[111112] in cryptography@c2.net mail archive
Re: More on in-memory zeroisation
daemon@ATHENA.MIT.EDU (Bodo Moeller)
Tue Dec 18 21:34:24 2007
Date: Mon, 17 Dec 2007 12:48:27 +0100
From: Bodo Moeller <bmoeller@acm.org>
To: Peter Gutmann <pgut001@cs.auckland.ac.nz>
Cc: cryptography@metzdowd.com
In-Reply-To: <E1J1FSg-0004Op-Uy@wintermute01.cs.auckland.ac.nz>
On Sun, Dec 09, 2007 at 07:16:22PM +1300, Peter Gutmann wrote:
> There was a discussion on this list a year or two back about problems in using
> memset() to zeroise in-memory data, specifically the fact that optimising
> compilers would remove a memset() on (apparently) dead data in the belief that
> it wasn't serving any purpose.
Actually this problem was discussed five years ago (October 2002) on
the vuln-dev mailing list:
http://www.securityfocus.com/archive/82/297827/30/0/threaded
http://msdn2.microsoft.com/en-us/library/ms972826.aspx
If the problem also was discussed here on the cryptography list a year
or two ago, I am afraid that my memory of this either has been zeroized,
or has been detected not to serve any purpose.
Bodo
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
