
// out of scope. Its `Debug` output never shows the contents.
let secret = Zeroizing::new([0x42u8; 32]);
assert_eq!(secret[0], 0x42);
assert_eq!(format!("{secret:?}"), "Zeroizing([REDACTED])");
drop(secret); // wiped here

A type holding secrets implements Zeroize by wiping each field, and wipes itself on drop with a two-line Drop impl:

use purecrypto::zeroize::{Zeroize, ZeroizeOnDrop};

struct SigningKey {
    seed: [u8; 32],
    public: [u8; 32], // not secret, but cheap to clear too
}

impl Zeroize for SigningKey {
    fn zeroize(&mut self) {
        self.seed.zeroize();
        self.public.zeroize();
    }
}

impl Drop for SigningKey {
    fn drop(&mut self) {
        self.zeroize();
    }
}

impl ZeroizeOnDrop for SigningKey {}

Structs

Zeroizing

A guard that wipes the wrapped value when dropped.

Traits

DefaultIsZeroes

Marker for Copy types whose Default value is the all-zero bit pattern, which is the only thing needed to wipe them.

Zeroize

Types whose contents can be overwritten with zeros.

ZeroizeOnDrop

Marker for types that wipe their secrets when dropped.

Functions

zero_bulk

Wipes a large, plain-byte buffer with ordinary (vectorizable) stores instead of the volatile ones behind Zeroize.