[Cryptography] Heartbleed and fundamental crypto programming practices

[Chris Tonkinson]

> We've all by now heard of the Heartbleed security disaster.  I haven't
seen the actual coding error, but the descriptions indicate that an
attacker could cause the server to allocate and return a large buffer,
almost all of which was left uninitialized - and often ended up
containing various pieces of left-over sensitive information from
previously-deleted and now-reused memory blocks.

While I don't disagree with the spirit of your warning, it's probably
worth clarifying that the most noteworthy data at risk of exposure in
the case of Heartbleed is the cert private key. That is, the private key
which, by definition, must remain in memory to en/decrypt traffic.

To all of the media frenzy over credit card information, user passwords,
etc., your points are very duly noted - but the exposure of the site
private key allows retroactive decryption of previously captured traffic
as well as continued active/passive decryption as long as the system
remains unpatched, and said key remains un-revoked.

While observing secure coding practices would certainly reduce the risk
of exploit, increase probability of successful mitigation, and decrease
data exposure following an exploit - again, in this case, that key must
remain in memory for the system to operate.

Seems to me that correctly utilizing libraries with proper over/under
flow guards would nullify 99% (just made that statistic up) of modern
attacks. A red/black library in concert with that, however, would offer
even more protection as you've noted.

However, if I've misunderstood your point, and you're simply using this
as an opportunity to call attention to best practices, then please do
disregard my clarification.

Cheers!

Chris

  "Work as if you were to live a hundred years. Pray as if you were to
die tomorrow."
  -Benjamin Franklin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 901 bytes
Desc: OpenPGP digital signature
URL: <http://www.metzdowd.com/pipermail/cryptography/attachments/20140410/921468a5/attachment.pgp>