<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: 0.875rem;
}
body {
-webkit-text-shadow: rgba(255,255,255,0.01) 0 0 1px;
}
body {
font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Noto Sans", Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,0.01) 0 0 1px; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Noto Sans", Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";'>
<div class="content">
<p style="color: #777777;">
<a href="https://gitlab.com/dueno" style="color: #1068bf;">Daiki Ueno</a>
<a href="https://gitlab.com/gnutls/gnutls/-/issues/1398#note_1071468742" style="color: #1068bf;">commented</a>:
</p>
<div class="md" style="color: #303030; word-wrap: break-word;">
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">I agree in general. To ensure zeroization of sensitive materials in GnuTLS/Nettle while not sacrificing the GMP users, the current alternatives under discussion are:</p>
<ul dir="auto" style="text-align: initial; list-style-type: disc; margin: 0 0 16px; padding: 0;">
<li style="margin-top: 0; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">switch <code style='font-size: 90%; color: #1f1f1f; word-wrap: break-word; background-color: #f0f0f0; border-radius: 4px; margin-top: 0; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 2px 4px;'>mpz_</code> usage in Nettle and GnuTLS to using the low-level <a href="https://gmplib.org/manual/Low_002dlevel-Functions" rel="nofollow noreferrer noopener" target="_blank" style="color: #1068bf;"><code style='font-size: 90%; color: #1068bf; word-wrap: break-word; background-color: #f0f0f0; border-radius: 4px; margin-top: 0; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 2px 4px;'>mpn_</code></a> functions, and implement zeroization directly</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">link to a static library of GMP so the call to <code style='font-size: 90%; color: #1f1f1f; word-wrap: break-word; background-color: #f0f0f0; border-radius: 4px; margin-top: 0; font-family: "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 2px 4px;'>mp_set_memory_functions</code> doesn't affect other GMP users</li>
</ul>
<p dir="auto" style="color: #303030; margin: 0 0 16px;" align="initial">While the former would be better in the long run, it would require significant effort in porting. The latter would be simpler, though it would slightly increase the library size (see <a href="https://gitlab.com/gnutls/gnutls/-/merge_requests/1635" data-original="!1635" data-link="false" data-link-reference="false" data-project="179611" data-merge-request="172404695" data-project-path="gnutls/gnutls" data-iid="1635" data-reference-type="merge_request" data-container="body" data-placement="top" title="build: allow GMP to be statically linked" class="gfm gfm-merge_request" style="color: #1068bf; margin-top: 0;">!1635</a> and the example usage in <a href="https://gitlab.com/redhat/centos-stream/rpms/nettle/-/merge_requests/6/" data-original="nettle" data-link="true" data-link-reference="true" data-project="23681386" data-merge-request="172184504" data-project-path="redhat/centos-stream/rpms/nettle" data-iid="6" data-reference-type="merge_request" data-container="body" data-placement="top" title="Bundle GMP for privatizing memory functions" class="gfm gfm-merge_request" style="color: #1068bf;">nettle</a> and <a href="https://gitlab.com/redhat/centos-stream/rpms/gnutls/-/merge_requests/41" data-original="gnutls" data-link="true" data-link-reference="true" data-project="23660224" data-merge-request="172402744" data-project-path="redhat/centos-stream/rpms/gnutls" data-iid="41" data-reference-type="merge_request" data-container="body" data-placement="top" title="Bundle GMP to privatize memory functions" class="gfm gfm-merge_request" style="color: #1068bf;">gnutls</a> packages in CentOS Stream 9).</p>
<p dir="auto" style="color: #303030; margin: 0;" align="initial">Tagging <a href="https://gitlab.com/tobhe" data-user="3553161" data-reference-type="user" data-container="body" data-placement="top" class="gfm gfm-project_member js-user-link" title="Tobias Heider" style="color: #1068bf; background-color: #cbe2f9; border-radius: 4px; margin-top: 0; padding: 0 2px;">@tobhe</a> <a href="https://gitlab.com/nielsmoller" data-user="2977537" data-reference-type="user" data-container="body" data-placement="top" class="gfm gfm-project_member js-user-link" title="Niels Möller" style="color: #1068bf; background-color: #cbe2f9; border-radius: 4px; padding: 0 2px;">@nielsmoller</a> for further feedback.</p>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #666;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/issues/1398#note_1071468742" style="color: #1068bf;">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.com" style="color: #1068bf;">gitlab.com</a>. <a href="https://gitlab.com/-/sent_notifications/a973b6634f7095fd728875c67b6ad31a/unsubscribe" target="_blank" rel="noopener noreferrer" style="color: #1068bf;">Unsubscribe</a> from this thread · <a href="https://gitlab.com/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link" style="color: #1068bf;">Manage all notifications</a> · <a href="https://gitlab.com/help" target="_blank" rel="noopener noreferrer" class="help-link" style="color: #1068bf;">Help</a>
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/-/issues/1398#note_1071468742"}}</script>
</p>
</div>
</body>
</html>