Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[C++][Parquet] WipeOutDecryptionKeys doesn't securely wipe out keys #31603

Open
asfimport opened this issue Apr 14, 2022 · 7 comments
Open

[C++][Parquet] WipeOutDecryptionKeys doesn't securely wipe out keys #31603

asfimport opened this issue Apr 14, 2022 · 7 comments

Comments

@asfimport
Copy link

InternalFileDecryptor::WipeOutDecryptionKeys() merely call std::string::clear to dispose of the decryption key contents, but that method is not guaranteed to clear memory (it probably doesn't, actually).

We should probably devise a portable wrapper function for the various OS-specific memory clearing utilities.

Reporter: Antoine Pitrou / @pitrou

Note: This issue was originally created as ARROW-16202. Please see the migration documentation for further details.

@asfimport
Copy link
Author

@asfimport
Copy link
Author

Antoine Pitrou / @pitrou:
Actually we probably need a SecureString facility so that wiping happens every time a string copy is done.

@asfimport
Copy link
Author

Antoine Pitrou / @pitrou:
Draft PR for a low-level helper here: #12890

@asfimport
Copy link
Author

Krisztian Szucs / @kszucs:
@pitrou shall we postpone it to 9.0?

@asfimport
Copy link
Author

Antoine Pitrou / @pitrou:
Yes, probably.

@asfimport
Copy link
Author

Antoine Pitrou / @pitrou:
cc @ggershinsky

@asfimport asfimport added this to the 11.0.0 milestone Jan 11, 2023
@raulcd raulcd removed this from the 11.0.0 milestone Jan 11, 2023
@pitrou
Copy link
Member

pitrou commented Mar 21, 2024

@adamreeve For the record, you might be interested in this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants