[gnutls-dev]Erasing private certificate key from memory

[Nikos Mavroyanopoulos]

On Tue, Mar 04, 2003 at 02:41:48AM +0200, Timo Sirainen wrote:

> Would it be possible to add support for it? I don't know much about SSL
> protocol, but I'm hoping it wouldn't be needed after initial handshake.
> This would be useful as a way to prevent attacker from getting hands on
> it too easily.
> Hmm. Didn't SSL protocol support re-handshaking in the middle of the
> connection? Does that require the private key?

Yes. That is because there maybe multiple situations like, the first
handshake is anonymous, the second is server only authenticated,
and the third one is server and client authenticated. 

But this does not prevent us from adding an option to delete the private 
key and the certificates from the credentials structure. It will be included
in the 0.9.x branch.

> This brings to my mind other problem with async I/O. If I send alert
> message but it doesn't get fully sent, how do I know that I should call
> gnutls_record_send() again to finish it? And can there be some reasons
You don't have to. Just call gnutls_alert_send() if the return value
is GNUTLS_E_AGAIN, or INTERRUPTED.

> for gnutls_record_send() to actually want to read something or
> gnutls_record_recv() to send something (eg. automatic handshaking)?
> OpenSSL API has WANT_READ and WANT_WRITE errors which can occur with
> either command.
This also is the case with all the *_send() and *_bye() functions in gnutls.
They all call the low level record send function which returns the same
error codes on errors.

> 
> 
> _______________________________________________
> Gnutls-dev mailing list
> Gnutls-dev at gnupg.org
> http://lists.gnupg.org/mailman/listinfo/gnutls-dev
> 

-- 
Nikos Mavroyanopoulos