On Mar 25, 2011, at 4:45 PM, Jeffrey Walton wrote:
> On Fri, Mar 25, 2011 at 3:56 PM, Anthony Gabrielson
> <[email protected]> wrote:
>> This will do what you want:
>> http://agabrielson.wordpress.com/2010/07/15/openssl-an-example-from-the-command-line/
>
> memset(plaintext,0,sizeof(plaintext));
>
> The optimizer might remove your zeroization.
>
> Jeff
Hi Jeff,
Yup, the compiler may do all kinds of crazy things during optimization.
That sample code is actually based on some other code that I found on the web
that had major problems. The web example had a bug, so I added the memset to
help debug it. I noticed (with the help of memset) that the decrypt statement
was in fact not working at all. I fixed the example and the code eventually
turned became the example on the website. Further, the memory thats being
memset is also used again, several times - so although I'll admit that I
haven't looked at the assembly, I think its working as expected. Do you see a
real bug in the calls to OpenSSL? If so I would like to fix it - I'll be the
first to admit I make mistakes.
If you look further through the blog you will see an OpenSSL toolbox
for Matlab. I was interested in looking at several interactions and the
toolbox helped me do that. The sample code was the basis for that toolbox, and
although I haven't used the code in awhile, it was working as expected during
exploration.
Anyway, I hope folks like the example -
Anthony
