zeroize OTP UDS in stm32h5 derive path

danielinux · danielinux · commit 25668dd39b49 · 2026-04-14T14:38:51.000+02:00
F/2594
diff --git a/hal/stm32h5.c b/hal/stm32h5.c
@@ -42,6 +42,7 @@
 #elif defined(WOLFBOOT_HASH_SHA3_384)
 #include <wolfssl/wolfcrypt/sha3.h>
 #endif
+#include <wolfssl/wolfcrypt/memory.h>
 #endif
 
 #define PLL_SRC_HSE 1
@@ -272,9 +273,11 @@ int hal_uds_derive_key(uint8_t *out, size_t out_len)
                 copy_len = out_len;
             }
             memcpy(out, uds, copy_len);
+            wc_ForceZero(uds, sizeof(uds));
             return 0;
         }
     }
+    wc_ForceZero(uds, sizeof(uds));
 #endif
 
 #ifdef WOLFBOOT_UDS_UID_FALLBACK_FORTEST

Original file line number	Diff line number	Diff line change
`@@ -42,6 +42,7 @@`
`42`	`42`	`#elif defined(WOLFBOOT_HASH_SHA3_384)`
`43`	`43`	`#include <wolfssl/wolfcrypt/sha3.h>`
`44`	`44`	`#endif`
	`45`	`+#include <wolfssl/wolfcrypt/memory.h>`
`45`	`46`	`#endif`
`46`	`47`
`47`	`48`	`#define PLL_SRC_HSE 1`
`@@ -272,9 +273,11 @@ int hal_uds_derive_key(uint8_t *out, size_t out_len)`
`272`	`273`	`copy_len = out_len;`
`273`	`274`	`}`
`274`	`275`	`memcpy(out, uds, copy_len);`
	`276`	`+ wc_ForceZero(uds, sizeof(uds));`
`275`	`277`	`return 0;`
`276`	`278`	`}`
`277`	`279`	`}`
	`280`	`+ wc_ForceZero(uds, sizeof(uds));`
`278`	`281`	`#endif`
`279`	`282`
`280`	`283`	`#ifdef WOLFBOOT_UDS_UID_FALLBACK_FORTEST`