aes-doesnt-leak-memory.py

from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.ciphers import ( Cipher, algorithms, modes )

import os

nonce = os.urandom(16)
key = os.urandom(32)

mode = modes.GCM(nonce, None)

cipher = Cipher(algorithms.AES(key), mode, backend=default_backend())

enc = cipher.encryptor()
dec = cipher.decryptor()

a = os.urandom(64)
b = os.urandom(64)

import gc
from SecureBytes import clearmem, scanmem, scanmem_supported

assert scanmem_supported

data = a + b

print(data)

assert scanmem(a, b)

clearmem(data)
assert not scanmem(a, b)

data = a + b

ct = enc.update(data) + enc.finalize()
tag = enc.tag
assert len(ct) == 128

clearmem(data)
assert not scanmem(a, b)

pt = dec.update(ct) + dec.finalize_with_tag(tag)

assert len(pt) == 128

print(pt)

assert scanmem(a, b)

clearmem(pt)

assert not scanmem(a, b)