encryption

func DefaultPHIFields ¶

func DefaultPHIFields() []string

DefaultPHIFields returns commonly required encrypted fields for compliance.

func DeriveKey ¶

func DeriveKey(password, salt []byte, iterations int) []byte

DeriveKey derives a 32-byte AES-256 key from password and salt using PBKDF2-HMAC-SHA256.

This is a low-level function for custom key derivation scenarios. For most use cases, prefer NewEncryptorWithPassword() which handles key derivation and management automatically.

Parameters ¶

password: User password as bytes (convert string with []byte(password)) salt: Unique salt per installation (32 bytes recommended) iterations: PBKDF2 iteration count (0 = default 600,000)

Security Considerations ¶

Iteration Count:

• OWASP 2023: 600,000 minimum for PBKDF2-HMAC-SHA256
• NIST SP 800-132: 10,000 minimum (outdated, use OWASP)
• Higher = more secure but slower (~100ms is acceptable)

Salt Requirements:

• MUST be cryptographically random (use GenerateSalt())
• MUST be unique per installation/user
• 32 bytes (256 bits) recommended
• Store securely but doesn't need to be secret

Password Strength:

• Minimum 20 characters recommended
• Mix uppercase, lowercase, digits, symbols
• Avoid common passwords and patterns

Performance Characteristics ¶

Timing (600,000 iterations):

• ~100-200ms on modern CPUs
• ~50-100ms on high-end server CPUs
• Intentionally slow to prevent brute-force

Memory:

• Minimal: ~1KB during derivation
• Returns 32-byte key

Thread Safety ¶

DeriveKey is stateless and thread-safe:

• Safe to call from multiple goroutines
• No shared state or locks

Example (Basic Usage):

password := []byte("SecurePassword123!")
salt, _ := encryption.GenerateSalt()

// Derive with default iterations (600,000)
key := encryption.DeriveKey(password, salt, 0)
fmt.Printf("Derived key: %x\n", key)

// Store salt for later use
os.WriteFile("salt.key", salt, 0600)

Example (Custom Iterations):

// High-security: 1 million iterations (~200ms)
key := encryption.DeriveKey(password, salt, 1000000)

// Fast iteration for dev (not recommended for production)
devKey := encryption.DeriveKey(password, salt, 10000)

Example (Multi-Tenant Key Derivation):

// Derive tenant-specific keys from master password
func deriveTenantKey(masterPassword, tenantID string) []byte {
	// Generate deterministic salt from tenant ID
	h := sha256.New()
	h.Write([]byte("nornicdb-tenant"))
	h.Write([]byte(tenantID))
	salt := h.Sum(nil)

	return encryption.DeriveKey([]byte(masterPassword), salt, 600000)
}

tenant1Key := deriveTenantKey("MasterPass123!", "tenant-001")
tenant2Key := deriveTenantKey("MasterPass123!", "tenant-002")
// Different keys despite same password

Example (Key Stretching for Weak Passwords):

// User provides weak password
weakPassword := []byte("password")
salt := mustLoadSalt()

// Extra iterations to compensate
key := encryption.DeriveKey(weakPassword, salt, 2000000) // 2M iterations

// Better: Enforce strong passwords at input
if len(password) < 20 {
	return errors.New("password too short")
}

ELI12 Explanation ¶

Think of DeriveKey as a special blender that makes smoothies:

You put in:

• Your password (like fruit)
• A salt (like ice - makes it unique)
• How many times to blend (iterations)

The blender:

1. Mixes everything together
2. Blends it thousands of times (600,000!)
3. Produces exactly 32 bytes of perfect key material

Why blend so many times?

• It takes ~100ms for you (barely noticeable)
• An attacker trying every password takes 100ms per guess
• Guessing billions of passwords would take centuries!

Why use salt?

• Two people with "password123" get different keys
• Attackers can't use pre-made lists (rainbow tables)
• Each installation is unique and independent

The output is always exactly 32 bytes (256 bits), perfect for AES-256 encryption!

func GenerateKey ¶

func GenerateKey() ([]byte, error)

GenerateKey generates a cryptographically secure random 32-byte AES-256 key.

This function uses crypto/rand to generate high-quality random keys suitable for production encryption. The key can be used directly with KeyManager or Encryptor.

Security Features ¶

Randomness Source:

• Uses crypto/rand (OS-provided CSPRNG)
• /dev/urandom on Unix (non-blocking, cryptographically secure)
• CryptGenRandom on Windows
• No deterministic generation or weak PRNGs

Key Properties:

• 256 bits (32 bytes) for AES-256
• Each bit has 50% probability of 0 or 1
• 2^256 possible keys (~10^77 combinations)
• Brute force would take longer than universe's age

Performance Characteristics ¶

Generation Time:

• <1µs on modern hardware
• OS kernel overhead dominates
• Can generate millions per second

Memory:

• Allocates 32 bytes
• No persistent state
• Garbage collected normally

Thread Safety ¶

crypto/rand.Read is thread-safe:

• Safe to call from multiple goroutines
• No locking required in application code
• OS handles concurrency

Example (Basic Usage):

// Generate a new key
key, err := encryption.GenerateKey()
if err != nil {
	log.Fatalf("Key generation failed: %v", err)
}

fmt.Printf("Generated key: %x\n", key)
// Output: Generated key: 3f7a2b9c... (32 bytes hex)

// Use with KeyManager
km := encryption.NewKeyManager(encryption.DefaultConfig())
km.AddKey(&encryption.Key{
	ID:       1,
	Material: key,
	Active:   true,
})

Example (Production Setup):

// Generate and store master key (do once!)
key, err := encryption.GenerateKey()
if err != nil {
	log.Fatal(err)
}

// Store in secure location
// Option 1: KMS (recommended)
storeInKMS("nornicdb-master-key", key)

// Option 2: Encrypted file
encrypted := encryptWithHSM(key)
os.WriteFile("/etc/nornicdb/master.key", encrypted, 0600)

// Option 3: Environment variable (Base64)
encoded := base64.StdEncoding.EncodeToString(key)
os.Setenv("NORNICDB_KEY", encoded)

// Securely wipe from memory
encryption.SecureWipe(key)

Example (Key Rotation):

// Generate new key for rotation
newKey, err := encryption.GenerateKey()
if err != nil {
	return err
}

// Add to key manager
km.AddKey(&encryption.Key{
	ID:        km.KeyCount() + 1,
	Material:  newKey,
	CreatedAt: time.Now(),
	Active:    true,
})

log.Printf("Rotated to new key v%d", km.KeyCount())

Example (Multi-Environment Key Generation):

// Generate different keys per environment
func generateEnvironmentKeys() map[string][]byte {
	keys := make(map[string][]byte)

	for _, env := range []string{"dev", "staging", "prod"} {
		key, err := encryption.GenerateKey()
		if err != nil {
			log.Fatalf("Failed to generate key for %s: %v", env, err)
		}
		keys[env] = key

		// Store securely
		filename := fmt.Sprintf("/etc/nornicdb/%s.key", env)
		os.WriteFile(filename, key, 0600)
	}

	return keys
}

Example (Batch Key Generation):

// Generate multiple keys for multi-tenant setup
func generateTenantKeys(tenantIDs []string) (map[string][]byte, error) {
	keys := make(map[string][]byte)

	for _, tenantID := range tenantIDs {
		key, err := encryption.GenerateKey()
		if err != nil {
			return nil, fmt.Errorf("tenant %s: %w", tenantID, err)
		}
		keys[tenantID] = key
	}

	return keys, nil
}

tenants := []string{"acme-corp", "contoso", "fabrikam"}
keys, _ := generateTenantKeys(tenants)

Example (Key Generation with Backup):

// Generate key and create encrypted backup
key, err := encryption.GenerateKey()
if err != nil {
	return err
}

// Store primary
storeInKMS("primary-key", key)

// Create encrypted backup
backupKey, _ := encryption.GenerateKey()
backup := encryptKey(key, backupKey)
storeInS3("key-backup", backup)

// Store backup key separately
storeInVault("backup-key", backupKey)

ELI12 Explanation ¶

GenerateKey is like rolling a perfect 256-sided die 8 times:

Regular die (6 sides):

• Rolling once gives you 6 possibilities
• Easy to guess if you try a few times

Our crypto die (256 sides):

• Rolling once gives you 256 possibilities
• Rolling 8 times gives you 256^8 possibilities
• That's 18,446,744,073,709,551,616 combinations (18 quintillion!)

But we actually use 32 bytes (not 8):

• That's 256^32 possible keys
• More combinations than atoms in the universe!
• Impossible to guess, even with all computers on Earth

The randomness comes from your computer's special random generator:

• Uses hardware events (mouse movements, keyboard timing, network noise)
• Cryptographically secure (no patterns)
• Each key is completely unique and unpredictable

This is why it's safe: even if an attacker knows you used this function, they have no way to guess which of the 2^256 possible keys you got!

func GenerateSalt ¶

func GenerateSalt() ([]byte, error)

GenerateSalt generates a cryptographically secure random 32-byte salt for key derivation.

This function generates a unique salt for use with DeriveKey() or NewEncryptorWithPassword(). The salt should be generated once per installation and stored securely (but doesn't need to be kept secret).

Salt Purpose ¶

Prevents Rainbow Table Attacks:

• Pre-computed hash tables become useless
• Each installation has unique derived keys
• Same password → different keys with different salts

Uniqueness:

• Each installation should have unique salt
• Multi-tenant: Each tenant should have unique salt
• Users sharing password won't have same derived key

Security Properties ¶

Randomness:

• Uses crypto/rand (same as GenerateKey)
• 256 bits of entropy (32 bytes)
• No predictable patterns

Storage:

• Salt does NOT need to be secret
• Can store in config files (restricted permissions)
• Should be backed up with database
• Never reuse across installations

Performance Characteristics ¶

Generation Time:

• <1µs (identical to GenerateKey)
• One-time operation per installation

Memory:

• 32 bytes allocated
• Persist in config or database

Thread Safety ¶

crypto/rand.Read is thread-safe:

• Safe to call from multiple goroutines
• No synchronization needed

Example (Initial Setup):

// Generate salt during installation
salt, err := encryption.GenerateSalt()
if err != nil {
	log.Fatalf("Failed to generate salt: %v", err)
}

// Store in config file
config := map[string]string{
	"salt": hex.EncodeToString(salt),
}
json.WriteFile("/etc/nornicdb/config.json", config, 0600)

// Or store in environment
encoded := base64.StdEncoding.EncodeToString(salt)
os.Setenv("NORNICDB_SALT", encoded)

Example (Production Setup with Persistence):

// Generate once during first run
saltFile := "/etc/nornicdb/salt.key"

var salt []byte
if _, err := os.Stat(saltFile); os.IsNotExist(err) {
	// First run: generate and save
	salt, err = encryption.GenerateSalt()
	if err != nil {
		log.Fatal(err)
	}

	err = os.WriteFile(saltFile, salt, 0600)
	if err != nil {
		log.Fatalf("Failed to save salt: %v", err)
	}

	log.Println("Generated new salt")
} else {
	// Subsequent runs: load existing
	salt, err = os.ReadFile(saltFile)
	if err != nil {
		log.Fatalf("Failed to load salt: %v", err)
	}

	log.Println("Loaded existing salt")
}

// Use with key derivation
password := os.Getenv("MASTER_PASSWORD")
key := encryption.DeriveKey([]byte(password), salt, 600000)

Example (Multi-Tenant Salt Management):

// Generate unique salt per tenant
type TenantConfig struct {
	ID   string
	Salt []byte
}

func createTenant(tenantID string) (*TenantConfig, error) {
	salt, err := encryption.GenerateSalt()
	if err != nil {
		return nil, err
	}

	config := &TenantConfig{
		ID:   tenantID,
		Salt: salt,
	}

	// Store in database
	db.Save(config)

	return config, nil
}

// Each tenant gets isolated encryption
tenant1, _ := createTenant("acme-corp")
tenant2, _ := createTenant("contoso")

// Derive tenant-specific keys
masterPassword := os.Getenv("MASTER_PASSWORD")
key1 := encryption.DeriveKey([]byte(masterPassword), tenant1.Salt, 600000)
key2 := encryption.DeriveKey([]byte(masterPassword), tenant2.Salt, 600000)
// Different keys despite same password!

Example (Database-Backed Salt):

// Store salt in database for multi-instance deployments
func getOrCreateSalt(db *sql.DB) ([]byte, error) {
	// Try to load existing
	var salt []byte
	err := db.QueryRow("SELECT salt FROM config WHERE key = 'master_salt'").Scan(&salt)

	if err == sql.ErrNoRows {
		// First run: generate and save
		salt, err = encryption.GenerateSalt()
		if err != nil {
			return nil, err
		}

		_, err = db.Exec("INSERT INTO config (key, salt) VALUES (?, ?)", "master_salt", salt)
		if err != nil {
			return nil, err
		}

		log.Println("Generated and stored new salt")
	} else if err != nil {
		return nil, err
	}

	return salt, nil
}

salt, err := getOrCreateSalt(db)
// All instances use same salt (important for key derivation)

Example (Salt Backup and Recovery):

// Generate with backup strategy
salt, err := encryption.GenerateSalt()
if err != nil {
	return err
}

// Store primary
os.WriteFile("/etc/nornicdb/salt.key", salt, 0600)

// Store backup in different location
os.WriteFile("/var/backup/nornicdb-salt.key", salt, 0600)

// Store in secrets manager
storeInSecretsManager("nornicdb-salt", salt)

// Print for manual backup (Base64)
encoded := base64.StdEncoding.EncodeToString(salt)
fmt.Printf("BACKUP THIS SALT: %s\n", encoded)

ELI12 Explanation ¶

Think of salt like the secret ingredient in your grandma's cookie recipe:

Without salt:

• Everyone using "password123" gets the same key
• Hackers can make a list: "password123" → key A, "qwerty" → key B
• They use this list to crack millions of passwords instantly (rainbow table)

With salt:

• Your salt is like adding "secret ingredient #847392"
• Same "password123" + your salt = different key than everyone else
• Hackers' pre-made lists are useless - they'd need a list for EVERY salt
• Your installation is unique and independent

Important:

• Generate once and save it (like writing down the recipe)
• The salt doesn't need to be secret (everyone knows salt is salt)
• But you need the SAME salt every time (can't change the recipe!)
• Each installation/tenant should have their own unique salt

This makes password cracking go from "instant with pre-made lists" to "must try every password individually for your specific installation"!

func HashKey ¶

func HashKey(key []byte) string

HashKey returns a SHA-256 hash of the key material for logging and identification.

This function creates a non-reversible fingerprint of a key that can be safely logged or displayed without exposing the actual key material. The hash can be used to identify which key is being used without revealing sensitive data.

Security Properties ¶

Non-Reversible:

• SHA-256 is cryptographically secure one-way function
• Cannot derive original key from hash
• Safe to log in audit trails

Collision Resistance:

• 128-bit output (16 bytes) from 256-bit hash
• Probability of collision: ~1 in 2^128
• Practically impossible with small key counts

Deterministic:

• Same key always produces same hash
• Useful for key identification and tracking

Use Cases ¶

Logging:

• Audit trails without exposing keys
• Key rotation tracking
• Debugging encryption issues

Key Identification:

• Verify correct key is loaded
• Compare keys without exposing material
• Track key usage across systems

NOT for:

• Key storage (use the key directly)
• Password hashing (use bcrypt/argon2)
• Authentication (use secure comparison)

Performance Characteristics ¶

Hashing Time:

• <1µs for 32-byte key
• SHA-256 is highly optimized

Memory:

• 32-byte hex string output
• No persistent allocations

Thread Safety ¶

SHA-256 is stateless and thread-safe:

• Safe to call from multiple goroutines
• No shared state

Example (Basic Usage):

key, _ := encryption.GenerateKey()
hash := encryption.HashKey(key)

fmt.Printf("Key fingerprint: %s\n", hash)
// Output: Key fingerprint: 3f7a2b9c1d4e5f6a...

// Safe to log
log.Printf("Loaded key with hash %s", hash)

Example (Key Rotation Tracking):

// Track key rotation in audit log
func rotateKey(km *encryption.KeyManager) error {
	old, _ := km.CurrentKey()
	oldHash := encryption.HashKey(old.Material)

	newKey, err := km.RotateKey()
	if err != nil {
		return err
	}

	newHash := encryption.HashKey(newKey.Material)

	// Log rotation event
	auditLog.Printf("Key rotated: %s → %s", oldHash, newHash)
	auditLog.Printf("Old key v%d retired, new key v%d active", old.ID, newKey.ID)

	return nil
}

Example (Key Verification):

// Verify loaded key matches expected
expectedHash := "3f7a2b9c1d4e5f6a" // From secure config

key, err := loadKeyFromKMS()
if err != nil {
	return err
}

actualHash := encryption.HashKey(key)
if actualHash != expectedHash {
	return fmt.Errorf("key verification failed: got %s, want %s", actualHash, expectedHash)
}

log.Printf("Key verified: %s", actualHash)

Example (Multi-Key Management):

// Track multiple keys by hash
type KeyInfo struct {
	Version int
	Hash    string
	Loaded  time.Time
}

keyRegistry := make(map[string]KeyInfo)

func registerKey(version int, material []byte) {
	hash := encryption.HashKey(material)
	keyRegistry[hash] = KeyInfo{
		Version: version,
		Hash:    hash,
		Loaded:  time.Now(),
	}

	log.Printf("Registered key v%d: %s", version, hash)
}

Example (Debugging Encryption Issues):

// Compare keys across environments
prodKey := loadKey("production")
devKey := loadKey("development")

prodHash := encryption.HashKey(prodKey)
devHash := encryption.HashKey(devKey)

if prodHash == devHash {
	log.Warning("Production and dev using same key! (SECURITY RISK)")
} else {
	log.Info("Production key: %s", prodHash)
	log.Info("Dev key: %s", devHash)
}

Example (Compliance Audit Trail):

// Log key usage for compliance
func encryptPHI(data string, enc *encryption.Encryptor) (string, error) {
	// Get current key
	km := enc.KeyManager()
	key, _ := km.CurrentKey()
	keyHash := encryption.HashKey(key.Material)

	// Encrypt
	ciphertext, err := enc.EncryptString(data)
	if err != nil {
		return "", err
	}

	// Audit log (HIPAA §164.312(b))
	auditLog.Printf("PHI encrypted with key %s (v%d) at %s",
		keyHash, key.ID, time.Now().Format(time.RFC3339))

	return ciphertext, nil
}

ELI12 Explanation ¶

Think of HashKey like making a fingerprint of your actual key:

Your encryption key:

• 32 bytes of secret data
• Must NEVER be shown or logged
• Like the actual key to your house

The hash (fingerprint):

• 16 bytes that identify the key
• Can be safely shown and logged
• Like a photo of your key - you can show people the photo without worrying they'll copy your key

Why this is safe:

• You can't recreate the key from its hash (one-way function)
• Each key has a unique hash (like unique fingerprints)
• Perfect for logs: "Used key abc123" instead of showing real key

Real-world example:

• Your key: "3f7a2b9c..." (32 bytes, secret)
• The hash: "d4e5f6a7..." (16 bytes, safe to show)
• Attacker sees hash: Can't recover key (SHA-256 is unbreakable)
• You see hash in logs: "Oh, that's key version 5!"

This lets you track which key is being used without ever exposing the actual key material in logs or debug output!

func SecureWipe ¶

func SecureWipe(data []byte)

SecureWipe zeros out sensitive data in memory to prevent recovery.

This function overwrites sensitive data (keys, passwords, plaintexts) with zeros to reduce the window of exposure in memory. While Go's garbage collector will eventually reclaim the memory, SecureWipe provides immediate erasure.

Security Benefits ¶

Memory Exposure:

• Reduces time sensitive data remains in memory
• Prevents recovery from memory dumps
• Defense against cold boot attacks
• Reduces process memory scanning risk

Compliance:

• GDPR Art.32: Appropriate security measures
• HIPAA §164.312(a)(1): Technical safeguards
• PCI-DSS 3.2.1: Render PAN unrecoverable

Limitations ¶

Not a Silver Bullet:

• Go compiler may optimize away the writes
• Memory may be swapped to disk before wiping
• Copies may exist elsewhere in memory
• GC may have moved data before wipe

Best Practices:

• Wipe immediately after use
• Minimize sensitive data lifetime
• Use mlock() to prevent swapping (if available)
• Disable core dumps in production

Performance Characteristics ¶

Execution Time:

• O(n) where n = bytes to wipe
• ~1-2 CPU cycles per byte
• 32-byte key: ~30-60 nanoseconds

Memory:

• No allocations
• Operates in-place

Thread Safety ¶

Operates on caller's data:

• No shared state
• Caller must ensure exclusive access
• Not safe to wipe data in use by other goroutines

Example (Basic Usage):

// Generate sensitive data
password := []byte("SuperSecret123!")
key := encryption.DeriveKey(password, salt, 600000)

// Use key...
enc := encryption.NewEncryptor(km, true)

// Immediately wipe after use
encryption.SecureWipe(password)
encryption.SecureWipe(key)

// Memory now contains zeros
fmt.Printf("%x\n", password) // "000000000000000000000000000000"

Example (Key Loading from KMS):

func loadKeyFromKMS(keyID string) (*encryption.Key, error) {
	// Fetch from KMS
	resp, err := kmsClient.Decrypt(keyID)
	if err != nil {
		return nil, err
	}

	// Use the key material
	key := &encryption.Key{
		ID:       1,
		Material: resp.Plaintext,
		Active:   true,
	}

	// Wipe plaintext from KMS response
	defer encryption.SecureWipe(resp.Plaintext)

	return key, nil
}

Example (Password Handling):

func authenticateUser(username, password string) error {
	// Convert to bytes for secure wiping
	passBytes := []byte(password)
	defer encryption.SecureWipe(passBytes)

	// Load user's password hash
	storedHash := db.GetPasswordHash(username)

	// Compare
	err := bcrypt.CompareHashAndPassword(storedHash, passBytes)

	// passBytes wiped on function exit
	return err
}

Example (Decrypted PHI Handling):

// Decrypt PHI and wipe immediately after processing
func processPHI(encrypted string, enc *encryption.Encryptor) error {
	// Decrypt
	plaintext, err := enc.Decrypt(encrypted)
	if err != nil {
		return err
	}
	defer encryption.SecureWipe(plaintext)

	// Process data
	result := analyzeData(plaintext)

	// plaintext wiped here (defer)
	return db.SaveResult(result)
}

Example (Batch Key Generation with Cleanup):

func generateAndStoreKeys(count int) error {
	keys := make([][]byte, count)

	// Generate keys
	for i := 0; i < count; i++ {
		key, err := encryption.GenerateKey()
		if err != nil {
			return err
		}
		keys[i] = key
	}

	// Store in KMS
	for i, key := range keys {
		err := kms.Store(fmt.Sprintf("key-%d", i), key)
		if err != nil {
			return err
		}

		// Wipe immediately after storage
		encryption.SecureWipe(key)
	}

	return nil
}

Example (Secure Password Prompt):

func promptForPassword() (string, error) {
	fmt.Print("Enter password: ")
	passBytes, err := term.ReadPassword(int(os.Stdin.Fd()))
	if err != nil {
		return "", err
	}
	defer encryption.SecureWipe(passBytes)

	// Derive key immediately
	key := encryption.DeriveKey(passBytes, salt, 600000)

	// Return hex-encoded (for storage)
	// Original password bytes wiped
	return hex.EncodeToString(key), nil
}

Example (Multi-Stage Wiping):

// Wipe data at multiple stages
func secureEncryptionFlow() error {
	// Stage 1: Load password
	password := []byte(os.Getenv("PASSWORD"))
	defer encryption.SecureWipe(password)

	// Stage 2: Derive key
	key := encryption.DeriveKey(password, salt, 600000)
	defer encryption.SecureWipe(key)

	// Stage 3: Load plaintext
	plaintext := []byte("sensitive data")
	defer encryption.SecureWipe(plaintext)

	// Encrypt (ciphertext can stay in memory)
	enc := encryption.NewEncryptor(km, true)
	ciphertext, err := enc.Encrypt(plaintext)

	// All sensitive data wiped on function exit
	return err
}

ELI12 Explanation ¶

Think of SecureWipe like shredding a paper document:

Without SecureWipe:

• You throw the paper in the trash
• It sits there until garbage day
• Someone could dig through the trash and read it
• In computers: sensitive data sits in memory until garbage collector runs

With SecureWipe:

• You shred the paper immediately
• The information is gone right away
• Even if someone digs through trash, they can't read it
• In computers: we overwrite memory with zeros immediately

What gets wiped:

• Passwords (after checking login)
• Encryption keys (after using them)
• Decrypted data (after processing)
• Any sensitive bytes in memory

Why this helps:

• Shorter window for memory sniffing attacks
• Protection if process memory is dumped
• Defense against cold boot attacks (freezing RAM to read it)
• Required for some compliance standards (PCI-DSS)

Important: This is defense-in-depth, not perfect security. The data existed in memory briefly, but we minimize exposure time!