Zeroing the Link Secret about anoncreds-rs HOT 1 OPEN

Some input from @andrewwhitehead:

In python we actually use the buffer protocol to copy data from an indy-credx object to askar without leaving duplicates, but that's not always possible.
For example: https://github.com/hyperledger/aries-cloudagent-python/blob/99b9e3713334c078212683c536277dc944025417/aries_cloudagent/indy/credx/holder.py#L84
raw_value is a memoryview object, which just references the buffer that will be zeroed

From what I understand, this means that the Python wrapper can pass around a value like the link secret without needing to copy the bytes out of the original buffer. As discussed on Discord, this means that, even though the link secret does need to be passed beyond the FFI boundary at least so the caller can store it in Askar or similar, this can be done in a way that the Rust layer can still effectively zeroize the link secret from memory.

Currently, the anoncreds-rs python wrapper will not accept a memoryview object for the link secret value in methods like process_credential and is strictly expecting a string value.

from anoncreds-rs.