limitations.rst 1.2 KB

123456789101112131415161718192021222324
  1. Known security limitations
  2. ==========================
  3. Secure memory wiping
  4. --------------------
  5. `Memory wiping`_ is used to protect secret data or key material from attackers
  6. with access to deallocated memory. This is a defense-in-depth measure against
  7. vulnerabilities that leak application memory.
  8. Many ``cryptography`` APIs which accept ``bytes`` also accept types which
  9. implement the buffer interface. Thus, users wishing to do so can pass
  10. ``memoryview`` or another mutable type to ``cryptography`` APIs, and overwrite
  11. the contents once the data is no longer needed.
  12. However, ``cryptography`` does not clear memory by default, as there is no way
  13. to clear immutable structures such as ``bytes``. As a result, ``cryptography``,
  14. like almost all software in Python is potentially vulnerable to this attack. The
  15. `CERT secure coding guidelines`_ assesses this issue as "Severity: medium,
  16. Likelihood: unlikely, Remediation Cost: expensive to repair" and we do not
  17. consider this a high risk for most users.
  18. .. _`Memory wiping`: https://devblogs.microsoft.com/oldnewthing/?p=4223
  19. .. _`CERT secure coding guidelines`: https://www.securecoding.cert.org/confluence/display/c/MEM03-C.+Clear+sensitive+information+stored+in+reusable+resources