1 files changed, 19 insertions, 2 deletions
diff --git a/source/crypto/SealedBox.mc b/source/crypto/SealedBox.mc
index 765a1d8..3877e1a 100644
--- a/source/crypto/SealedBox.mc
+++ b/source/crypto/SealedBox.mc
@@ -55,7 +55,19 @@ module SealedBox {
     // Seal with a given IV. Only tests call this directly (fixed IVs make the
     // output reproducible); reusing an IV in real use would be a mistake.
     function sealWithIv(keys as Keys, aad as ByteArray, plaintext as ByteArray, iv as ByteArray) as ByteArray {
-        var ciphertext = Aes.cbcEncrypt(keys.encKey, iv, plaintext);
+        return sealKeepWithIv(keys, aad, plaintext, iv, null);
+    }
+
+    // As seal(); with `leftovers`, the padded plaintext copy is added there
+    // for the caller to wipe in steps (zeroing 4 KB is a large part of a
+    // watchdog step) instead of wiped here.
+    function sealKeep(keys as Keys, aad as ByteArray, plaintext as ByteArray, leftovers as Array<ByteArray>?) as ByteArray {
+        return sealKeepWithIv(keys, aad, plaintext, Cryptography.randomBytes(IV_BYTES), leftovers);
+    }
+
+    function sealKeepWithIv(keys as Keys, aad as ByteArray, plaintext as ByteArray, iv as ByteArray,
+            leftovers as Array<ByteArray>?) as ByteArray {
+        var ciphertext = Aes.cbcEncryptKeep(keys.encKey, iv, plaintext, leftovers);
         var box = [VERSION]b;
         box.addAll(iv);
         box.addAll(ciphertext);
@@ -66,6 +78,11 @@ module SealedBox {
     // The plaintext, or null if the box is malformed, was sealed with another
     // key or aad, or was changed in any way.
     function open(keys as Keys, aad as ByteArray, box as ByteArray) as ByteArray? {
+        return openKeep(keys, aad, box, null);
+    }
+
+    // As open(); with `leftovers`, the padded plaintext is added there.
+    function openKeep(keys as Keys, aad as ByteArray, box as ByteArray, leftovers as Array<ByteArray>?) as ByteArray? {
         var size = box.size();
         if (size < MIN_SIZE || (size - 1 - IV_BYTES - TAG_BYTES) % Aes.BLOCK_BYTES != 0 || box[0] != VERSION) {
             return null;
@@ -77,7 +94,7 @@ module SealedBox {
         if (!valid) {
             return null;
         }
-        return Aes.cbcDecrypt(keys.encKey, box.slice(1, 1 + IV_BYTES), box.slice(1 + IV_BYTES, size - TAG_BYTES));
+        return Aes.cbcDecryptKeep(keys.encKey, box.slice(1, 1 + IV_BYTES), box.slice(1 + IV_BYTES, size - TAG_BYTES), leftovers);
     }
 
     // HMAC over the label, the aad (with its length) and the box body.