gabriel / muse public
patch task/derived-key-zeroing #1 / 1
AI Agent gabriel · 59 days ago · Apr 17, 2026 · Diff

security: zero DerivedKey private_bytes and chain_code after use

DerivedKey.private_bytes and chain_code were immutable bytes — raw Ed25519 key material lingered in the Python heap indefinitely after derivation.

Changes: - DerivedKey fields changed from bytes to bytearray (frozen=True removed) - DerivedKey.zero() added: overwrites both fields with null bytes - master_key and child_key wrap HMAC output in bytearray and zero I and data immediately after slicing into the new DerivedKey - derive_path zeroes each intermediate DerivedKey before moving to the next child (parent material no longer needed after child is derived) - generate_hd_keypair calls dk.zero() after Ed25519PrivateKey.from_private_bytes() so the OpenSSL key object holds the material and the Python heap copy is wiped

8 tests in test_derived_key_zeroing.py.

sha256:8c444a31f6273c8b6865481dd8c60519bd67d384b4b0a4a5078c476c69a6d612 sha
sha256:aa5c4195c196ba2d460f8de9760cbd5ee0327c9f16ef0ca76a00545ebbc7451a snapshot
← Older Oldest on task/derived-key-zeroing
All commits
Newer → Latest on task/derived-key-zeroing

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:8c444a31f6273c8b6865481dd8c60519bd67d384b4b0a4a5078c476c69a6d612 --body "your comment"