From 8f5226a0313d460613b9551ca46e3913cd408c6c Mon Sep 17 00:00:00 2001 From: Yuki Kishimoto Date: Sat, 13 Jun 2026 19:39:04 +0200 Subject: [PATCH 1/2] nostr: impl `Drop` for `Keys` Erase the keypair in `Keys` on `Drop`. Closes https://github.com/rust-nostr/nostr/issues/1378 Signed-off-by: Yuki Kishimoto --- crates/nostr/src/key/mod.rs | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/crates/nostr/src/key/mod.rs b/crates/nostr/src/key/mod.rs index 1c93be805..d6662379a 100644 --- a/crates/nostr/src/key/mod.rs +++ b/crates/nostr/src/key/mod.rs @@ -265,6 +265,16 @@ impl FromStr for Keys { } } +impl Drop for Keys { + #[inline] + fn drop(&mut self) { + // Erase the keypair. + // + // NOTE: we already erase the secret key in 'impl Drop for SecretKey'. + self.keypair.non_secure_erase(); + } +} + impl GetPublicKey for Keys { type Error = Infallible; From f0c716900d533a7629c76f91276af4a3f10e3890 Mon Sep 17 00:00:00 2001 From: Yuki Kishimoto Date: Sat, 13 Jun 2026 19:47:21 +0200 Subject: [PATCH 2/2] nostr: remove `Keys::keypair` method This avoids external copies of the keypair and keeps its lifecycle tied to `Keys`, so the key material is erased in one controlled place on drop. Signed-off-by: Yuki Kishimoto --- crates/nostr/src/key/mod.rs | 6 ------ 1 file changed, 6 deletions(-) diff --git a/crates/nostr/src/key/mod.rs b/crates/nostr/src/key/mod.rs index d6662379a..97f9c339b 100644 --- a/crates/nostr/src/key/mod.rs +++ b/crates/nostr/src/key/mod.rs @@ -209,12 +209,6 @@ impl Keys { &self.secret_key } - /// Get keypair - #[inline] - pub fn keypair(&self) -> &Keypair { - &self.keypair - } - /// Creates a schnorr signature of the [`Message`]. /// /// This method uses a random number generator that retrieves randomness from the operating system (see [`SysRng`]).