Crate soteria_rs

This crate implements a wrapper around a secret that is stored in memory.

Protected allows a program to store a encrypted secret in memory. The secret is encrypted using XChaChaPoly1305. The encryption keys are large enough to mitigate memory side channel attacks like Spectre, Meltdown, Rowhammer, and RamBleed.

There is a pre_key and a nonce each large enough to limit these attacks. The pre_key and nonce are feed into a merlin transcript to mix with other data and derive the actual encryption key. This value is wiped from memory when the dropped or decrypted.

Structs

Protected

A protected region of memory. The pre key is large to inhibit speculation and side-channel attacks like Spectre, Meltdown, Rowhammer, and RamBleed. Uses XChacha20Poly1305 to encrypt/decrypt the data in memory in place.

Unprotected

Unprotected contains the decrypted value. After Unprotected is dropped, the Protected is reengaged with new cryptographic material and the value is encrypted again

Constants

DEFAULT_BUF_SIZE

The default BUFFER size for the prekey and nonce in memory. This is large enough to inhibit speculation and side-channel attacks. Consumers should not go much smaller than this.