No matter how you look at it, C is the wrong choice for security relevant systems software. But where is the alternative?
No wait! Ruby, that should be perfect, can't cause buffer overflow there....
Ermm.. wait I got , well use python!
Hint: it starts with a C.
If you build a house in a swamp, you are in trouble.
If C is the wrong choice, what is the right choice?
Why, Python, of course![0]
[0] - http://pypy.org/
(I jest, your point is entirely valid)
> Bogus objects — properly tagged words with invalid addresses that pointed at uninitialized memory or into the middle of object of a different type — which would cause the GC to corrupt memory would be left in registers or on the stack. These sort of problems were everywhere in the microcode.
Go build your cabin in the woods now.
Something like a buffer overflow was very very rare. This was not a systemic problem like it is in C.
And there are Java compilers and runtimes written in Java, and Lisp compilers written in Lisp, etc.
The issue is developers are not using the tools or following the best practices because they think they know better than 30 years worth of experience or get caught up in bikeshedding about ideology, licenses and which line the curly braces go on.
http://www.amazon.com/The-CERT-Secure-Coding-Standard/dp/032...
Online:
https://www.securecoding.cert.org/confluence/display/seccode...
Others:
http://www.amazon.com/Secure-Coding-Edition-Software-Enginee...
http://www.amazon.com/Style-Guidelines-Programming-Professio...
http://www.amazon.com/C-Traps-Pitfalls-Andrew-Koenig/dp/0201...
Nevermind the copious undefined behavior, the fact that C programmers sometimes struggle to figure out what a valid C expression actually does, the fact that C programmers have to choose between code bloat and using "goto" for finalization, the fact that there are no standard error handling constructs, the fact that strings are null terminated, the lack of a standardized way to determine array lengths at runtime, etc., etc., etc. Even something as simple as this:
int f(int x, int y) { return x + y; }
Can lead to undefined behavior in C:
https://www.securecoding.cert.org/confluence/display/seccode...
Basically C should be at the bottom of the list of languages that programmers choose for cryptography or security software.
There's a bit of research in this, but I don't know of anything that's ready to use.
For that, we'd need: (1) A set of properties to verify for an implementation (2) An implementation to verify
Looking at http://coq.inria.fr/related-tools, there may be some related tools that could do the job. Still, there's a research project there.
A few substantiating links from my search results for "coq generating code":
http://coq.inria.fr/V8.1/refman/Reference-Manual021.html
http://research.microsoft.com/en-us/um/people/akenn/coq/LOLA...
http://research.microsoft.com/en-us/um/people/nick/coqasm.pd...