Clarify p256 and k256 key generation

spruceid · Oct 20, 2021 · 49198f0 · 49198f0
1 parent 5b438cd
commit 49198f0
Showing 1 changed file with 6 additions and 5 deletions.
diff --git a/src/jwk.rs b/src/jwk.rs
@@ -276,22 +276,23 @@ impl JWK {
     pub fn generate_secp256k1() -> Result<JWK, Error> {
         let mut rng = rand::rngs::OsRng {};
         let secret_key = k256::SecretKey::random(&mut rng);
-        let sk_bytes = secret_key.to_bytes();
+        // SecretKey zeroizes on drop
+        let sk_bytes = secret_key.to_bytes().to_vec();
         let public_key = secret_key.public_key();
         let mut ec_params = ECParams::try_from(&public_key)?;
-        ec_params.ecc_private_key = Some(Base64urlUInt(sk_bytes.to_vec()));
+        ec_params.ecc_private_key = Some(Base64urlUInt(sk_bytes));
         Ok(JWK::from(Params::EC(ec_params)))
     }
 
     #[cfg(feature = "p256")]
     pub fn generate_p256() -> Result<JWK, Error> {
         let mut rng = rand::rngs::OsRng {};
         let secret_key = p256::SecretKey::random(&mut rng);
-        use p256::elliptic_curve::ff::PrimeField;
-        let sk_bytes = secret_key.secret_scalar().to_repr();
+        // SecretKey zeroizes on drop
+        let sk_bytes = secret_key.to_bytes().to_vec();
         let public_key: p256::PublicKey = secret_key.public_key();
         let mut ec_params = ECParams::try_from(&public_key)?;
-        ec_params.ecc_private_key = Some(Base64urlUInt(sk_bytes.to_vec()));
+        ec_params.ecc_private_key = Some(Base64urlUInt(sk_bytes));
         Ok(JWK::from(Params::EC(ec_params)))
     }