crypto: make ChaCha20::SetKey wipe buffer

2 files changed, 8 insertions, 5 deletions

diff --git a/src/crypto/chacha20.cpp b/src/crypto/chacha20.cpp
index 143179f905..a3cc87e81b 100644
--- a/src/crypto/chacha20.cpp
+++ b/src/crypto/chacha20.cpp
@@ -335,6 +335,13 @@ ChaCha20::~ChaCha20()
     memory_cleanse(m_buffer.data(), m_buffer.size());
 }
 
+void ChaCha20::SetKey(Span<const std::byte> key) noexcept
+{
+    m_aligned.SetKey(key);
+    m_bufleft = 0;
+    memory_cleanse(m_buffer.data(), m_buffer.size());
+}
+
 FSChaCha20::FSChaCha20(Span<const std::byte> key, uint32_t rekey_interval) noexcept :
     m_chacha20(key), m_rekey_interval(rekey_interval)
 {
diff --git a/src/crypto/chacha20.h b/src/crypto/chacha20.h
index 4d16961609..5f0f1ff64b 100644
--- a/src/crypto/chacha20.h
+++ b/src/crypto/chacha20.h
@@ -95,11 +95,7 @@ public:
     ~ChaCha20();
 
     /** Set 32-byte key, and seek to nonce 0 and block position 0. */
-    void SetKey(Span<const std::byte> key) noexcept
-    {
-        m_aligned.SetKey(key);
-        m_bufleft = 0;
-    }
+    void SetKey(Span<const std::byte> key) noexcept;
 
     /** 96-bit nonce type. */
     using Nonce96 = ChaCha20Aligned::Nonce96;