References: <68d50540-ec71-5564-99a7-7bb24ae05d17@...1856...> <1480371252-3880-1-git-send-email-steffan@...1856...> <331bcfe6-0373-1542-cdfc-50f360b7ceaa@...1435...> From: Arne Schwabe Message-ID: <2ebb29c2-6cbf-e770-2f31-5e08fa2f0e9f@...1227...> Date: Tue, 29 Nov 2016 11:07:12 +0100 MIME-Version: 1.0 In-Reply-To: <331bcfe6-0373-1542-cdfc-50f360b7ceaa@...1435...> Subject: Re: [Openvpn-devel] [PATCH v2] Introduce and use secure_memzero() to erase secrets List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit To: Steffan Karger , openvpn-devel@lists.sourceforge.net Am 29.11.16 um 09:20 schrieb Steffan Karger: > Hi, > > On 29-11-16 00:00, Zhaomo Yang wrote: >> Just wanted to let you know that we have a new implementation of >> secure_memzero.h, which is available at >> https://compsec.sysnet.ucsd.edu/secure_memzero.h >> . >> >> The version I sent to you guys has a minor issue in dealing with >> memset_s. Also, this implementation synthesizes most of the existing >> working solutions for this problem. It allows you to specify, via >> macros, which implementation you prefer. This will let users override >> our defaults, if they want. > Thanks, but I think I prefer the more light-weight approach you sent > earlier (slightly molded to use static inline wrapper functions instead > of macro's). It does what it needs to do for us, and is sufficiently > small to easily integrate into existing code. > > And thanks again for notifying us (on security@) on your findings. > I think we should prefer memset_s if available since it is a C11 standard. Arne