[Twisted-Python] Erasing strings from memory?
I'm working on a SSH client/server for Twisted, and some of the things the client needs to work with are passwords both for login and for private keys, and then the decrypted keys. Obviously, storing these in memory leads to the possibility of acessing them and thereby compromising the user. Is there a way to overwrite the data, or otherwise erase it from memory? -p -- Paul Swartz (o_ http://twistedmatrix.com/users/z3p.twistd/ //\ z3p@twistedmatrix.com V_/_ AIM: Z3Penguin
On Sun, 10 Nov 2002, "Paul Swartz" <z3p@twistedmatrix.com> wrote:
I'm working on a SSH client/server for Twisted, and some of the things the client needs to work with are passwords both for login and for private keys, and then the decrypted keys. Obviously, storing these in memory leads to the possibility of acessing them and thereby compromising the user. Is there a way to overwrite the data, or otherwise erase it from memory?
The best way would probably to do it in a subprocess. The next best way would be to read the string into an mmapped are which you explicitely free. If you want to be really secure, write a third program like ssh-agent which does the authentication for a user.
On 10 Nov 2002 18:06:27 -0000, Moshe Zadka <twisted@moshez.org> wrote:
The best way would probably to do it in a subprocess. The next best way would be to read the string into an mmapped are which you explicitely free. If you want to be really secure, write a third program like ssh-agent which does the authentication for a user.
Couldn't you use the 'array' module to create a character array which then you could manually dump garbage over? (making sure not to use any array convenience functions like "tostring" or what-have-you) -- | <`'> | Glyph Lefkowitz: Traveling Sorcerer | | < _/ > | Lead Developer, the Twisted project | | < ___/ > | http://www.twistedmatrix.com |
On 10 Nov 2002 at 22:16, Glyph Lefkowitz wrote:
Couldn't you use the 'array' module to create a character array which then you could manually dump garbage over? (making sure not to use any array convenience functions like "tostring" or what-have-you)
Maybe, but I doubt I could send arrays to functions that expect Python strings. I got a message from Rich Satz on pycrypto with a C module that will clear a Python string along with permission to use it in Twisted. I'll commit it when I use it in conch. -p -- Paul Swartz (o_ http://twistedmatrix.com/users/z3p.twistd/ //\ z3p@twistedmatrix.com V_/_ AIM: Z3Penguin
participants (3)
-
Glyph Lefkowitz -
Moshe Zadka -
Paul Swartz