From xemacs-m  Thu Aug 28 08:54:49 1997
Received: from newman.aventail.com (root@newman.aventail.com [199.238.236.1])
	by xemacs.org (8.8.5/8.8.5) with ESMTP id IAA07766;
	Thu, 28 Aug 1997 08:54:48 -0500 (CDT)
Received: from kramer.in.aventail.com (wmperry@kramer.in.aventail.com [192.168.1.12])
	by newman.aventail.com (8.8.5/8.8.5) with ESMTP id GAA02685;
	Thu, 28 Aug 1997 06:54:45 -0700 (PDT)
Received: (from wmperry@localhost)
	by kramer.in.aventail.com (8.8.5/8.8.5) id GAA28048;
	Thu, 28 Aug 1997 06:54:03 -0700
To: jari.aalto@ntc.nokia.com
Cc: lomew@cs.utah.edu, steve@xemacs.org, xemacs-beta@xemacs.org
Subject: Re: PGP security threat alert
References: <199708280521.BAA23864@helene.tele.nokia.fi>
Errors-to: wmperry@aventail.com
Reply-to: wmperry@aventail.com
X-Face: O~Rn;(l][/-o1sALg4A@xpE:9-"'IR[%;,,!m7</SYF`{vYQ(&RI1&EiH[FvT;J}@f!4kfz
 x_!Y#=y{Uuj9GvUi=cPuajQ(Z42R[wE@{G,sn$qGr5g/wnb*"*ktI+,CD}1Z'wxrM2ag-r0p5I6\nA
 [WJopW_J.WY;
From: wmperry@aventail.com (William M. Perry)
Date: 28 Aug 1997 06:54:03 -0700
In-Reply-To: Jari Aalto's message of "Thu, 28 Aug 1997 01:21:22 -0400"
Message-ID: <86en7e8lc4.fsf@kramer.in.aventail.com>
Lines: 35
X-Mailer: Gnus v5.4.64/XEmacs 20.3(beta18) - "Bratislava"

Jari Aalto <jaalto@tre.tele.nokia.fi> writes:

> -----BEGIN PGP SIGNED MESSAGE-----
> 
> ##
> Subject: Re: PGP security threat alert
> Reply-to: jari.aalto@ntc.nokia.com
> 
> | Wed 27.8.97  Bart Robinson <lomew@cs.utah.edu>
> |
> |         (let ((record-keystrokes nil) pw)
> 
> That looks nice!
> I have a question; I store the passwords to hash array indexed by
> user name and when the timer process expiress the hash; it simply
> resets it to nil.
> 
> Is this secure enough or should I map over the elements in the
> vector and set each user's password hash-key to nil; before setting the whole
> vector is set to nil?

  Set them manually to something (typically NULL), with something like
this.  If XEmacs coredumps before doing a garbage collection after you have 
simply done a 'clrhash', the passwords can still be exposed.

(defun passwd-clrhash (hash)
  (cl-maphash
   (lambda (k v)
     (loop for i from 0 to (1- (length v))
	   do (aset v i ?\0)))
   hash)
  (cl-clrhash hash))

-Bill P.

