Repository: google/OpenSK
File: src/embedded_flash/store/format.rs (Rust)

Code before:
    ///
    /// - 0 for entries (user entries or internal entries).
    /// - 1 for free space until the end of the page.
    present_bit: usize,

    /// Whether an entry is deleted.
    ///
    /// - 0 for deleted entries.
    /// - 1 for alive entries.
    deleted_bit: usize,

    /// Whether an entry is internal.
    ///
    /// - 0 for internal entries.
    /// - 1 for user entries.
    internal_bit: usize,

    /// Whether a user entry is a replace entry.
    ///
    /// - 0 for replace entries.
    /// - 1 for insert entries.
    replace_bit: usize,

    /// Whether a user entry has sensitive data.
    ///
    /// When a user entry with sensitive data is deleted, the data is overwritten with zeroes.
    ///
    /// - 0 for sensitive data.
    /// - 1 for non-sensitive data.
    sensitive_bit: usize,

    /// The data length of a user entry.
    length_range: bitfield::BitRange,

    /// The tag of a user entry.
    tag_range: bitfield::BitRange,

    /// The page index of a replace entry.
    replace_page_range: bitfield::BitRange,

    /// The byte index of a replace entry.
    replace_byte_range: bitfield::BitRange,

    /// The index of the page to erase.
    ///
    /// This is only present for internal entries.
    old_page_range: bitfield::BitRange,

    /// The current erase count of the page to erase.
    ///
    /// This is only present for internal entries.

Review comment (security):
Could you be more specific about the contract here? In which cases is data indeed guaranteed to be overwritten at the moment? In which (corruption) cases is it not guaranteed? When moving a sensitive entry for compaction, is the old entry wiped out at an appropriate time? What happens when recovering while some sensitive entry was being copied around?

The contract doesn't have to be very strict for now, but there must at least be a disclaimer about what cases are not covered.

Of course, this contract can evolve as the implementation evolves (better corruption recovery for example).

Code after:
    ///
    /// - 0 for entries (user entries or internal entries).
    /// - 1 for free space until the end of the page.
    present_bit: usize,

    /// Whether an entry is deleted.
    ///
    /// - 0 for deleted entries.
    /// - 1 for alive entries.
    deleted_bit: usize,

    /// Whether an entry is internal.
    ///
    /// - 0 for internal entries.
    /// - 1 for user entries.
    internal_bit: usize,

    /// Whether a user entry is a replace entry.
    ///
    /// - 0 for replace entries.
    /// - 1 for insert entries.
    replace_bit: usize,

    /// Whether a user entry has sensitive data.
    ///
    /// - 0 for sensitive data.
    /// - 1 for non-sensitive data.
    ///
    /// When a user entry with sensitive data is deleted, the data is overwritten with zeroes. This
    /// feature is subject to the same guarantees as all other features of the store, in particular
    /// deleting a sensitive entry is atomic. See the store module-level documentation for more
    /// information.
    sensitive_bit: usize,

    /// The data length of a user entry.
    length_range: bitfield::BitRange,

    /// The tag of a user entry.
    tag_range: bitfield::BitRange,

    /// The page index of a replace entry.
    replace_page_range: bitfield::BitRange,

    /// The byte index of a replace entry.
    replace_byte_range: bitfield::BitRange,

    /// The index of the page to erase.
    ///
    /// This is only present for internal entries.
    old_page_range: bitfield::BitRange,