configfile: Explicitly wipe scrypt derived key after decrypting/encrypting master key.

Further raises the bar for recovering keys from memory.

1 files changed, 7 insertions, 0 deletions

diff --git a/internal/contentenc/content.go b/internal/contentenc/content.go
index bda3fdc..c0f9851 100644
--- a/internal/contentenc/content.go
+++ b/internal/contentenc/content.go
@@ -324,3 +324,10 @@ func (be *ContentEnc) MergeBlocks(oldData []byte, newData []byte, offset int) []
 	}
 	return out[0:outLen]
 }
+
+// Wipe tries to wipe secret keys from memory by overwriting them with zeros
+// and/or setting references to nil.
+func (be *ContentEnc) Wipe() {
+	be.cryptoCore.Wipe()
+	be.cryptoCore = nil
+}