Skip to content

Reduce amount of heap allocated types making it more secure#4

Merged
ba0f3 merged 1 commit intoOpenSystemsLab:masterfrom
beef331:master
Sep 26, 2023
Merged

Reduce amount of heap allocated types making it more secure#4
ba0f3 merged 1 commit intoOpenSystemsLab:masterfrom
beef331:master

Conversation

@beef331
Copy link
Copy Markdown
Contributor

@beef331 beef331 commented Sep 26, 2023

This PR removes ref object as it's not needed and it just increases the chance of a heap attack. It also disables copies on the objects to prevent accidentally keeping the secret in memory at multiple places. Finally it bumps nimble versions and pins base32. This is a breaking change but hopefully for the better 😅

@ba0f3
Copy link
Copy Markdown
Contributor

ba0f3 commented Sep 26, 2023

Thank you!

@ba0f3 ba0f3 merged commit 341847b into OpenSystemsLab:master Sep 26, 2023
@beef331
Copy link
Copy Markdown
Contributor Author

beef331 commented Sep 26, 2023

As mentioned in the comments we could look at using stack_strings to store the secret in a stack allocated matter, the major issue there is that it means we're forced to a fixed size. Meaning secrets have to be a specific size or smaller. My thought was to have a otp.secretSize that users could use to define their secret length, which would be defaulted to 32. If this is something you're interested in I'll make a PR.

@ba0f3
Copy link
Copy Markdown
Contributor

ba0f3 commented Sep 26, 2023

That's greet, a PR is welcome. Thank you!

@ThomasTJdev
Copy link
Copy Markdown
Contributor

This is a breaking change but hopefully for the better 😅

@beef331 - would it be possible to add the breaking changes in a changelog? Or in the release tag?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants