[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

GnuTLS and zeroing keys in Emacs

From: Paul Eggert
Subject: GnuTLS and zeroing keys in Emacs
Date: Fri, 14 Jul 2017 16:42:22 -0700
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1

Thanks for your recent GnuTLS-related contributions for Emacs. I found some minor glitches with respect to integer overflow detection and style, and installed the attached patch to try to help clear up the problems I found.

I did notice one other thing: sometimes the new code zeros out keys that will be garbage, I guess under the theory that this will help protect the user from hostile code within Emacs that attempts to steal keys by reading "unused" memory. However, zeroing out these keys does not actually destroy the keys reliably, as some compilers elide code that clears about-to-become-garbage objects, and some of the strings may be moved in garbage-collected memory (so their old contents are not zeroed).

I left in the code that clears keys, but I'm wondering: is there some general Emacs-internal guideline about this sort of thing? If we're serious about clearing keys I suppose we need to tell the GC and compilers not to move them around or optimize away useless stores. If not, then perhaps we should mark the key-clearing code in some way that says "this doesn't work in general but is the best we can easily do".

Attachment: 0001-GnuTLS-integer-overflow-and-style-fixes.patch
Description: Text Data

reply via email to

[Prev in Thread] Current Thread [Next in Thread]