Re: [PATCH 1/8] purgatory/sha256: replace memset by memzero_explicit

[David Sterba <dsterba@suse.cz>]

On Sun, Nov 30, 2014 at 05:59:27PM +0100, Julia Lawall wrote:
> @@ -205,7 +205,7 @@ static void sha256_transform(u32 *state, const u8 *input)
>  
>  	/* clear any sensitive info... */
>  	a = b = c = d = e = f = g = h = t1 = t2 = 0;

All of these get optimized away.

How to clear them effectively is another question.  Setting them one by
one casting to volatile would generate 10 instructions. Although this
might be quick as there are no dependencies, the function
sha256_transform is called repeatedly and the small overhead may add up.

Other attempts to fix it require restructuring the code so all the
variables are eg. stored in an array that gets cleared in one go. Here
the indirect access could be hidden into the macros (e0, e1, s0, s1).

> -	memset(W, 0, 64 * sizeof(u32));
> +	memzero_explicit(W, 64 * sizeof(u32));