fix: zeroize temp fields during serializing (#126)

* fix: zeroize temp fields during serializing

* fmt

src/ristretto/serialize.rs

@@ -32,6 +32,7 @@ use serde::{
     Serializer,
 };
 use tari_utilities::{byte_array::ByteArray, hex::Hex};
+use zeroize::Zeroize;
 
 use crate::ristretto::{RistrettoPublicKey, RistrettoSecretKey};
 
@@ -92,8 +93,10 @@ impl<'de> Deserialize<'de> for RistrettoSecretKey {
         }
 
         if deserializer.is_human_readable() {
-            let s = String::deserialize(deserializer)?;
-            RistrettoSecretKey::from_hex(&s).map_err(de::Error::custom)
+            let mut s = String::deserialize(deserializer)?;
+            let v = RistrettoSecretKey::from_hex(&s).map_err(de::Error::custom);
+            s.zeroize();
+            v
         } else {
             deserializer.deserialize_bytes(RistrettoVisitor)
         }
@@ -104,7 +107,10 @@ impl Serialize for RistrettoSecretKey {
     fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
     where S: Serializer {
         if serializer.is_human_readable() {
-            self.to_hex().serialize(serializer)
+            let mut s = self.to_hex();
+            let result = s.serialize(serializer);
+            s.zeroize();
+            result
         } else {
             serializer.serialize_bytes(self.as_bytes())
         }