From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/8480 Path: news.gmane.org!not-for-mail From: David Edelsohn Newsgroups: gmane.comp.lib.glibc.alpha,gmane.comp.gcc.devel,gmane.linux.lib.musl.general Subject: Re: Compiler support for erasure of sensitive data Date: Wed, 9 Sep 2015 13:54:38 -0400 Message-ID: References: <55F05FF1.3000405@panix.com> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-Trace: ger.gmane.org 1441821288 13364 80.91.229.3 (9 Sep 2015 17:54:48 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Wed, 9 Sep 2015 17:54:48 +0000 (UTC) Cc: GCC Development , GNU C Library , musl@lists.openwall.com To: Zack Weinberg Original-X-From: libc-alpha-return-63081-glibc-alpha=m.gmane.org@sourceware.org Wed Sep 09 19:54:47 2015 Return-path: Envelope-to: glibc-alpha@plane.gmane.org Original-Received: from server1.sourceware.org ([209.132.180.131] helo=sourceware.org) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1ZZja2-0002WL-Gw for glibc-alpha@plane.gmane.org; Wed, 09 Sep 2015 19:54:46 +0200 DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; q=dns; s=default; b= XbowT6xC/h7IWq7JpIcbA1Pylzg6Xa/F2kMFDvq17vTbr38Q1qW1IyYNIlGJpAOg jCCrmatsW1RJGS+yAYFvWWIEiHYVDackXSp3p1BnoRwlznGFJNLIgGtBynIM6p+N lm17YJ+o4qMitDWRqb+0xVY8Q/aVYKGSXSdiqDOd6Yg= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; s=default; bh=KSMI1 h9n4PnJwkak+fp/ai11bcc=; b=RNfydrtqlZZyMZVwppaSAYlpfCZh6qFU6X9bt k0Rzc8pPcY/AgtjkYUjYV5u0B8cuRKmpoenLyk4OofCjxsnU9HT7UtcVKowBzRqQ VHcH66KdrFV1f62zm2I0IZGaLnK49CCrK96nYilpU/V9rcgSWP5kizBFMDC5p97K qbB+GM= Original-Received: (qmail 21869 invoked by alias); 9 Sep 2015 17:54:42 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Original-Sender: libc-alpha-owner@sourceware.org Original-Received: (qmail 21738 invoked by uid 89); 9 Sep 2015 17:54:41 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-2.3 required=5.0 tests=AWL,BAYES_00,FREEMAIL_FROM,RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.2 X-HELO: mail-io0-f169.google.com X-Received: by 10.107.164.26 with SMTP id n26mr52206017ioe.189.1441821278360; Wed, 09 Sep 2015 10:54:38 -0700 (PDT) In-Reply-To: <55F05FF1.3000405@panix.com> Xref: news.gmane.org gmane.comp.lib.glibc.alpha:55361 gmane.comp.gcc.devel:141213 gmane.linux.lib.musl.general:8480 Archived-At: On Wed, Sep 9, 2015 at 12:36 PM, Zack Weinberg wrote: > The ABI dictates basically everything you see. The call to > explicit_bzero has forced the compiler to *create* a second copy of > the variable `k` on the stack, just so it can be erased -- and the > copy in registers survives (at least for a short time), which is not > what the programmer wanted. With or without explicit_bzero, we have > no way of getting rid of the copy in registers. More complicated > scenarios of course exist. > Comments? Please note that I do not have anything like the time > required to implement any of this myself (and I'm ten years out of > practice on GCC and have no experience whatsoever with Clang, > anyway). I'm hoping this catches someone's interest. What level of erasure of sensitive data are you trying to ensure? Assuming that overwriting values in the ISA registers actually completely clears and destroys the values is delusionally naive. Most modern hardware architectures have hardware capabilities to encrypt and protect sensitive data. - David