openpgp: Zero the stack after nettle's ed25519::public_keyryan/zero-stack-ed25519-pubkey

  - libgmp, a dependency of nettle, does not appropriately zero the
    input after calling `mpn_mul_n`. Because of this, it is possible for
    an ed25519 private key to be kept on the stack. This only occurs on
    some systems and may depend on the optimization of the compiler
    building libgmp.

  - Fixes #1080.

1 files changed, 3 insertions, 1 deletions

diff --git a/openpgp/src/crypto/backend/nettle/asymmetric.rs b/openpgp/src/crypto/backend/nettle/asymmetric.rs
index 405074a0..ac679146 100644
--- a/openpgp/src/crypto/backend/nettle/asymmetric.rs
+++ b/openpgp/src/crypto/backend/nettle/asymmetric.rs
@@ -74,7 +74,9 @@ impl Asymmetric for super::Backend {
     fn ed25519_derive_public(secret: &Protected) -> Result<[u8; 32]> {
         debug_assert_eq!(ed25519::ED25519_KEY_SIZE, 32);
         let mut public = [0; 32];
-        ed25519::public_key(&mut public, secret)?;
+        zero_stack!(2048 bytes after running {
+            ed25519::public_key(&mut public, secret)
+        })?;
         Ok(public)
     }