[ pycrypto-Patches-700778 ] Added the key as attribute

Patches item #700778, was opened at 2003-03-10 06:40
Message generated for change (Comment added) made by akuchling
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=320937&aid=700778&group_id=20937

Category: None
Group: None
>Status: Closed
>Resolution: Rejected
Priority: 5
Submitted By: Tage Stabell-Kulø (tagesk)
Assigned to: A.M. Kuchling (akuchling)
Summary: Added the key as attribute

Initial Comment:
We're implementing a server that deals with crypto for many clients.
Some clients need to pass crypto-objects to the server.  When
the server needs to send /the key/ to a peer, there is need to
obtain the original key from an object.
This code adds a new attribut (named key) that holds the original
key as it was used to initialize the object.



----------------------------------------------------------------------

>Comment By: A.M. Kuchling (akuchling)
Date: 2004-07-10 13:23

Message:
Logged In: YES 
user_id=11375

I've decided to reject this patch; key data should be in memory as briefly 
as possible, and the library shouldn't keep it around automatically.


----------------------------------------------------------------------

Comment By: Tage Stabell-Kulø (tagesk)
Date: 2003-03-10 12:28

Message:
Logged In: YES 
user_id=207511

The object contains the key, although in a sligthly different 
representation (installed by block_init).  Hence, the object should be 
treated with the outmost care in any case.  Adding the key should not add 
to the risk.  I try to attach the patch again.


----------------------------------------------------------------------

Comment By: A.M. Kuchling (akuchling)
Date: 2003-03-10 10:05

Message:
Logged In: YES 
user_id=11375

No patch is attached; SF's file uploading is buggy and often fails, so try again.

Why not just pass a string containing the key instead of a crypto object, though?  I dislike the idea of keeping the key around in the object, because a security hole might make it possible to poke around in a process's memory and find the key.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=320937&aid=700778&group_id=20937


-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 - 
digital self defense, top technical experts, no vendor pitches, 
unmatched networking opportunities. Visit www.blackhat.com