Secure programming is slow - really?
Key | Action |
---|---|
K or space | Play / Pause |
M | Mute / Unmute |
C | Select next subtitles |
A | Select next audio track |
V | Show slide in full page or toggle automatic source change |
left arrow | Seek 5s backward |
right arrow | Seek 5s forward |
shift + left arrow or J | Seek 10s backward |
shift + right arrow or L | Seek 10s forward |
control + left arrow | Seek 60s backward |
control + right arrow | Seek 60s forward |
shift + down arrow | Decrease volume |
shift + up arrow | Increase volume |
shift + comma | Decrease playback rate |
shift + dot or shift + semicolon | Increase playback rate |
end | Seek to end |
beginning | Seek to beginning |
Share this media
Download links
HLS video stream
You can use an external player to play this stream (like VLC).
HLS video streamWhen subscribed to notifications, an email will be sent to you for all added annotations.
Your user account has no email address.
Information on this media
Links:
Number of views:
406Creation date:
July 4, 2018Speakers:
Pierre ChifflierLicense:
CC BY-SA v4Description
Performance is important in many programs: web servers, network applications, intrusion detection systems, etc. In these programs, C is a usual choice as the programming language: it is close to the hardware, and very fast. However, it is very hard to make the program secure, and this results in many vulnerabilities.
This talk is about why and how use rust to achieve both performance and security by creating a “safe zone” in a C program. We first look at the good code patterns to produce efficient code, and the limits of this approach. We then go through the optimization of the code to gain more performance, and check that doing so we do not remove any important check.
We can use Kerberos as an example, since it is based on ASN.1/DER, which is both difficult to manipulate, and very error-prone: all objects are Type-Length-Value (TLV), so a C parser has to manipulate recursive objects with pointers and lengths everywhere. DER parsers are regular clients for CVEs.
Keywords: performance, security, rust, assembly
Note: we take the parsers in Suricata as an example of such code. However, this talk is not related to Suricata, but more about the source code, the compiler and the produced code.
Pierre Chifflier
Pierre is the head of the intrusion detection research lab (LED) at ANSSI. He is interested in various security topics such as Operating Systems, compilers, programming languages, and new intrusion detection methods. He is also a Debian developer and has been involved in free software since a long time.
Other media in the channel "2018"
- 109 views, 7 this yearGlassfish from (IN)Secure adminJuly 6th, 2018
- 160 views, 3 this yearShadow on the Wall - Risks and Flaws with ShadowsocksJuly 6th, 2018
- 57 views, 4 this yearOpen Hardware for (software) offensive securityJuly 6th, 2018
- 48 views, 4 this yearFreedom Fighting Mode - Open Source Hacking HarnessJuly 6th, 2018
- 76 views, 1 this yearExpl-iot: IoT Security Testing FrameworkJuly 6th, 2018
- 23 viewsIo(M)T Security: A year in reviewJuly 6th, 2018