Introduce vector_ref::cleanse, code adapted from openSSL.

Introduce secure_vector and bytesSec, make Secret auto-cleansing.

alethzero/MainWin.cpp

@@ -349,8 +349,8 @@ void Main::refreshWhisper()
 
 void Main::addNewId(QString _ids)
 {
-	Secret _id = jsToSecret(_ids.toStdString());
-	KeyPair kp(_id);
+	Secret const& id = jsToSecret(_ids.toStdString());
+	KeyPair kp(id);
 	m_myIdentities.push_back(kp);
 	m_server->setIdentities(keysAsVector(owned()));
 	refreshWhisper();
@@ -1327,7 +1327,9 @@ void Main::refreshAccounts()
 	bool showContract = ui->showContracts->isChecked();
 	bool showBasic = ui->showBasic->isChecked();
 	bool onlyNamed = ui->onlyNamed->isChecked();
-	for (auto const& i: ethereum()->addresses())
+	auto as = ethereum()->addresses();
+	sort(as.begin(), as.end());
+	for (auto const& i: as)
 	{
 		bool isContract = (ethereum()->codeHashAt(i) != EmptySHA3);
 		if (!((showContract && isContract) || (showBasic && !isContract)))

ethminer/CMakeLists.txt

@@ -30,6 +30,7 @@ endif()
 
 target_link_libraries(${EXECUTABLE} ethcore)
 target_link_libraries(${EXECUTABLE} ethash)
+target_link_libraries(${EXECUTABLE} devcrypto)
 
 if (DEFINED WIN32 AND NOT DEFINED CMAKE_COMPILER_IS_MINGW)
 	eth_copy_dlls("${EXECUTABLE}" MHD_DLLS)

libdevcore/Common.h

@@ -79,6 +79,16 @@ using bytes = std::vector<byte>;
 using bytesRef = vector_ref<byte>;
 using bytesConstRef = vector_ref<byte const>;
 
+template <class T>
+class secure_vector: public std::vector<T>
+{
+public:
+	template <class ... Args> secure_vector(Args&& ... _args): std::vector<T>(_args ...) {}
+	~secure_vector() { vector_ref<T>(this).cleanse(); }
+};
+
+using bytesSec = secure_vector<byte>;
+
 // Numeric types.
 using bigint = boost::multiprecision::number<boost::multiprecision::cpp_int_backend<>>;
 using u64 =  boost::multiprecision::number<boost::multiprecision::cpp_int_backend<64, 64, boost::multiprecision::unsigned_magnitude, boost::multiprecision::unchecked, void>>;

libdevcore/FixedHash.h

@@ -214,6 +214,8 @@ public:
 		return ret;
 	}
 
+	void clear() { m_data.fill(0); }
+
 private:
 	std::array<byte, N> m_data;		///< The binary data.
 };

libdevcore/vector_ref.h

@@ -9,6 +9,8 @@
 namespace dev
 {
 
+static unsigned char s_cleanseCounter = 0;
+
 /**
  * A modifiable reference to an existing object or vector in memory.
  */
@@ -65,6 +67,24 @@ public:
 	void copyTo(vector_ref<typename std::remove_const<_T>::type> _t) const { if (overlapsWith(_t)) memmove(_t.data(), m_data, std::min(_t.size(), m_count) * sizeof(_T)); else memcpy(_t.data(), m_data, std::min(_t.size(), m_count) * sizeof(_T)); }
 	/// Copies the contents of this vector_ref to the contents of @a _t, and zeros further trailing elements in @a _t.
 	void populate(vector_ref<typename std::remove_const<_T>::type> _t) const { copyTo(_t); memset(_t.data() + m_count, 0, std::max(_t.size(), m_count) - m_count); }
+	/// Securely overwrite the memory.
+	/// @note adapted from OpenSSL's implementation.
+	void cleanse()
+	{
+		uint8_t* p = (uint8_t*)begin();
+		size_t len = (uint8_t*)end() - p;
+		size_t loop = len;
+		size_t count = s_cleanseCounter;
+		while (loop--)
+		{
+			*(p++) = (uint8_t)count;
+			count += (17 + ((size_t)p & 0xf));
+		}
+		p = (uint8_t*)memchr((uint8_t*)begin(), (uint8_t)count, len);
+		if (p)
+			count += (63 + (size_t)p);
+		s_cleanseCounter = (uint8_t)count;
+	}
 
 	_T* begin() { return m_data; }
 	_T* end() { return m_data + m_count; }

libdevcrypto/Common.cpp

@@ -272,6 +272,13 @@ bytes dev::scrypt(std::string const& _pass, bytes const& _salt, uint64_t _n, uin
 	return ret;
 }
 
+void KeyPair::populateFromSecret(Secret const& _sec)
+{
+	m_secret = _sec;
+	if (s_secp256k1pp.verifySecret(m_secret, m_public))
+		m_address = toAddress(m_public);
+}
+
 KeyPair KeyPair::create()
 {
 	for (int i = 0; i < 100; ++i)
@@ -283,13 +290,6 @@ KeyPair KeyPair::create()
 	return KeyPair();
 }
 
-KeyPair::KeyPair(h256 _sec):
-	m_secret(_sec)
-{
-	if (s_secp256k1pp.verifySecret(m_secret, m_public))
-		m_address = toAddress(m_public);
-}
-
 KeyPair KeyPair::fromEncryptedSeed(bytesConstRef _seed, std::string const& _password)
 {
 	return KeyPair(sha3(aesDecrypt(_seed, _password)));

libdevcrypto/Common.h

@@ -34,7 +34,13 @@ namespace dev
 
 /// A secret key: 32 bytes.
 /// @NOTE This is not endian-specific; it's just a bunch of bytes.
-using Secret = h256;
+class Secret: public h256
+{
+public:
+	template <class ... Args> Secret(Args&& ... _args): h256(_args ...) {}
+	Secret(bytesSec const& _b): h256(bytesConstRef(&_b)) {}
+	~Secret() { ref().cleanse(); }
+};
 
 /// A public key: 64 bytes.
 /// @NOTE This is not endian-specific; it's just a bunch of bytes.
@@ -151,7 +157,7 @@ public:
 	KeyPair() {}
 
 	/// Normal constructor - populates object from the given secret key.
-	KeyPair(Secret _k);
+	KeyPair(Secret const& _k) { populateFromSecret(_k); }
 
 	/// Create a new, randomly generated object.
 	static KeyPair create();
@@ -174,6 +180,8 @@ public:
 	bool operator!=(KeyPair const& _c) const { return m_secret != _c.m_secret; }
 
 private:
+	void populateFromSecret(Secret const& _k);
+
 	Secret m_secret;
 	Public m_public;
 	Address m_address;

libdevcrypto/CryptoPP.cpp

@@ -33,7 +33,7 @@ static_assert(dev::Secret::size == 32, "Secret key must be 32 bytes.");
 static_assert(dev::Public::size == 64, "Public key must be 64 bytes.");
 static_assert(dev::Signature::size == 65, "Signature must be 65 bytes.");
 
-bytes Secp256k1PP::eciesKDF(Secret _z, bytes _s1, unsigned kdByteLen)
+bytes Secp256k1PP::eciesKDF(Secret const& _z, bytes _s1, unsigned kdByteLen)
 {
 	auto reps = ((kdByteLen + 7) * 8) / (CryptoPP::SHA256::BLOCKSIZE * 8);
 	// SEC/ISO/Shoup specify counter size SHOULD be equivalent

libdevcrypto/CryptoPP.h

@@ -87,7 +87,7 @@ public:
 	bool decryptECIES(Secret const& _k, bytes& io_text);
 	
 	/// Key derivation function used by encryptECIES and decryptECIES.
-	bytes eciesKDF(Secret _z, bytes _s1, unsigned kdBitLen = 256);
+	bytes eciesKDF(Secret const& _z, bytes _s1, unsigned kdBitLen = 256);
 	
 	/// @returns siganture of message.
 	Signature sign(Secret const& _k, bytesConstRef _message);

libdevcrypto/ECDHE.h

@@ -40,7 +40,7 @@ class Alias
 {
 	friend class ECDHEKeyExchange; // todo: remove
 public:
-	Alias(Secret _s): m_secret(_s) {};
+	Alias(Secret const& _s): m_secret(_s) {};
 	
 	AliasSession session(Address _a) { return m_sessions.count(_a) ? m_sessions.find(_a)->second : AliasSession(); }
 	

libdevcrypto/SecretStore.cpp

@@ -91,13 +91,13 @@ SecretStore::SecretStore(string const& _path): m_path(_path)
 	load();
 }
 
-bytes SecretStore::secret(h128 const& _uuid, function<string()> const& _pass, bool _useCache) const
+bytesSec SecretStore::secret(h128 const& _uuid, function<string()> const& _pass, bool _useCache) const
 {
 	auto rit = m_cached.find(_uuid);
 	if (_useCache && rit != m_cached.end())
 		return rit->second;
 	auto it = m_keys.find(_uuid);
-	bytes key;
+	bytesSec key;
 	if (it != m_keys.end())
 	{
 		key = decrypt(it->second.encryptedKey, _pass());

libdevcrypto/SecretStore.h

@@ -52,7 +52,7 @@ public:
 	/// @returns the secret key stored by the given @a _uuid.
 	/// @param _pass function that returns the password for the key.
 	/// @param _useCache if true, allow previously decrypted keys to be returned directly.
-	bytes secret(h128 const& _uuid, std::function<std::string()> const& _pass, bool _useCache = true) const;
+	bytesSec secret(h128 const& _uuid, std::function<std::string()> const& _pass, bool _useCache = true) const;
 	/// Imports the (encrypted) key stored in the file @a _file and copies it to the managed directory.
 	h128 importKey(std::string const& _file) { auto ret = readKey(_file, false); if (ret) save(); return ret; }
 	/// Imports the (encrypted) key contained in the json formatted @a _content and stores it in
@@ -107,7 +107,7 @@ private:
 	static bytes decrypt(std::string const& _v, std::string const& _pass);
 
 	/// Stores decrypted keys by uuid.
-	mutable std::unordered_map<h128, bytes> m_cached;
+	mutable std::unordered_map<h128, bytesSec> m_cached;
 	/// Stores encrypted keys together with the file they were loaded from by uuid.
 	std::unordered_map<h128, EncryptedKey> m_keys;
 

libethcore/CMakeLists.txt

@@ -23,13 +23,11 @@ file(GLOB HEADERS "*.h")
 add_library(${EXECUTABLE} ${SRC_LIST} ${HEADERS})
 
 target_link_libraries(${EXECUTABLE} ethash)
-target_link_libraries(${EXECUTABLE} devcrypto)
 target_link_libraries(${EXECUTABLE} evmcore)
-
 if (ETHASHCL)
 	target_link_libraries(${EXECUTABLE} ethash-cl)
 endif ()
-
+target_link_libraries(${EXECUTABLE} devcrypto)
 if (CPUID_FOUND)
 	target_link_libraries(${EXECUTABLE} ${CPUID_LIBRARIES})
 endif ()

libethcore/Common.cpp

@@ -65,7 +65,7 @@ Network resetNetwork(Network _n)
 	c_gasLimitBoundDivisor = 1024;
 	c_minimumDifficulty = 131072;
 	c_difficultyBoundDivisor = 2048;
-	c_durationLimit = c_network == Network::Turbo ? 2 : c_network == Network::Olympic ? 8 : 12;
+	c_durationLimit = c_network == Network::Turbo ? 2 : c_network == Network::Olympic ? 8 : 13;
 	c_blockReward = c_network == Network::Olympic ? (1500 * finney) : (5 * ether);
 	return _n;
 }

libethereum/BlockChain.cpp

@@ -152,7 +152,7 @@ BlockChain::BlockChain(bytes const& _genesisBlock, std::unordered_map<Address, A
 	open(_genesisBlock, _genesisState, _path, _we, _p);
 }
 
-void BlockChain::open(bytes const& _genesisBlock, std::unordered_map<Address, Account> const& _genesisState, std::string const& _path, WithExisting _we, ProgressCallback const& _p)
+void BlockChain::open(bytes const& _genesisBlock, std::unordered_map<Address, Account> const& _genesisState, std::string const& _path, WithExisting, ProgressCallback const&)
 {
 	// initialise deathrow.
 	m_cacheUsage.resize(c_collectionQueueSize);
@@ -165,9 +165,6 @@ void BlockChain::open(bytes const& _genesisBlock, std::unordered_map<Address, Ac
 
 	// remove the next line real soon. we don't need to be supporting this forever.
 	upgradeDatabase(_path, genesisHash());
-
-	if (openDatabase(_path, _we) != c_minorProtocolVersion)
-		rebuild(_path, _p);
 }
 
 BlockChain::~BlockChain()
@@ -289,7 +286,7 @@ void BlockChain::rebuild(std::string const& _path, std::function<void(unsigned,
 	// Keep extras DB around, but under a temp name
 	delete m_extrasDB;
 	m_extrasDB = nullptr;
-	boost::filesystem::rename(path + "/details", path + "/extras.old");
+	boost::filesystem::rename(extrasPath + "/extras", extrasPath + "/extras.old");
 	ldb::DB* oldExtrasDB;
 	ldb::Options o;
 	o.create_if_missing = true;

libethereum/BlockChain.h

@@ -104,6 +104,8 @@ public:
 class BlockChain
 {
 public:
+	/// Doesn't open the database - if you want it open it's up to you to subclass this and open it
+	/// in the constructor there.
 	BlockChain(bytes const& _genesisBlock, StateDefinition const& _genesisState, std::string const& _path, WithExisting _we = WithExisting::Trust, ProgressCallback const& _p = ProgressCallback());
 	~BlockChain();
 
@@ -292,13 +294,20 @@ public:
 protected:
 	static h256 chunkId(unsigned _level, unsigned _index) { return h256(_index * 0xff + _level); }
 
-	/// Initialise everything and open the database.
+	/// Initialise everything and ready for openning the database.
 	void open(bytes const& _genesisBlock, std::unordered_map<Address, Account> const& _genesisState, std::string const& _path, WithExisting _we, ProgressCallback const& _p);
 	/// Open the database.
-	unsigned openDatabase(std::string const& _path, WithExisting _we = WithExisting::Trust);
+	unsigned openDatabase(std::string const& _path, WithExisting _we);
 	/// Finalise everything and close the database.
 	void close();
 
+	/// Open the database, rebuilding if necessary.
+	void openDatabase(std::string const& _path, WithExisting _we, ProgressCallback const& _pc)
+	{
+		if (openDatabase(_path, _we) != c_minorProtocolVersion || _we == WithExisting::Verify)
+			rebuild(_path, _pc);
+	}
+
 	template<class T, class K, unsigned N> T queryExtras(K const& _h, std::unordered_map<K, T>& _m, boost::shared_mutex& _x, T const& _n, ldb::DB* _extrasDB = nullptr) const
 	{
 		{

libethereum/CanonBlockChain.cpp

@@ -47,6 +47,7 @@ bytes CanonBlockChain<Ethash>::s_genesisExtraData;
 CanonBlockChain<Ethash>::CanonBlockChain(std::string const& _path, WithExisting _we, ProgressCallback const& _pc):
 	FullBlockChain<Ethash>(createGenesisBlock(), createGenesisState(), _path, _we, _pc)
 {
+	BlockChain::openDatabase(_path, _we, _pc);
 }
 
 void CanonBlockChain<Ethash>::reopen(WithExisting _we, ProgressCallback const& _pc)

libethereum/CanonBlockChain.h

@@ -52,7 +52,10 @@ class CanonBlockChain: public FullBlockChain<Sealer>
 public:
 	CanonBlockChain(WithExisting _we = WithExisting::Trust, ProgressCallback const& _pc = ProgressCallback()): CanonBlockChain<Sealer>(std::string(), _we, _pc) {}
 	CanonBlockChain(std::string const& _path, WithExisting _we = WithExisting::Trust, ProgressCallback const& _pc = ProgressCallback()):
-		FullBlockChain<Sealer>(createGenesisBlock(), StateDefinition(), _path, _we, _pc) {}
+		FullBlockChain<Sealer>(createGenesisBlock(), StateDefinition(), _path, _we, _pc)
+	{
+		BlockChain::openDatabase(_path, _we, _pc);
+	}
 	~CanonBlockChain() {}
 
 	/// @returns the genesis block as its RLP-encoded byte array.

libethereumx/Ethereum.cpp

@@ -83,7 +83,7 @@ void Ethereum::connect(std::string const& _seedHost, unsigned short _port)
 {
 }
 
-void Ethereum::submitTransaction(Secret _secret, u256 _value, Address _dest, bytes const& _data, u256 _gas, u256 _gasPrice)
+void Ethereum::submitTransaction(Secret const& _secret, u256 _value, Address _dest, bytes const& _data, u256 _gas, u256 _gasPrice)
 {
 }
 
@@ -92,7 +92,7 @@ bytes Ethereum::call(Address const& _from, u256 _value, Address _dest, bytes con
 	return bytes();
 }
 
-Address Ethereum::submitTransaction(Secret _secret, u256 _endowment, bytes const& _init, u256 _gas, u256 _gasPrice)
+Address Ethereum::submitTransaction(Secret const& _secret, u256 _endowment, bytes const& _init, u256 _gas, u256 _gasPrice)
 {
 	return Address();
 }

libethereumx/Ethereum.h

@@ -62,11 +62,11 @@ public:
 	~Ethereum();
 
 	/// Submits the given message-call transaction.
-	void submitTransaction(Secret _secret, u256 _value, Address _dest, bytes const& _data = bytes(), u256 _gas = 10000, u256 _gasPrice = 10 * szabo);
+	void submitTransaction(Secret const& _secret, u256 _value, Address _dest, bytes const& _data = bytes(), u256 _gas = 10000, u256 _gasPrice = 10 * szabo);
 
 	/// Submits a new contract-creation transaction.
 	/// @returns the new contract's address (assuming it all goes through).
-	Address submitTransaction(Secret _secret, u256 _endowment, bytes const& _init, u256 _gas = 10000, u256 _gasPrice = 10 * szabo);
+	Address submitTransaction(Secret const& _secret, u256 _endowment, bytes const& _init, u256 _gas = 10000, u256 _gasPrice = 10 * szabo);
 
 	/// Injects the RLP-encoded transaction given by the _rlp into the transaction queue directly.
 	void inject(bytesConstRef _rlp);

libweb3jsonrpc/JsonHelper.cpp

@@ -482,7 +482,7 @@ shh::Message toMessage(Json::Value const& _json)
 	return ret;
 }
 
-shh::Envelope toSealed(Json::Value const& _json, shh::Message const& _m, Secret _from)
+shh::Envelope toSealed(Json::Value const& _json, shh::Message const& _m, Secret const& _from)
 {
 	unsigned ttl = 50;
 	unsigned workToProve = 50;

libweb3jsonrpc/JsonHelper.h

@@ -89,7 +89,7 @@ namespace shh
 
 Json::Value toJson(h256 const& _h, Envelope const& _e, Message const& _m);
 Message toMessage(Json::Value const& _json);
-Envelope toSealed(Json::Value const& _json, Message const& _m, Secret _from);
+Envelope toSealed(Json::Value const& _json, Message const& _m, Secret const& _from);
 std::pair<Topics, Public> toWatch(Json::Value const& _json);
 
 }

libwhisper/CMakeLists.txt

@@ -21,10 +21,10 @@ file(GLOB HEADERS "*.h")
 
 add_library(${EXECUTABLE} ${SRC_LIST} ${HEADERS})
 
-target_link_libraries(${EXECUTABLE} ethcore)
+#target_link_libraries(${EXECUTABLE} ethcore)
+target_link_libraries(${EXECUTABLE} p2p)
 target_link_libraries(${EXECUTABLE} devcrypto)
 target_link_libraries(${EXECUTABLE} devcore)
-target_link_libraries(${EXECUTABLE} p2p)
 
 install( TARGETS ${EXECUTABLE} RUNTIME DESTINATION bin ARCHIVE DESTINATION lib LIBRARY DESTINATION lib )
 install( FILES ${HEADERS} DESTINATION include/${EXECUTABLE} )

libwhisper/Interface.h

@@ -76,8 +76,8 @@ public:
 
 	void post(bytes const& _payload, Topics _topics, unsigned _ttl = 50, unsigned _workToProve = 50) { inject(Message(_payload).seal(_topics, _ttl, _workToProve)); }
 	void post(Public _to, bytes const& _payload, Topics _topics, unsigned _ttl = 50, unsigned _workToProve = 50) { inject(Message(_payload).sealTo(_to, _topics, _ttl, _workToProve)); }
-	void post(Secret _from, bytes const& _payload, Topics _topics, unsigned _ttl = 50, unsigned _workToProve = 50) { inject(Message(_payload).seal(_from, _topics, _ttl, _workToProve)); }
-	void post(Secret _from, Public _to, bytes const& _payload, Topics _topics, unsigned _ttl = 50, unsigned _workToProve = 50) { inject(Message(_payload).sealTo(_from, _to, _topics, _ttl, _workToProve)); }
+	void post(Secret const& _from, bytes const& _payload, Topics _topics, unsigned _ttl = 50, unsigned _workToProve = 50) { inject(Message(_payload).seal(_from, _topics, _ttl, _workToProve)); }
+	void post(Secret const& _from, Public _to, bytes const& _payload, Topics _topics, unsigned _ttl = 50, unsigned _workToProve = 50) { inject(Message(_payload).sealTo(_from, _to, _topics, _ttl, _workToProve)); }
 };
 
 struct WatshhChannel: public dev::LogChannel { static const char* name() { return "shh"; } static const int verbosity = 1; };

libwhisper/Message.cpp

@@ -97,7 +97,7 @@ bool Message::populate(bytes const& _data)
 	return true;
 }
 
-Envelope Message::seal(Secret _from, Topics const& _fullTopics, unsigned _ttl, unsigned _workToProve) const
+Envelope Message::seal(Secret const& _from, Topics const& _fullTopics, unsigned _ttl, unsigned _workToProve) const
 {
 	AbridgedTopics topics = abridge(_fullTopics);
 	Envelope ret(time(0) + _ttl, _ttl, topics);

libwhisper/Message.h

@@ -118,11 +118,11 @@ public:
 	operator bool() const { return !!m_payload.size() || m_from || m_to; }
 
 	/// Turn this message into a ditributable Envelope.
-	Envelope seal(Secret _from, Topics const& _topics, unsigned _ttl = 50, unsigned _workToProve = 50) const;
+	Envelope seal(Secret const& _from, Topics const& _topics, unsigned _ttl = 50, unsigned _workToProve = 50) const;
 	// Overloads for skipping _from or specifying _to.
 	Envelope seal(Topics const& _topics, unsigned _ttl = 50, unsigned _workToProve = 50) const { return seal(Secret(), _topics, _ttl, _workToProve); }
 	Envelope sealTo(Public _to, Topics const& _topics, unsigned _ttl = 50, unsigned _workToProve = 50) { m_to = _to; return seal(Secret(), _topics, _ttl, _workToProve); }
-	Envelope sealTo(Secret _from, Public _to, Topics const& _topics, unsigned _ttl = 50, unsigned _workToProve = 50) { m_to = _to; return seal(_from, _topics, _ttl, _workToProve); }
+	Envelope sealTo(Secret const& _from, Public _to, Topics const& _topics, unsigned _ttl = 50, unsigned _workToProve = 50) { m_to = _to; return seal(_from, _topics, _ttl, _workToProve); }
 
 private:
 	bool populate(bytes const& _data);

mix/ClientModel.h

@@ -55,7 +55,7 @@ struct SolidityType;
 struct TransactionSettings
 {
 	TransactionSettings() {}
-	TransactionSettings(QString const& _contractId, QString const& _functionId, u256 _value, u256 _gas, bool _gasAuto, u256 _gasPrice, Secret _sender, bool _isContractCreation, bool _isFunctionCall):
+	TransactionSettings(QString const& _contractId, QString const& _functionId, u256 _value, u256 _gas, bool _gasAuto, u256 _gasPrice, Secret const& _sender, bool _isContractCreation, bool _isFunctionCall):
 		contractId(_contractId), functionId(_functionId), value(_value), gas(_gas), gasAuto(_gasAuto), gasPrice(_gasPrice), sender(_sender), isContractCreation(_isContractCreation), isFunctionCall(_isFunctionCall)  {}
 	TransactionSettings(QString const& _stdContractName, QString const& _stdContractUrl):
 		contractId(_stdContractName), gasAuto(true), stdContractUrl(_stdContractUrl), isContractCreation(true), isFunctionCall(true) {}

test/libdevcrypto/crypto.cpp

@@ -514,7 +514,7 @@ BOOST_AUTO_TEST_CASE(handshakeNew)
 		bytes keyMaterialBytes(512);
 		bytesRef keyMaterial(&keyMaterialBytes);
 		
-		h256 ess;
+		Secret ess;
 		// todo: ecdh-agree should be able to output bytes
 		eA.agree(eBAck, ess);
 		ess.ref().copyTo(keyMaterial.cropped(0, h256::size));
@@ -581,7 +581,7 @@ BOOST_AUTO_TEST_CASE(handshakeNew)
 		bytes keyMaterialBytes(512);
 		bytesRef keyMaterial(&keyMaterialBytes);
 		
-		h256 ess;
+		Secret ess;
 		// todo: ecdh-agree should be able to output bytes
 		eB.agree(eAAuth, ess);
 //		s_secp256k1.agree(eB.seckey(), eAAuth, ess);

test/libethereum/stateOriginal.cpp

@@ -54,8 +54,8 @@ BOOST_AUTO_TEST_CASE(Complex)
 
 	cnote << "Testing State...";
 
-	KeyPair me = sha3("Gav Wood");
-	KeyPair myMiner = sha3("Gav's Miner");
+	KeyPair me = Secret(sha3("Gav Wood"));
+	KeyPair myMiner = Secret(sha3("Gav's Miner"));
 //	KeyPair you = sha3("123");
 
 	Defaults::setDBPath(boost::filesystem::temp_directory_path().string() + "/" + toString(chrono::system_clock::now().time_since_epoch().count()));