fix(739) SignatureECDSAN destroying private key

mwiede · Jan 7, 2025 · 1d013ef · 1d013ef
1 parent 323a82a
commit 1d013ef
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 3 deletions.
diff --git a/src/main/java/com/jcraft/jsch/KeyPairECDSA.java b/src/main/java/com/jcraft/jsch/KeyPairECDSA.java
@@ -345,13 +345,16 @@ public int getKeySize() {
 
   @Override
   public byte[] getSignature(byte[] data) {
+    byte[] keyCopy = null;
     try {
       Class<? extends SignatureECDSA> c =
           Class.forName(JSch.getConfig("ecdsa-sha2-" + Util.byte2str(name)))
               .asSubclass(SignatureECDSA.class);
       SignatureECDSA ecdsa = c.getDeclaredConstructor().newInstance();
       ecdsa.init();
-      ecdsa.setPrvKey(prv_array);
+      // https://github.com/mwiede/jsch/issues/739 : prv_array could be destroyed by ecdsa signing process if its first bit is 1
+      keyCopy = Arrays.copyOf(prv_array, prv_array.length);
+      ecdsa.setPrvKey(keyCopy);
 
       ecdsa.update(data);
       byte[] sig = ecdsa.sign();
@@ -364,6 +367,8 @@ public byte[] getSignature(byte[] data) {
       if (instLogger.getLogger().isEnabled(Logger.ERROR)) {
         instLogger.getLogger().log(Logger.ERROR, "failed to generate signature", e);
       }
+    } finally {
+      Util.bzero(keyCopy);
     }
     return null;
   }

diff --git a/src/main/java/com/jcraft/jsch/jce/Util.java b/src/main/java/com/jcraft/jsch/jce/Util.java
@@ -26,8 +26,8 @@
 
 package com.jcraft.jsch.jce;
 
-class Util {
-  static void bzero(byte[] foo) {
+public class Util {
+  public static void bzero(byte[] foo) {
     if (foo == null)
       return;
     for (int i = 0; i < foo.length; i++)