From a19731a16024c4e643b4a39c6e8882a5684ab433 Mon Sep 17 00:00:00 2001
From: Cezary Olborski <cezary.olborski@gmail.com>
Date: Thu, 12 Nov 2026 07:30:30 +0800
Subject: [PATCH] hmac: impl ZeroizeOnDrop for HMAC cores and wrappers

---
 hmac/Cargo.toml       |  2 +-
 hmac/src/block_api.rs |  9 +++++++++
 hmac/src/lib.rs       |  9 +++++++++
 hmac/tests/zeroize.rs | 21 +++++++++++++++++++++
 4 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 hmac/tests/zeroize.rs

diff --git a/hmac/Cargo.toml b/hmac/Cargo.toml
index e94b0ba6..688492ef 100644
--- a/hmac/Cargo.toml
+++ b/hmac/Cargo.toml
@@ -19,7 +19,7 @@ digest = { version = "0.11.2", features = ["mac"] }
 digest = { version = "0.11.2", features = ["dev"] }
 md-5 = { version = "0.11", default-features = false }
 sha1 = { version = "0.11", default-features = false }
-sha2 = { version = "0.11", default-features = false }
+sha2 = { version = "0.11", default-features = false, features = ["zeroize"] }
 streebog = { version = "0.11", default-features = false }
 hex-literal = "1"
 
diff --git a/hmac/src/block_api.rs b/hmac/src/block_api.rs
index 3071f682..6d9a57d0 100644
--- a/hmac/src/block_api.rs
+++ b/hmac/src/block_api.rs
@@ -10,6 +10,9 @@ use digest::{
     common::{Key, KeySizeUser},
 };
 
+#[cfg(feature = "zeroize")]
+use digest::zeroize::ZeroizeOnDrop;
+
 /// Generic core HMAC instance, which operates over blocks.
 pub struct HmacCore<D: EagerHash> {
     digest: D::Core,
@@ -98,6 +101,9 @@ impl<D: EagerHash + AlgorithmName> AlgorithmName for HmacCore<D> {
     }
 }
 
+#[cfg(feature = "zeroize")]
+impl<D: EagerHash> ZeroizeOnDrop for HmacCore<D> where D::Core: ZeroizeOnDrop {}
+
 impl<D: EagerHash> fmt::Debug for HmacCore<D>
 where
     D::Core: AlgorithmName,
@@ -205,6 +211,9 @@ impl<D: EagerHash + AlgorithmName> AlgorithmName for HmacResetCore<D> {
     }
 }
 
+#[cfg(feature = "zeroize")]
+impl<D: EagerHash> ZeroizeOnDrop for HmacResetCore<D> where D::Core: ZeroizeOnDrop {}
+
 impl<D: EagerHash> fmt::Debug for HmacResetCore<D>
 where
     D::Core: AlgorithmName,
diff --git a/hmac/src/lib.rs b/hmac/src/lib.rs
index d21153bc..bbfaf63e 100644
--- a/hmac/src/lib.rs
+++ b/hmac/src/lib.rs
@@ -31,6 +31,9 @@ pub use simple_reset::SimpleHmacReset;
 use core::fmt;
 use digest::block_api::{AlgorithmName, CoreProxy};
 
+#[cfg(feature = "zeroize")]
+use digest::zeroize::ZeroizeOnDrop;
+
 digest::buffer_fixed!(
     /// Generic HMAC instance.
     #[derive(Clone)]
@@ -44,6 +47,9 @@ impl<D: EagerHash + AlgorithmName> AlgorithmName for Hmac<D> {
     }
 }
 
+#[cfg(feature = "zeroize")]
+impl<D: EagerHash> ZeroizeOnDrop for Hmac<D> where D::Core: ZeroizeOnDrop {}
+
 digest::buffer_fixed!(
     /// Generic HMAC instance with reset support.
     #[derive(Clone)]
@@ -56,3 +62,6 @@ impl<D: EagerHash + AlgorithmName> AlgorithmName for HmacReset<D> {
         <Self as CoreProxy>::Core::write_alg_name(f)
     }
 }
+
+#[cfg(feature = "zeroize")]
+impl<D: EagerHash> ZeroizeOnDrop for HmacReset<D> where D::Core: ZeroizeOnDrop {}
diff --git a/hmac/tests/zeroize.rs b/hmac/tests/zeroize.rs
new file mode 100644
index 00000000..bb6f4e93
--- /dev/null
+++ b/hmac/tests/zeroize.rs
@@ -0,0 +1,21 @@
+//! `ZeroizeOnDrop` tests.
+#![cfg(feature = "zeroize")]
+
+use digest::zeroize::ZeroizeOnDrop;
+use hmac::{
+    Hmac, HmacReset,
+    block_api::{HmacCore, HmacResetCore},
+};
+use sha2::{Sha256, Sha512};
+
+fn assert_zeroize_on_drop<T: ZeroizeOnDrop>() {}
+
+#[test]
+fn zeroize_on_drop() {
+    assert_zeroize_on_drop::<HmacCore<Sha256>>();
+    assert_zeroize_on_drop::<HmacResetCore<Sha256>>();
+    assert_zeroize_on_drop::<Hmac<Sha256>>();
+    assert_zeroize_on_drop::<HmacReset<Sha256>>();
+    assert_zeroize_on_drop::<Hmac<Sha512>>();
+    assert_zeroize_on_drop::<HmacReset<Sha512>>();
+}