search

haskell-crypto / cryptonite

lowlevel set of cryptographic primitives for haskell
Other
226 stars 139 forks source link

AEAD memory leak #319

Closed wyager closed 4 years ago

wyager commented 4 years ago

AEAD will currently leak memory if you try to use it in a streaming fashion.

I believe all that is needed is to make AEAD strict on aeadState. If I have essentially seq (aeadState aead) aead the problem goes away (although it's actually a bit more complicated complicated due to the existential in AEAD)

On a related note, could aeadModeImpl be lifted out of AEAD? I'm not exactly sure what's going on there - there's some weird existential hiding stuff going on and I can't figure out exactly what it's for.

wyager commented 4 years ago

To clarify, this only really comes up if you're authenticating a large amount of associated data, so it's easy to miss. If you're encrypting, you're usually strict on the ciphertext chunks pretty quickly, which would prevent this issue from being visible. The issue I ran into is that if I'm feeding lots of AD chunks into the AEAD, they just stick around in memory instead of getting folded into the AEAD state.

ocheron commented 4 years ago

Yes you're right, field aeadState should be changed to strict. Do you send a PR for this?

I don't understand what you want to change about aeadModeImpl. It's there to reference the AEAD code from the AEAD value alone.