{"repo":"awnumar/memguard","free":true,"listed":false,"github":"https://github.com/awnumar/memguard","clone":"git clone https://github.com/awnumar/memguard.git","description":"Software sandbox for storage of sensitive information in memory.","language":"Go","stars":2753,"topics":["crypto","cryptography","go","golang","memory","security"],"license":"Apache-2.0","category":"security_tool","readme_excerpt":"

\n \n

MemGuard

\n

Software enclave for storage of sensitive information in memory.

\n

\n \n \n

\n

\n\n---\n\nThis package attempts to reduce the likelihood of sensitive data being exposed when in memory. It aims to support all major operating systems and is written in pure Go.\n\n## Features\n\n* Sensitive data is encrypted and authenticated in memory with XSalsa20Poly1305. The [scheme](https://spacetime.dev/encrypting-secrets-in-memory) used also [defends against cold-boot attacks](https://spacetime.dev/memory-retention-attacks).\n* Memory allocation bypasses the language runtime by [using system calls](https://github.com/awnumar/memcall) to query the kernel for resources directly. This avoids interference from the garbage-collector.\n* Buffers that store plaintext data are fortified with guard pages and canary values to detect spurious accesses and overflows.\n* Effort is taken to prevent sensitive data from touching the disk. This includes locking memory to prevent swapping and handling core dumps.\n* Kernel-level immutability is implemented so that attempted modification of protected regions results in an access violation.\n* Multiple endpoints provide session purging and safe termination capabilities as well as signal handling to prevent remnant data being left behind.\n* Side-channel attacks are mitigated against by making sure that the copying and comparison of data is done in constant-time.\n\nSome features were inspired by [libsodium](https://github.com/jedisct1/libsodium), so credits to them.\n\nFull documentation and a complete overview of the API can be found [here](https://godoc.org/github.com/awnumar/memguard). Interesting and useful code samples can be found within the [examples](examples) subpackage.\n\n## Installation\n\n```\n$ go get github.com/awnumar/memguard\n```\n\nAPI is experimental and may have unstable changes. You should pin a version. [[modules](https://github.com/golang/go/wiki/Modules)]\n\n## Contributing\n\n* Submitting program samples to [`./examples`](examples).\n* Reporting bugs, vulnerabilities, and any difficulties in using the API.\n* Writing useful security and crypto libraries that utilise memguard.\n* Implementing kernel-specific/cpu-specific protections.\n* Submitting performance improvements.\n\nIssues are for reporting bugs and for discussion on proposals. Pull requests should be made against master.\n","default_branch":"master","files":49,"tree":[".github/ISSUE_TEMPLATE/bug_report.md",".github/ISSUE_TEMPLATE/proposal.md",".github/ISSUE_TEMPLATE/question.md",".github/workflows/ci.yml","AUTHORS","LICENSE","README.md","buffer.go","buffer_test.go","core/auxiliary.go","core/auxiliary_test.go","core/buffer.go","core/buffer_test.go","core/coffer.go","core/coffer_test.go","core/crypto.go","core/crypto_test.go","core/enclave.go","core/enclave_test.go","core/exit.go","core/exit_test.go","core/init.go","docs.go","enclave.go","enclave_test.go","examples/README.md","examples/casting/casting.go","examples/casting/casting_test.go","examples/deadlock/x01/poc.go","examples/deadlock/x01/poc_test.go","examples/deadlock/x02/poc.go","examples/deadlock/x02/poc_test.go","examples/socketkey/socketkey.go","examples/socketkey/socketkey_test.go","examples/stdin/stdin.go","examples/stream/cpuprof1.svg","examples/stream/memprof1.svg","examples/stream/stream.go","examples/stream/stream_test.go","examples/streams/streams.go","go.mod","go.sum","logo.svg","memguard.go","memguard_test.go","signals.go","signals_test.go","stream.go","stream_test.go"],"storefront":"/r/awnumar","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/awnumar/memguard/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}