Notes on OpenSSL remote memory corruption by Guido Vranken

In crypto code you often have conventions to name a certain value with a letter. E.g. RSA public keys consist of the values N, e, private keys also have d, p, q etc.

One may argue whether a, b and m are as "commonly known" for modular exponentiation. Still: There are definitely valid cases to use single letter variable names if they are the most well known "names" of certain values.

Math and crypto code are different from business logic. Under some circumstances, it's acceptable to use single-letter variable names. This often happens when the code implements a mathematical operation according to a standard formula.

For example, the following SHA-256 code comes from OpenBSD - a Unix derivative known for its focus on security and correctness.

     do {
        /* Rounds 0 to 15 (unrolled): */
        ROUND256_0_TO_15(a,b,c,d,e,f,g,h);
        ROUND256_0_TO_15(h,a,b,c,d,e,f,g);
        ROUND256_0_TO_15(g,h,a,b,c,d,e,f);
        ROUND256_0_TO_15(f,g,h,a,b,c,d,e);
        ROUND256_0_TO_15(e,f,g,h,a,b,c,d);
        ROUND256_0_TO_15(d,e,f,g,h,a,b,c);
        ROUND256_0_TO_15(c,d,e,f,g,h,a,b);
        ROUND256_0_TO_15(b,c,d,e,f,g,h,a);
     } while (j < 16);

In this particular case, the code is a direct translation of math, following the paper's notations is preferable. The state variables are named a, b, c, d, e, f, g because they're what the authors of SHA-256 chose to call them. When writing this particular fragment of code, renaming the state variables to something else is not constructive and increases the chance of mistakes.

I haven't read the OpenSSL code in question so I cannot comment whether the uses of single-letter variables in your comment are appropriate. To make an educated guess, a, b, m, r are probably reasonable. The uses of carry, mask, num, tmp are potentially questionable, though.

I use single letter variable names all the time.

    emails = users.map u -> u.email

It’s perfectly reasonable when the context is brief and the usage is obvious.