Initialise commit_secret alongside LedgerSecret (#7689)

Author: cjen1-msft

src/node/ledger_secret.h

@@ -28,16 +28,18 @@ namespace ccf
     std::shared_ptr<ccf::crypto::KeyAesGcm> key;
     std::optional<ccf::kv::Version> previous_secret_stored_version =
       std::nullopt;
-    std::optional<ccf::crypto::HashBytes> commit_secret = std::nullopt;
+    ccf::crypto::HashBytes commit_secret;
 
-    const ccf::crypto::HashBytes& get_commit_secret()
+    static ccf::crypto::HashBytes derive_commit_secret(
+      std::span<const uint8_t> raw_key)
     {
-      if (!commit_secret.has_value())
-      {
-        commit_secret = ccf::crypto::hmac(
-          ccf::crypto::MDType::SHA256, raw_key, commit_secret_label);
-      }
-      return commit_secret.value();
+      return ccf::crypto::hmac(
+        ccf::crypto::MDType::SHA256, raw_key, commit_secret_label);
+    }
+
+    [[nodiscard]] const ccf::crypto::HashBytes& get_commit_secret() const
+    {
+      return commit_secret;
     }
 
     bool operator==(const LedgerSecret& other) const
@@ -46,11 +48,12 @@ namespace ccf
         previous_secret_stored_version == other.previous_secret_stored_version;
     }
 
-    LedgerSecret() = default;
+    LedgerSecret() : commit_secret(derive_commit_secret(raw_key)) {}
 
     ~LedgerSecret()
     {
       OPENSSL_cleanse(raw_key.data(), raw_key.size());
+      OPENSSL_cleanse(commit_secret.data(), commit_secret.size());
     }
 
     // The copy constructor is used for serialising a LedgerSecret. However,
@@ -59,7 +62,8 @@ namespace ccf
     LedgerSecret(const LedgerSecret& other) :
       raw_key(other.raw_key),
       key(ccf::crypto::make_key_aes_gcm(other.raw_key)),
-      previous_secret_stored_version(other.previous_secret_stored_version)
+      previous_secret_stored_version(other.previous_secret_stored_version),
+      commit_secret(derive_commit_secret(raw_key))
     {}
 
     LedgerSecret(
@@ -68,7 +72,8 @@ namespace ccf
         std::nullopt) :
       raw_key(raw_key_),
       key(ccf::crypto::make_key_aes_gcm(std::move(raw_key_))),
-      previous_secret_stored_version(previous_secret_stored_version_)
+      previous_secret_stored_version(previous_secret_stored_version_),
+      commit_secret(derive_commit_secret(raw_key))
     {}
   };