Re: [PATCH 0/3] lib/crypto: Provide a function for zeroizing hmac_sha1_ctx

[Jarkko Sakkinen]

On Wed, Aug 12, 2026 at 06:33:33PM +0200, Thomas Huth wrote:
> It's maybe not worth the effort for hmac_sha1_ctx right now (since there
> is only one spot that forgot to zeroize the structure in case of errors),
> but offering a function for zeroizing the data via __cleanup might help to
> get future code into the proper shape right from the start. Thus let's
> introduce a hmac_sha1_zeroize_ctx() function now and use it in the
> appropriate spots.
> 
> Thomas Huth (3):
>   crypto: Provide a wrapper for zeroizing hmac_sha1_ctx
>   security: keys: trusted: always clear the hmac_sha1_ctx before
>     returning
>   lib/crypto: sha1: Use hmac_sha1_zeroize_ctx() instead of
>     memzero_explicit()
> 
>  include/crypto/sha1.h                     | 17 +++++++++++++++++
>  lib/crypto/sha1.c                         |  2 +-
>  security/keys/trusted-keys/trusted_tpm1.c |  2 +-
>  3 files changed, 19 insertions(+), 2 deletions(-)
> 
> -- 
> 2.55.0
> 

Looks right to me:


For 1-3:

Reviewed-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx>

BR, Jarkko