Ring: Implement custom `Drop` trait for all private keys to zero memory
I'm not sure if this would be considered overkill, but I think that it would marginally increase the security of the library if key material were destroyed before releasing the memory back to the OS. I only checked that this trait was or wasn't implemented for RSAPrivateKey before opening this issue.
heartsucker
All 4 comments
As a technical matter, you cannot formally impose security properties with Drop since memory leaks are considered memory safe. That doesn't mean this is not a good idea! Everyone tries hard to ensure that Drop always gets run eventually. And https://github.com/cesarb/clear_on_drop works fine in practice.
We've had several discussions around this like https://github.com/isislovecruft/curve25519-dalek/issues/11 and https://github.com/rust-lang/rfcs/issues/1850 but actually the most informative thing was Laurent Simon's work presented at Real World Crypto last year : You do not necessarily want to zero cryptographic key material when they types get dropped, as you might make many intermediate values. You often want to instrument your functions, keep key material only on the stack, and zero all the stack that you used when your cryptographic routines conclude. See https://github.com/rust-lang/rfcs/issues/1853#issuecomment-275568249
I think ring is self contained enough to do zeroing in a variety of ways of course, but the wider Rust ecosystem should find ways to follow Laurent Simon's suggestions.
burdges
on 28 Jul 2017
Ah, thanks for the links. My cursory search didn't turn up anything useful. And it seems this is something that would have to be solved at the language level and not with some tinkering with traits/unsafe.
heartsucker
on 28 Jul 2017
@burdges I googled "rust memory erasure" and it led me to a rabbit hole of insightful commentary from you on this issue all over GitHub. Thanks for all the info on this!
nadimkobeissi
on 31 Jul 2017
I'm going to close this because solutions based on Drop don't work in general because of mem::forget() and other ways of leaking objects.
briansmith
on 23 Sep 2017
Related issues
tarcieri
路
9Comments
Jake-Shadle
路
11Comments
est31
路
6Comments
briansmith
路
11Comments
Ianleeclark
路
9Comments
Most helpful comment
As a technical matter, you cannot formally impose security properties with
Dropsince memory leaks are considered memory safe. That doesn't mean this is not a good idea! Everyone tries hard to ensure thatDropalways gets run eventually. And https://github.com/cesarb/clear_on_drop works fine in practice.We've had several discussions around this like https://github.com/isislovecruft/curve25519-dalek/issues/11 and https://github.com/rust-lang/rfcs/issues/1850 but actually the most informative thing was Laurent Simon's work presented at Real World Crypto last year : You do not necessarily want to zero cryptographic key material when they types get dropped, as you might make many intermediate values. You often want to instrument your functions, keep key material only on the stack, and zero all the stack that you used when your cryptographic routines conclude. See https://github.com/rust-lang/rfcs/issues/1853#issuecomment-275568249
I think ring is self contained enough to do zeroing in a variety of ways of course, but the wider Rust ecosystem should find ways to follow Laurent Simon's suggestions.