[Cryptography] Security is the other person's problem

[Peter Gutmann]

Fascinating discussion on the OpenWall/GMP lists about the fact that GMP uses
assert() (or at least a homebrew ASSERT that ignores NDEBUG) for
parameter/argument checking rather than simply checking the parameters and
returning an error as you'd expect, thus writing sensitive data to coredumps
and possibly sending it to error reporting services if the OS does this.  The
general consensus seems to be that if this happens it's the user's fault for
passing in invalid parameters, having core dumps enabled, not catching
SIGABRT, not setting setrlimit, not using prctl with PR_SET_DUMPABLE or
ulimit, not disabling error reporting, and holding it wrong.  The thread
starts here:

https://www.openwall.com/lists/oss-security/2018/12/31/1

There doesn't seem to be a thread index, but the following captures most of
it:

https://www.openwall.com/lists/oss-security/2018/12/31/
https://www.openwall.com/lists/oss-security/2019/01/01/

Near the end of the discussion is this gem:

  A reasonable assumption is that this user has modified the sources to
  cause this bug.  The motive would be to support his auxesis about how
  insecure GMP is.

  Let's move on.  No bug to be found here.

I had no idea that Ulrich Drepper was also involved in GMP...

Peter.