Re: Compiler support for erasure of sensitive data

[David Edelsohn <dje.gcc@gmail.com>]

On Wed, Sep 9, 2015 at 12:36 PM, Zack Weinberg <zackw@panix.com> wrote:

> The ABI dictates basically everything you see.  The call to
> explicit_bzero has forced the compiler to *create* a second copy of
> the variable `k` on the stack, just so it can be erased -- and the
> copy in registers survives (at least for a short time), which is not
> what the programmer wanted.  With or without explicit_bzero, we have
> no way of getting rid of the copy in registers.  More complicated
> scenarios of course exist.

> Comments?  Please note that I do not have anything like the time
> required to implement any of this myself (and I'm ten years out of
> practice on GCC and have no experience whatsoever with Clang,
> anyway).  I'm hoping this catches someone's interest.

What level of erasure of sensitive data are you trying to ensure?
Assuming that overwriting values in the ISA registers actually
completely clears and destroys the values is delusionally naive.

Most modern hardware architectures have hardware capabilities to
encrypt and protect sensitive data.

- David