2

I had an exam question on why security canaries should be short. I suspect that is so that the attacker has a harder time finding the canary. Is that right?

2
  • Why do you think it's harder to find (brute force?) a short canary?
    – domen
    Feb 17, 2020 at 11:50
  • I would think that you would want a security canary to be easy for an attacker to find, not hard. But then again maybe I am misunderstanding what you are talking about... Feb 17, 2020 at 13:28

1 Answer 1

2

Presumably you are referring to stack canaries, which is a runtime construct and trivial to find. You want them to be short for performance reasons as they are compared every time a function returns.

You can find some more information of the performance of protection here: https://research.google/pubs/pub43809/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .