Files
Aditya Patwardhan aaf99d3b68 fix(protocomm): zeroize SRP session key before free
esp_srp_free() released the 64-byte SHA-512 session_key buffer with a
plain free(), leaving the derived session key resident in heap memory
that can later be reallocated and read back. Wipe it with
mbedtls_platform_zeroize() before freeing.

Closes SEC-120
2026-09-21 11:42:04 +05:30
..