Comments (3)
What you're asking to do here is not currently doable with the haskell memory model (as used), and 'raw-memory-dump' is actually not part of the threat model (since the passphrases are in clear pretty much all over memory). The only non invasive way right now to solve this problem is to use hardware key; all the counter measure above would just be snake oil without a complete re-architecturing of the secret managements.
from cardano-crypto.
We will review with the product managers if we want to address this, and if so with what priority.
This will be more relevant with KES since although we may start with the encrypted KES_0 and passphrase, we will need to keep in memory (at different times) KES_1..KES_n, and not leak these to disk, so an ability to use mlock
'ed memory for the private keys could be important.
from cardano-crypto.
This repository doesn't implement KES, and is not tracking meta tasks either. so I fail to see the point to track this here, considering this is about redefining the threat model of the application.
from cardano-crypto.
Related Issues (20)
- split cardano-crypto into primitive/hdwallet bits
- HDWallet: Use some kind of secure zero instead of memset that could be optimised out HOT 1
- VRF: extend current implementation to support different hash algorithm
- ECC: de-hardcode P256R1
- Private Key Generation
- There is a mistake in your test vectors HOT 2
- Some transactions don't end in blockchain HOT 1
- Add `generateSecretKey`
- HD version bytes for BIP-0032 HOT 1
- Remove `Crypto.ECC.P256` and openssl dependency
- Odd behaviour (including SIGSEGV) from encryptedCreateDirectWithTweak
- Some documentation?
- Adapt to Cardano and implement EIP-3267 (crypto salaries) HOT 1
- About wallet_encrypted_derive_private in encrypted_sign.c HOT 1
- Cardano xPrv to Crypto.PubKey.Ed25519.SecretKey
- Repo Preparation for MBO
- Upgrade cardano-crypto to ghc 9.6 HOT 6
- test
- Missing Documentation per OSC Governance HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cardano-crypto.