2021-05-10 - securely clearing memory

whenever you read secrets into the application memory, you should clear it from the memory. tricky part in managed languages (like C#/Java/Python), but straight forward in C/C++, right? right? no… it's not. obvious things like memset() can be optimized away ("as-if" rule -- "dead code" can be removed).

in order to the way to go is to use function that is guaranteed not to be optimized away – for example explicit_bzero() on Linux/FreeBSD. and we're good, right? right? no… not exactly… the next problem is that these secrets are typically used for something and encryption/hashing algorithms can leave their internal state in the memory, that can make it easier to extract certain pieces of information… and this problem does not have a reasonable solution to this point.

so for the time being – just explicit_bzero() secrets that you have.

blog/2021/05/10/2021-05-10_-_securely_clearing_memory.txt · Last modified: 2021/06/15 20:09 by
Back to top
Valid CSS Driven by DokuWiki Recent changes RSS feed Valid XHTML 1.0