Re:How to zero a buffer
by maxlybbert on Friday September 05, 2014 @12:40AM
(#8272342)
C may have pitfalls for "these kinds of applications," but it has some strengths that other languages don't. Since C gives the programmer significant control over memory allocation, it's possible to avoid various kinds of timing attacks related to cache misses (possible is not the same as easy). Many languages don't give the programmer the necessary tools to do that.
[ Parent
| on HN ]
There are two different things you can mean when you say "C is not suitable to these kinds of applications". One is the more extreme, "You should not be using C, you should be using <other existing language> because it is more suitable." That's a bit of a hard sell; though specific alternatives should be evaluated on their merits. There is also, "there are design choices that have been made in C that make it worse for these applications than C would have been were it not for those choices", which seems an easy case to make.
Re:How to zero a buffer
by maxlybbert on Friday September 05, 2014 @04:32AM
(#8272826)
The funny thing to me is that the standard crypto packages for other languages nearly always end up calling C code.
That's not at all incompatible with "C is the best option of existing languages, but still bad in some obvious ways where it could be better (for this purpose)."
Re:How to zero a buffer
by maxlybbert on Friday September 05, 2014 @01:52PM
(#8275218)
True.