memguard_rs/lib.rs
1//! # memguard-rs
2//!
3//! Secure memory handling primitives for Rust.
4//!
5//! ## Features
6//!
7//! - **Zeroization on drop** — volatile-write memory clearing the compiler cannot optimize away
8//! - **Memory locking** — `mlock`/`VirtualLock` to prevent secrets from being written to swap
9//! - **Constant-time comparison** — timing side-channel resistant equality checks for secrets
10//! - **Compile-time guarded regions** — const-generic memory regions with type-level size enforcement
11//! - **`no_std` compatible** — core primitives work without an allocator
12//! - **Zero dependencies** — no transitive dependency surface to audit
13//!
14//! ## Quick start
15//!
16//! ```rust
17//! use memguard_rs::Secret;
18//!
19//! let mut key = Secret::new([0u8; 32]);
20//!
21//! // Access the secret only within a closure — it's not exposed outside
22//! key.expose(|k| {
23//! assert_eq!(k.len(), 32);
24//! });
25//!
26//! // Modify in place
27//! key.expose_mut(|k| {
28//! k[0] = 0xFF;
29//! });
30//!
31//! // When `key` goes out of scope, its memory is zeroized via volatile writes
32//! ```
33
34#![cfg_attr(not(feature = "std"), no_std)]
35#![cfg_attr(docsrs, feature(doc_cfg))]
36
37#[cfg(feature = "alloc")]
38extern crate alloc;
39
40pub mod cmp;
41pub mod error;
42pub mod guard;
43pub mod mlock;
44pub mod secret;
45pub mod zeroize;
46
47pub use cmp::{ct_eq, ct_select};
48pub use error::{Error, Result};
49pub use guard::GuardedRegion;
50pub use secret::Secret;
51pub use zeroize::Zeroize;