[cryptography] Secret<T> wrapper memory hardening

.github/workflows/benchmark.yml

@@ -37,7 +37,7 @@ jobs:
       matrix:
         include:
           - package: commonware-cryptography
-            cargo_flags: ""
+            cargo_flags: "--features commonware-cryptography/unsafe-mlock"
             file_suffix: ""
             benchmark_name: "commonware-cryptography"
           - package: commonware-storage

.github/workflows/slow.yml

@@ -83,7 +83,7 @@ jobs:
       matrix:
         include:
           - package: commonware-cryptography
-            cargo_flags: ""
+            cargo_flags: "--features commonware-cryptography/unsafe-mlock"
           - package: commonware-storage
             cargo_flags: ""
           - package: commonware-storage

consensus/Cargo.toml

@@ -43,6 +43,7 @@ tracing.workspace = true
 [dev-dependencies]
 commonware-conformance.workspace = true
 commonware-consensus = { path = ".", features = ["mocks"] }
+commonware-cryptography = { workspace = true, features = ["unsafe-mlock"] }
 commonware-math.workspace = true
 commonware-resolver = { workspace = true, features = ["mocks"] }
 commonware-runtime = { workspace = true, features = ["test-utils"] }

cryptography/Cargo.toml

@@ -46,6 +46,9 @@ aws-lc-rs.workspace = true
 version = "0.2.15"
 features = ["js"]
 
+[target.'cfg(unix)'.dependencies]
+libc.workspace = true
+
 [dev-dependencies]
 anyhow.workspace = true
 commonware-conformance.workspace = true
@@ -61,6 +64,7 @@ crate-type = ["rlib", "cdylib"]
 
 [features]
 default = [ "std" ]
+unsafe-mlock = []
 parallel = [ "blake3/rayon", "commonware-parallel/std", "std" ]
 mocks = [ "std" ]
 arbitrary = [
@@ -98,16 +102,19 @@ std = [
 name = "bls12381"
 harness = false
 path = "src/bls12381/benches/bench.rs"
+required-features = ["unsafe-mlock"]
 
 [[bench]]
 name = "ed25519"
 harness = false
 path = "src/ed25519/benches/bench.rs"
+required-features = ["unsafe-mlock"]
 
 [[bench]]
 name = "secp256r1"
 harness = false
 path = "src/secp256r1/benches/bench.rs"
+required-features = ["unsafe-mlock"]
 
 [[bench]]
 name = "sha256"
@@ -128,3 +135,4 @@ path = "src/lthash/benches/bench.rs"
 name = "handshake"
 harness = false
 path = "src/handshake/benches/bench.rs"
+required-features = ["unsafe-mlock"]

cryptography/src/bls12381/dkg.rs

@@ -689,7 +689,7 @@ pub struct DealerPrivMsg {
 
 impl DealerPrivMsg {
     /// Creates a new `DealerPrivMsg` with the given share.
-    pub const fn new(share: Scalar) -> Self {
+    pub fn new(share: Scalar) -> Self {
         Self {
             share: Secret::new(share),
         }

cryptography/src/bls12381/primitives/group.rs

@@ -507,7 +507,7 @@ pub struct Share {
 
 impl Share {
     /// Creates a new `Share` with the given index and private key.
-    pub const fn new(index: u32, private: Private) -> Self {
+    pub fn new(index: u32, private: Private) -> Self {
         Self {
             index,
             private: Secret::new(private),

cryptography/src/handshake/key_exchange.rs

@@ -9,7 +9,7 @@ pub struct SharedSecret {
 
 impl SharedSecret {
     /// Creates a new SharedSecret wrapping the given x25519 shared secret.
-    const fn new(secret: x25519_dalek::SharedSecret) -> Self {
+    fn new(secret: x25519_dalek::SharedSecret) -> Self {
         Self {
             secret: Secret::new(secret),
         }