Protect sensitive memory regions separately about dtls HOT 1 CLOSED

I've looked at memguard again recently, but it would be pretty invasive to use it as you end up constantly needing to interact with the memguard.Enclave. We'd have to abstract around that at the very least and be extremely careful to constantly use it correctly when dealing with any secret material.

I think I'm going to close this one for now. As it currently stands, Go's standard library doesn't do anything in particular on this front either. In most cases stdlib doesn't even bother with pointers-to-structs so there'll potentially be multiple copies of things like a TLS private key in memory when using cryto/tls etc. If the Go runtime could provide something like mmap'ing and locking an area of memory to store secrets in that would probably be a lot more feasible to support.

from dtls.