Hacker News new | past | comments | ask | show | jobs | submit login

Not really. Just put the clearing function into another translation unit.

    clear_memory(secret_key, sizeof secret_key);
(And don't enable any wacky whole program link-time optimizations. Those violate ISO C by continuing semantic analysis into translation phase 8. ISO C makes it clear that tokens are "syntactically and semantically analyzed" in phase 7, as translation unit. Then in phase 8, only references are resolved to link. Doing any semantic analysis to optimize things at link time violates the conceptual model thereby given. GCC has support for this but it has to be explicitly enabled; moreover, there is more to using link-time optiizations than just passing options.)

The current translation unit must really call clear_memory and really pass it the pointer to the secret_key, whose contents have to be settled. The writes performed by clear_memory really have to take place, because the caller depends on it; clear_memory has no idea that the object is dead (having no next use) in the calling translation unit.

The main problem is not getting the clearing not to be elided, but with stray copies of the data being elsewhere. The C programmer doesn't have visibility and control over all the storage areas where a datum may end up. If secret_key is really cleared, is that enough?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: