Draft Edition of LibTomMath book

[Peter Gutmann]

bear <bear at sonic.net> writes:

>One thing that I've noticed for a long time is that there are *VERY* few math
>libraries that don't leave whatever numbers they're working with in memory
>when deallocating (deallocating heap via free() or deallocating stack via
>returning from a procedure call or deallocating swapspace by getting paged
>back in off a disk).

You have to differentiate between bignum maths libraries and bignum crypto
libraries.  Bignum libraries specifically targeted at crypto use (e.g. bnlib,
the OpenSSL bignum lib) do sanitise memory, it's only general-purpose bignum
libraries that don't (since there's no need to).  I'm not familiar enough with
the GMP source code to know what it does (GMP is a special case, being a
general bignum library but with an implicit acknowledgement that it's going to
end up used for crypto as well, although there are some missing primitives
such as a double-exp mod that would be useful for DSA, hint hint :-).

Peter.

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com