#private-key #memory #security #constant-time #memory-protection #sensitive #data

secure-string

A data type suitable for storing sensitive information such as passwords and private keys in memory, featuring constant time equality, mlock and zeroing out

3 releases (breaking)

0.3.0 Sep 30, 2023
0.2.0 Sep 30, 2023
0.1.0 Sep 30, 2023

#1691 in Cryptography

Download history 14/week @ 2024-05-20 214/week @ 2024-05-27 347/week @ 2024-06-03 244/week @ 2024-06-10 255/week @ 2024-06-17 324/week @ 2024-06-24 408/week @ 2024-07-01 355/week @ 2024-07-08 336/week @ 2024-07-15 211/week @ 2024-07-22 225/week @ 2024-07-29 337/week @ 2024-08-05 475/week @ 2024-08-12 390/week @ 2024-08-19 443/week @ 2024-08-26 314/week @ 2024-09-02

1,686 downloads per month
Used in 4 crates (3 directly)

Unlicense

37KB
777 lines

Secure String

crates.io crates.io API Docs unlicense

A Rust library that implements a data type (wrapper around Vec<u8> and other types) suitable for storing sensitive information such as passwords and private keys in memory. Inspired by Haskell securemem and .NET SecureString.

Featuring:

  • Supports various secure datatypes: SecureVec, SecureBytes, SecureArray, SecureString, SecureBox
  • automatically zeroing out in the destructor using zeroize
  • mlock and madvise protection if possible
  • formatting as ***SECRET*** to prevent leaking into logs
  • (optionally) de/serializable into anything Serde supports as a byte string
  • (optionally) compile-time checked preconditions for the public unsafe API

This crate is based on secstr by Val Packett, but modified to be a bit more rusty and versatile.

Usage

use secure_string::*;

let pw = SecureString::from("correct horse battery staple");

// Compared in constant time:
// (Obviously, you should store hashes in real apps, not plaintext passwords)
let are_pws_equal = pw == SecureString::from("correct horse battery staple".to_string()); // true

// Formatting, printing without leaking secrets into logs
let text_to_print = format!("{}", SecureString::from("hello")); // "***SECRET***"

// Clearing memory
// THIS IS DONE AUTOMATICALLY IN THE DESTRUCTOR
// (but you can force it)
let mut my_sec = SecureString::from("hello");
my_sec.zero_out();
// (It also sets the length to 0)
assert_eq!(my_sec.unsecure(), "");

Be careful with SecureString::from: if you have a borrowed string, it will be copied.
Use SecureString::new if you have a Vec<u8>.

License

This is free and unencumbered software released into the public domain.
For more information, please refer to the UNLICENSE file or unlicense.org.

Dependencies

~245KB