From: Brian Candler <B.Candler@...>
Date: 2003-08-07T23:30:47+09:00
Subject: Re: More on DRB & OpenSSL

On Thu, Aug 07, 2003 at 07:58:59PM +0900, Hugh Sasse Staff Elec Eng wrote:
> >   class SecureMarshall
> >     def initialize(secret, lifetime = 3600)
> >       require 'digest/md5'
>         [...error checking...]
> >       @secret = secret
> >       @lifetime = lifetime
> >     end
> >
> >     def encode(obj)
> >       out = Marshal.dump([obj, Time.now.to_i + @lifetime])
> >       [Marshal.dump([out, Digest::MD5::digest(out + @secret)])].  \
> > 		pack("m").gsub(/\n/,'')   # base64 encode
> >     end
> 
>         [...]
> >
> 
> This only works on one machine, and leaves the secret lying around
> in memory (@secret).  You can't really pass this object over the net
> without exposing the secret.  This is the sort of subtlety that
> catches me out every time!

I think you may have misunderstood the purpose of this class.

If you are working across two machines, you instantiate a separate copy of
SecureMarshall (with the same shared secret) on each one. You use it to
encode objects, which you squirt across the network, and decode at the other
end. The SecureMarshall object itself is not sent across the network!

If decode() accepts the object, it proves it was signed by the sender (i.e.
someone who knew the shared secret).

Sure the secret is in memory in @secret. You can't avoid that - well, you
can read it off disk each time you use it instead, but that's no more
secure; in fact you will leave lots of objects in memory which contain the
secret, until the garbage collector picks them up.

Regards,

Brian.