[PATCH v2] lib/crypto: Add a sentence about zeroizing raw key structures

[PATCH v2] lib/crypto: Add a sentence about zeroizing raw key structures

[Thomas Huth]

Let's make it clear that raw key material has to be zeroized, too.

Suggested-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 v2: Move the information into a separate paragraph

 Documentation/crypto/libcrypto-zeroization.rst | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/Documentation/crypto/libcrypto-zeroization.rst b/Documentation/crypto/libcrypto-zeroization.rst
index 76b6506711634..af3a4559b4963 100644
--- a/Documentation/crypto/libcrypto-zeroization.rst
+++ b/Documentation/crypto/libcrypto-zeroization.rst
@@ -43,6 +43,11 @@ two purposes:
 What to zeroize
 ---------------
 
+Raw key material (e.g. a plain AES key stored in an array or a caller-
+defined struct) must also be zeroized as soon as it is no longer needed,
+for example right after it has been used to populate one of the key
+structures below.
+
 The following types of structures hold sensitive material and should be
 zeroized after use:
 
-- 
2.56.0