3 ms·
> Note that in the heap there are the intermediate values that and are used when constructing the connection and doing the encryption, you aren't exactly lookin
by adsche 12y ago
> Note that in the heap there are the intermediate values that and are used when constructing the connection and doing the encryption, you aren't exactly looking for '------BEGIN PRIVATE KEY------' or base64 string, you'd be looking for those - each which have a unique data type.
That's what I thought as well when I saw people POSTing strings like that and other people finding them. But when the key is first loaded from file, wouldn't actually all those base64 strings be in memory?
Probably just pretty unlikely that they would persist for a long time without being overwritten.
- alexkus 12y agoIt shouldn't be about it eventually being overwritten, sensitive information like that (which isn't needed for runtime) should be actively scrubbed before the block of memory is freed. You can't, however, get away with not having the private key modulus in memory (in some form) all the time.