Doing this the crypto directory: grep memset *.c | wc -l I get 137 results. The compiler may optimise memset() away, subverting the intent of these operations. We have memzero_explicit() to avoid that problem. Should most or all those memset() calls be replaced?
