4 comments

  • voodooEntity2 hours ago
    Ok, i kinda get the idea, and with some modification it might be quite handy - but i wonder why its deemed like an &quot;unsolvable&quot; issue right now.<p>It may sound naive, but packages which include data like said session related or any other that should not persist (until the next Global GC) - why don&#x27;t you just scramble their value before ending your current action?<p>And dont get me wrong - yes that implies extra computation yada yada - but until a a solution is practical and builtin - i&#x27;d just recommend to scramble such variables with new data so no matter how long it will persist, a dump would just return your &quot;random&quot; scramble and nothing actually relevant.
    • willahmad2 hours ago
      without language level support, it makes code look like a mess.<p>Imagine, 3 level nesting calls where each calls another 3 methods, we are talking about 28 functions each with couple of variables, of course you can still clean them up, but imagine how clean code will look if you don&#x27;t have to.<p>Just like garbage collection, you can free up memory yourself, but someone forgot something and we have either memory leak or security issues.
      • HendrikHensen1 hour ago
        With good helpers, it could become something as simple as<p><pre><code> key := make([]byte, 32) defer scramble(&amp;key) &#x2F;&#x2F; do all the secret stuff </code></pre> Unless I don&#x27;t understand the problem correctly.
        • kbolino49 minutes ago
          There are two main reasons why this approach isn&#x27;t sufficient at a technical level, which are brought up by comments on the original proposal: <a href="https:&#x2F;&#x2F;github.com&#x2F;golang&#x2F;go&#x2F;issues&#x2F;21865" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;golang&#x2F;go&#x2F;issues&#x2F;21865</a><p>1) You are almost certainly going to be passing that key material to some other functions, and those functions may allocate and copy your data around; while core crypto operations could probably be identified and given special protection in their own right, this still creates a hole for &quot;helper&quot; functions that sit in the middle<p>2) The compiler can always keep some data in registers, and most Go code can be interrupted at any time, with the registers of the running goroutine copied to somewhere in memory temporarily; this is beyond your control and cannot be patched up after the fact by you even once control returns to your goroutine<p>So, even with your approach, (2) is a pretty serious and fundamental issue, and (1) is a pretty serious but mostly ergonomic issue. The two APIs also illustrate a basic difference in posture: secret.Do wipes <i>everything</i> except what you intentionally preserve beyond its scope, while scramble wipes only what you think it is important to wipe.
        • voodooEntity1 hour ago
          Yep thats what i had in mind
          • ok12345615 minutes ago
            This proposal is worse because all the valuable regions of code will be clearly annotated for static analysis, either explicitly via a library&#x2F;function call, or heuristically using the same boilerplate or fences.
      • compsciphd2 hours ago
        I could imagine code that did something like this for primatives<p><pre><code> secretStash := NewSecretStash() pString := secretStash.NewString() .... .... secretStash.Thrash() </code></pre> yes, you now have to deal in pointers, but that&#x27;s not too ugly, and everything is stored in secretStash so can iterate over all the types it supports and thrash them to make them unusable, even without the gc running.
        • voodooEntity1 hour ago
          Thats even better than what i had in mind but agree also a good way to just scrumble stuff unusable ++
    • skywhopper36 minutes ago
      Hard to understand what you’re asking. This <i>is</i> the solution that will practical and built-in. This is a summary of a new feature coming to Go’s runtime in 1.26.
  • dpifke3 days ago
    Related: <a href="https:&#x2F;&#x2F;pkg.go.dev&#x2F;crypto&#x2F;subtle#WithDataIndependentTiming" rel="nofollow">https:&#x2F;&#x2F;pkg.go.dev&#x2F;crypto&#x2F;subtle#WithDataIndependentTiming</a> (added in 1.25)<p>And an in-progress proposal to make these various &quot;bubble&quot; functions have consistent semantics: <a href="https:&#x2F;&#x2F;github.com&#x2F;golang&#x2F;go&#x2F;issues&#x2F;76477" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;golang&#x2F;go&#x2F;issues&#x2F;76477</a><p>(As an aside, the linked blog series is great, but if you&#x27;re interested in new Go features, I&#x27;ve found it really helpful to also subscribe to <a href="https:&#x2F;&#x2F;go.dev&#x2F;issue&#x2F;33502" rel="nofollow">https:&#x2F;&#x2F;go.dev&#x2F;issue&#x2F;33502</a> to get the weekly proposal updates straight from the source. Reading the debates on some of these proposals provides a huge level of insight into the evolution of Go.)
  • fsmv3 days ago
    One thing that makes me unsure about this proposal is the silent downgrading on unsupported platforms. People might think they&#x27;re safe when they&#x27;re not.<p>Go has the best support for cryptography of any language
    • fastest9633 days ago
      I&#x27;m not sure there&#x27;s a realistic alternative. If you need to generate a key then it has to happen somehow on unsupported platforms. You can check Enabled() if you need to know and intend to do something different but I assume most of the time you run the same function either way you&#x27;d just prefer to opt into secret mode if it&#x27;s available.
      • kbolino1 hour ago
        This is not what secret.Enabled() means. But it probably illustrates that the function needs to be renamed already. Here&#x27;s what the doc comment says:<p><pre><code> &#x2F;&#x2F; Enabled reports whether Do appears anywhere on the call stack. </code></pre> In other words, it is just a way of checking that you are indeed running inside the context of <i>some</i> secret.Do call; it doesn&#x27;t guarantee that secret.Do is actually offering the protection you may desire.
      • awithrow3 days ago
        Why not just panic and make it obvious?
        • kbolino1 hour ago
          One of the goals here is to make it easy to identify <i>existing</i> code which <i>would benefit from</i> this protection and separate that code from the rest. That code is going to run <i>anyway</i>, it already does so today.
    • samdoesnothing3 days ago
      Does it? I&#x27;m not disputing you, I&#x27;m curious why you think so.
      • pants23 days ago
        Not OP, but Go has some major advantages in cryptography:<p>1. Well-supported standard libraries generally written by Google<p>2. Major projects like Vault and K8s that use those implementations and publish new stuff<p>3. Primary client language for many blockchains, bringing cryptography contributions from the likes of Ethereum Foundation, Tendermint, Algorand, ZK rollups, etc
    • oncallthrow3 hours ago
      Meh, this is a defence in depth measure anyway<p>Edit: also, the supported platforms are ARM and x86. If your code isn’t running on one of those platforms, you probably know what you’re doing.
      • ctoth2 hours ago
        <i>Linux</i><p>Windows and MacOS?<p>Go is supposed to be cross-platform. I guess it&#x27;s cross-platform until it isn&#x27;t, and will silently change the semantics of security-critical operations (yes, every library builder will definitely remember to check if it&#x27;s enabled.)
      • hypeatei2 hours ago
        &gt; Meh, this is a defence in depth measure<p>Which is <i>exactly why</i> it should fail explicitly on unsupported platforms unless the developer says otherwise. I&#x27;m not sure how Go developers make things obvious, but presumably you have an ugly method or configuration option like:<p><pre><code> dangerousAllowSecretsToLeak() </code></pre> ...for when a developer understands the risk and doesn&#x27;t want to panic.
        • kbolino1 hour ago
          This is a sharp-edged tool guarded behind an experimental flag. You are not meant to use it unless you want to participate in the experiment. Objections like this and the other one (&quot;check if it&#x27;s enabled&quot; -- you can&#x27;t, that&#x27;s not what secret.Enabled() means) illustrate that this API may still need further evolution, which it won&#x27;t get if it&#x27;s never available to experiment with.
  • maxloh3 hours ago
    &gt; The new runtime&#x2F;secret package lets you run a function in secret mode. After the function finishes, it immediately erases (zeroes out) the registers and stack it used.<p>I don&#x27;t understand. Why do you need it in a garbage-collected language?<p>My impression was that you are not able to access any register in these language. It is handled by the compiler instead.
    • jerf2 hours ago
      This is about minimizing attack surface. Not only could secrets be leaked by hacking the OS process somehow to perform arbitrary reads on the memory space and send keys somewhere, they could also be leaked with root access to the machine running the process, root access to the virtualization layer, via other things like rowhammering potentially from an untrusted process in an entirely different virtual context running on the same machine, and at the really high end, attacks where the government agents siezing your machine physically freeze your RAM (that is, reduce the physical temperature of your RAM to very low temperatures) when they confiscate your machine and read it out later. (I don&#x27;t know if that is still possible with modern RAM, but even if it isn&#x27;t I wouldn&#x27;t care to bet much on the proposition that they don&#x27;t have some other way to read RAM contents out if they really, really want to.) This isn&#x27;t even intended as a complete list of the possibilities, just more than enough to justify the idea that in very high security environments there&#x27;s a variety of threats that come from leaving things in RAM longer than you absolutely need to. You can&#x27;t avoid having things in RAM to operate on them but you can ensure they are as transient as possible to minimize the attack window.<p>If you are concerned about secrets being zeroed out in almost any language, you need some sort of support for it. Non-GC&#x27;d languages are prone to optimize away zeroing out of memory before deallocation, because under normal circumstances a write to a value just before deallocation that is never effectfully read can be dropped without visible consequence to the rest of the program. And as compilers get smarter it can be harder to fool them with code, like, simply reading afterwards with no further visible effect might have been enough to fool 20th century compilers but nowadays I wouldn&#x27;t count on my compiler being that stupid.<p>There are also plenty of languages where you may want to use values that are immutable within the context of the language, so there isn&#x27;t even a way to express &quot;let&#x27;s zero out this RAM&quot;.<p>Basically, if you don&#x27;t build this in as a language feature, you have a whole lot of pressures constantly pushing you in the other direction, because why wouldn&#x27;t you want to avoid the cost of zeroing memory if you can? All kinds of reasons to try to avoid that.
    • er4hn3 hours ago
      In theory it prevents failures of the allocator that would allow reading uninitialized memory, which isn&#x27;t really a thing in Go.<p>In practice it provides a straightforward path to complying with government crypto certification requirements like FIPS 140 that were written with languages in mind where this is an issue.
    • vlovich12334 minutes ago
      Go is not a memory safe language. Even in memory safe languages, memory safety vulnerabilities can exist. Such vulnerabilities can be used to hijack your process into running untrusted code. Or as others point out sibling processes could attack yours. This underlying principle is defense in depth - you make add another layer of protection that has to be bypassed to achieve an exploit. All the chains combined raise the expense of hacking a system.
      • tptacek22 minutes ago
        Respectfully, this has become a message board canard. Go is absolutely a memory safe language. The problem is that &quot;memory safe&quot;, in its most common usage, is a term of art, meaning &quot;resilient against memory corruption exploits stemming from bounds checking, pointer provenance, uninitialized variables, type confusion and memory lifecycle issues&quot;. To say that Go isn&#x27;t memory safe under that definition is a &quot;big if true&quot; claim, as it implies that many other mainstream languages commonly regarded as memory safe aren&#x27;t.<p>Since &quot;safety&quot; is an encompassing term, it&#x27;s easy to find more rigorous definitions of the term that Go would flunk; for instance, it relies on explicit synchronization for shared memory variables. People aren&#x27;t wrong for calling out that other languages have stronger <i>correctness</i> stories, especially regarding concurrency. But they are wrong for extending those claims to &quot;Go isn&#x27;t memory safe&quot;.<p><a href="https:&#x2F;&#x2F;www.memorysafety.org&#x2F;docs&#x2F;memory-safety&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.memorysafety.org&#x2F;docs&#x2F;memory-safety&#x2F;</a>
    • kbolino1 hour ago
      Go has both assembly language and unsafe pointer operations available. While any uses of these more advanced techniques should be vetted before going to production, they are obviously able to break out of any sandboxing that you might otherwise think a garbage collector provides.<p>And any language which can call C code that is resident in the same virtual memory space can have its own restrictions bypassed by said C code. This even applies to more restrictive runtimes like the JVM or Python.
    • kittywantsbacon2 hours ago
      This would potentially protect against other process reading memory via some system compromise - they would be able to get new secrets but not old ones.