Talk:Protecting Memory Secrets
Draft Status
Despite the wording in some of the standards which may sound overly prescriptive, I expect the intent is not to ban the use of popular languages from use. As such I expect that the requirements will evolve. This is an attempt to step back from some of the wording to look at the risks and a broader set of options to meet the objective. This task should evoke a healthy constructive discussion. As such, I don't see this as cast in stone.
Motivation for task
Recent trends in data breaches are increasing focus on preventing breaches. One of the emerging areas is the entire area of secrets management, things like credentials at rest. There are a number of platform based secrets managers addressing these risks. The protection of secrets in working memory is less mature. Some emerging standards are calling for protections that may not exist in all languages.
Like it or not, some developers will need to demonstrate that they can code to these standards, provide language documentation, and verify the measures work.
Standards with Secrets Management
At Rest
OWASP has a secrets management cheat sheet
Transient =
The Payment Card Industry has approximately a dozen standards for the protection of credit/debit information. Some of these cover organizations others cover solutions. Bothe the P2PE and Secure Software standards require developers to address secrets in memory.
Reddit Discussion
- This discusses a variety of instances and techniques
- Context Managers (e.g. Python)
- Rust's Secrecy features
- Platform Specific Interfaces such as secure enclaves could help but make the solution more platform dependent
- In-memory encryption has been suggested but you still need to worry about the plain text input/output phases plus you need good encryption keys which has other challenges
- ORAM has been suggested but it sounds like fits another purpose
- Garbage Collection challenges
- attempting to zero elements one at a time could make the situation worse by creating partial strings in languages where new strings are created
- performance impact unless there is some way to constrain the size of the collected region
- not all languages can request collection and some delay the collection or take it as a suggestion