In order to help protect applications (particularly long-running servers) from pointer overruns or underruns that could return arbitrary data from
the program's dynamic memory area, where keys and other sensitive information might be stored, OpenSSL supports the concept of a "secure heap."
The level and type of security guarantees depend on the operating system. It is a good idea to review the code and see if it addresses your threat model and concerns.
If a secure heap is used, then all B<BIGNUM> values are stored in that heap. This is more than strictly necessary -- the public part of an RSA key, for example, need not be kept private -- but it is a secure approach and least invasive to the OpenSSL source code.
more here.......http://article.gmane.org/gmane.comp.encryption.openssl.devel/24356
the program's dynamic memory area, where keys and other sensitive information might be stored, OpenSSL supports the concept of a "secure heap."
The level and type of security guarantees depend on the operating system. It is a good idea to review the code and see if it addresses your threat model and concerns.
If a secure heap is used, then all B<BIGNUM> values are stored in that heap. This is more than strictly necessary -- the public part of an RSA key, for example, need not be kept private -- but it is a secure approach and least invasive to the OpenSSL source code.
more here.......http://article.gmane.org/gmane.comp.encryption.openssl.devel/24356