Cryptography Reference
In-Depth Information
PUBLIC
_f
EXTRN
_purgevars_l:NEAR
;
COMDAT _f
_TEXT
SEGMENT
_key_l$ = -516
_secret$ = -520
_f
PROC NEAR
; COMDAT
;9:{
sub
esp, 520
; 00000208H
; 10
:
CLINT key_l;
; 11
:
USHORT secret;
...
; 18
:
/* overwrite the variables */
; 19
:
PURGEVARS_L ((2, sizeof (secret), &secret,
sizeof (key_l), key_l));
lea
eax, DWORD PTR _key_l$[esp+532]
push
eax
lea
ecx, DWORD PTR _secret$[esp+536]
push
514
; 00000202H
push
ecx
push
2
push
2
call
_purgevars_l
; 20
: return 0;
xor
eax, eax
;21
:}
add
esp, 552
; 00000228H
ret
0
_f
ENDP
_TEXT
ENDS
As a further protective measure in connection with the implementation
of security-critical applications we should mention a comprehensive
mechanism for error handling that sees to it that even in the case of invalid
arguments or other exceptional situations no sensitive information is
divulged. Likewise, suitable measures should be considered for establishing
the authenticity of the code of a cryptographic application, so that the
insertion of Trojan horses is prevented or at least detected before the code
can be executed. Taking a cue from the story of the Trojan War,
Trojan horse
is the name given to software that has been altered in such a way that it
apparently functions correctly but has additional undesirable effects such
