core: add zeroize dep

Author: yukibtc

Cargo.lock

@@ -16,12 +16,13 @@ default = ["sysinfo"]
 [dependencies]
 aes = "0.8"
 bdk = { git = "https://github.com/bitcoindevkit/bdk", rev = "417963f16882945423b8a8b6b33a507f8d4888a3", default-features = false, features = ["std"] }
-bip39 = "2.0"
+bip39 = { git = "https://github.com/rust-bitcoin/rust-bip39", rev = "a30760beac21d595b2bda376df4f4e6bf029bcc5", default-features = false, features = ["std", "zeroize"] }
 cbc = { version = "0.1", features = ["alloc"] }
 chacha20poly1305 = "0.10"
 rand_chacha = "0.3"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
+zeroize = { version = "1.5", features = ["derive"] } # bip39 uses version 1.5
 
 [target.'cfg(not(target_vendor = "apple"))'.dependencies]
 sysinfo = { version = "0.28", optional = true }

keechain-core/Cargo.toml

@@ -8,6 +8,7 @@ use bdk::bitcoin::secp256k1::{Secp256k1, Signing};
 use bdk::bitcoin::Network;
 use serde::de::Deserializer;
 use serde::{Deserialize, Serialize};
+use zeroize::{Zeroize, ZeroizeOnDrop};
 
 use crate::bips::bip32::{self, Bip32, ExtendedPubKey, Fingerprint};
 use crate::bips::bip39::Mnemonic;
@@ -157,17 +158,16 @@ impl EncryptedKeychain {
     }
 }
 
-#[derive(Deserialize)]
+#[derive(Serialize, Deserialize, Zeroize, ZeroizeOnDrop)]
 struct KeychainIntermediate {
     mnemonic: Mnemonic,
     passphrases: Vec<String>,
 }
 
-#[derive(Clone, Serialize)]
+#[derive(Clone, Zeroize, ZeroizeOnDrop)]
 pub struct Keychain {
     mnemonic: Mnemonic,
     passphrases: Vec<String>,
-    #[serde(skip_serializing)]
     pub seed: Seed,
 }
 
@@ -184,10 +184,16 @@ impl Deref for Keychain {
     }
 }
 
-impl Drop for Keychain {
-    fn drop(&mut self) {
-        self.mnemonic = Mnemonic::from_entropy(b"00000000000000000000000000000000").unwrap();
-        self.passphrases = Vec::new();
+impl Serialize for Keychain {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        let intermediate = KeychainIntermediate {
+            mnemonic: self.mnemonic.clone(),
+            passphrases: self.passphrases.clone(),
+        };
+        intermediate.serialize(serializer)
     }
 }
 
@@ -197,7 +203,10 @@ impl<'de> Deserialize<'de> for Keychain {
         D: Deserializer<'de>,
     {
         let intermediate = KeychainIntermediate::deserialize(deserializer)?;
-        Ok(Self::new(intermediate.mnemonic, intermediate.passphrases))
+        Ok(Self::new(
+            intermediate.mnemonic.clone(),
+            intermediate.passphrases.clone(),
+        ))
     }
 }
 

keechain-core/src/types/keychain.rs

@@ -6,13 +6,14 @@ use core::fmt;
 use bdk::bitcoin::Network;
 use bip39::Mnemonic;
 use serde::{Deserialize, Serialize};
+use zeroize::{Zeroize, ZeroizeOnDrop};
 
 use crate::bips::bip32::{self, Bip32, ExtendedPrivKey};
 use crate::bips::bip85::Bip85;
 use crate::descriptors::ToDescriptor;
 use crate::util::hex;
 
-#[derive(Clone, Eq, PartialEq, Serialize, Deserialize)]
+#[derive(Clone, PartialEq, Eq, Serialize, Deserialize, Zeroize, ZeroizeOnDrop)]
 pub struct Seed {
     mnemonic: Mnemonic,
     passphrase: Option<String>,
@@ -24,13 +25,6 @@ impl fmt::Debug for Seed {
     }
 }
 
-impl Drop for Seed {
-    fn drop(&mut self) {
-        self.mnemonic = Mnemonic::from_entropy(b"00000000000000000000000000000000").unwrap();
-        self.passphrase = None;
-    }
-}
-
 impl Seed {
     pub fn new<S>(mnemonic: Mnemonic, passphrase: Option<S>) -> Self
     where