Crypto++

Debug builds of the project includes asserts to aide the developer in finding mistakes.

Release builds are built with -DNDEBUG and will NEVER asset. The library will validate the parameters and/or state and throw an exception on failure. Anywhere there is an 'if' statement to validate state includes an assert. Anywhere there is an assert to validate state includes an 'if' statement that throws. They are matched set like bookends.

The Crypto++ library never asserts in production for five reasons. First, it is the application's authors decision to crash their app. The library does not make policy decisions for the application author.

Second, some platforms, like Apple iOS, forbid applications from crashing because it degrades the UI experience. In this case, the App Store has set the policy for the application author. The library will not cause an author's app to be rejected from an App Store.

Third, the library handles sensitive information like private keys, shared secrets and passwords. When an assert fires a core file could be written that includes the sensitive information. That means the sensitive information has been egressed outside the application's security boundary. Folks with access to the mobile device, desktop computer or a computer paired/sync'd with the mobile device will be able to recover the secrets from the filesystem.

Fourth, the core file, if present, may be shipped to an Error Reporting Service. Now Apple, Google, Fedora, Red Hat, Ubuntu or Microsoft have the user's private keys, shared secrets and passwords. Then the information is then passed onto the developer who has the user's private keys, shared secrets and passwords, too.

Fifth, asserts destroy most of Confidentiality-Availability-Integrity (CIA). When an assert crashes a program, it (1) may preserve data Integrity at the expense of (2) Confidentiality of the data and (3) Availability of the program or server. If an author wishes to preserve Integrity, he/she/it merely needs to return false in the offending function or call exit(1) without the loss of Confidentiality or Availability.