Merge pull request #101 from roberthdevries/fix-passing-mutable-argument-as-default

Fix mutable arguments passed as default arguments.

tests/test_ciphers.py

@@ -25,6 +25,7 @@ import random
 import pytest
 from wolfcrypt._ffi import lib as _lib
 from wolfcrypt.ciphers import MODE_CTR, MODE_ECB, MODE_CBC, WolfCryptError
+from wolfcrypt.random import Random
 from wolfcrypt.utils import t2b, h2b
 import os
 
@@ -613,11 +614,11 @@ if _lib.ECC_ENABLED:
 
 
     def test_ecc_make_shared_secret():
-        a = EccPrivate.make_key(32)
+        a = EccPrivate.make_key(32, rng=Random())
         a_pub = EccPublic()
         a_pub.import_x963(a.export_x963())
 
-        b = EccPrivate.make_key(32)
+        b = EccPrivate.make_key(32, rng=Random())
         b_pub = EccPublic()
         b_pub.import_x963(b.export_x963())
 
@@ -626,6 +627,13 @@ if _lib.ECC_ENABLED:
             == a.shared_secret(b_pub) \
             == b.shared_secret(a_pub)
 
+    def test_ecc_make_key_no_rng():
+        key = EccPrivate.make_key(32)
+        pub_key = EccPublic()
+        pub_key.import_x963(key.export_x963())
+
+        assert key.shared_secret(pub_key)
+
 if _lib.ED25519_ENABLED:
     @pytest.fixture
     def ed25519_private(vectors):

wolfcrypt/ciphers.py

@@ -1229,6 +1229,11 @@ if _lib.ECC_ENABLED:
 
 
     class EccPrivate(EccPublic):
+
+        def __init__(self, key=None, rng=None):
+            super().__init__(key)
+            self._rng = rng
+
         @classmethod
         def make_key(cls, size, rng=None):
             """
@@ -1236,24 +1241,19 @@ if _lib.ECC_ENABLED:
             """
             if rng is None:
                 rng = Random()
-            ecc = cls()
+            ecc = cls(rng=rng)
 
-            ret = _lib.wc_ecc_make_key(rng.native_object, size,
+            ret = _lib.wc_ecc_make_key(ecc._rng.native_object, size,
                     ecc.native_object)
             if ret < 0:
                 raise WolfCryptError("Key generation error (%d)" % ret)
 
             if _lib.ECC_TIMING_RESISTANCE_ENABLED and (not _lib.FIPS_ENABLED or
                _lib.FIPS_VERSION > 2):
-                ret = _lib.wc_ecc_set_rng(ecc.native_object, rng.native_object)
+                ret = _lib.wc_ecc_set_rng(ecc.native_object, ecc._rng.native_object)
                 if ret < 0:
                     raise WolfCryptError("Error setting ECC RNG (%d)" % ret)
 
-            # Retain the RNG so it outlives the ECC key. Even outside the
-            # timing-resistance path, wolfSSL internals may retain a pointer
-            # to the RNG; keeping the reference avoids any UAF risk.
-            ecc._rng = rng
-
             return ecc
 
         def decode_key(self, key):