Allocate AWSCredentials secret key and signing key through a dedicated memory system

src/aws-cpp-sdk-core/include/aws/core/Aws.h

@@ -61,6 +61,13 @@ struct MemoryManagementOptions {
    * at startup time.
    */
   Aws::Utils::Memory::MemorySystemInterface* memoryManager = nullptr;
+
+  /**
+   * Defaults to nullptr. If this has been set then it will be installed at startup time and used for sensitive data
+   * such as secret keys, regardless of whether custom memory management has been turned on. If this hasn't been set,
+   * sensitive data is allocated like any other data.
+   */
+  Aws::Utils::Memory::MemorySystemInterface* sensitiveMemoryManager = nullptr;
 };
 
 /**

src/aws-cpp-sdk-core/include/aws/core/auth/AWSCredentials.h

@@ -63,7 +63,7 @@ namespace Aws
              * Expiration date is set to "never expire".
              */
             AWSCredentials(const Aws::String& accessKeyId, const Aws::String& secretKey) :
-                m_accessKeyId(accessKeyId), m_secretKey(secretKey), m_expiration((std::chrono::time_point<std::chrono::system_clock>::max)())
+                m_accessKeyId(accessKeyId), m_secretKey(secretKey.data(), secretKey.size()), m_expiration((std::chrono::time_point<std::chrono::system_clock>::max)())
             {
             }
 
@@ -72,6 +72,11 @@ namespace Aws
              * Expiration date is set to "never expire".
              */
             AWSCredentials(const Aws::String& accessKeyId, const Aws::String& secretKey, const Aws::String& sessionToken) :
+                m_accessKeyId(accessKeyId), m_secretKey(secretKey.data(), secretKey.size()), m_sessionToken(sessionToken), m_expiration((std::chrono::time_point<std::chrono::system_clock>::max)())
+            {
+            }
+
+            AWSCredentials(const Aws::String& accessKeyId, const Aws::SensitiveString& secretKey, const Aws::String& sessionToken) :
                 m_accessKeyId(accessKeyId), m_secretKey(secretKey), m_sessionToken(sessionToken), m_expiration((std::chrono::time_point<std::chrono::system_clock>::max)())
             {
             }
@@ -80,7 +85,7 @@ namespace Aws
              * Initializes object with accessKeyId, secretKey, sessionToken and expiration date.
              */
             AWSCredentials(const Aws::String& accessKeyId, const Aws::String& secretKey, const Aws::String& sessionToken, Aws::Utils::DateTime expiration) :
-                m_accessKeyId(accessKeyId), m_secretKey(secretKey), m_sessionToken(sessionToken), m_expiration(expiration)
+                m_accessKeyId(accessKeyId), m_secretKey(secretKey.data(), secretKey.size()), m_sessionToken(sessionToken), m_expiration(expiration)
             {
             }
 
@@ -93,7 +98,7 @@ namespace Aws
                            Aws::Utils::DateTime expiration,
                            const Aws::String& accountId)
                 : m_accessKeyId(accessKeyId),
-                  m_secretKey(secretKey),
+                  m_secretKey(secretKey.data(), secretKey.size()),
                   m_sessionToken(sessionToken),
                   m_expiration(expiration),
                   m_accountId(accountId) {}
@@ -142,7 +147,7 @@ namespace Aws
             /**
              * Gets the underlying secret key credential
              */
-            inline const Aws::String& GetAWSSecretKey() const
+            inline const Aws::SensitiveString& GetAWSSecretKey() const
             {
                 return m_secretKey;
             }
@@ -184,7 +189,7 @@ namespace Aws
              */
             inline void SetAWSSecretKey(const Aws::String& secretKey)
             {
-                m_secretKey = secretKey;
+                m_secretKey.assign(secretKey.data(), secretKey.size());
             }
 
             /**
@@ -257,7 +262,7 @@ namespace Aws
             inline void AddUserAgentFeature(Aws::Client::UserAgentFeature feature) { m_context.AddUserAgentFeature(feature); }
         private:
             Aws::String m_accessKeyId;
-            Aws::String m_secretKey;
+            Aws::SensitiveString m_secretKey;
             Aws::String m_sessionToken;
             Aws::Utils::DateTime m_expiration;
             Aws::String m_accountId;

src/aws-cpp-sdk-core/include/aws/core/auth/signer/AWSAuthEventStreamV4Signer.h

@@ -100,14 +100,14 @@ namespace Aws
                     const Aws::String& canonicalRequestHash, const Aws::String& region,
                     const Aws::String& serviceName) const;
             Aws::Utils::ByteBuffer ComputeHash(const Aws::String& secretKey, const Aws::String& simpleDate) const;
-            Aws::Utils::ByteBuffer ComputeHash(const Aws::String& secretKey,
+            Aws::Utils::ByteBuffer ComputeHash(const Aws::SensitiveString& secretKey,
                     const Aws::String& simpleDate, const Aws::String& region, const Aws::String& serviceName) const;
             const Aws::String m_serviceName;
             const Aws::String m_region;
             mutable Utils::Threading::ReaderWriterLock m_derivedKeyLock;
             mutable Aws::Utils::ByteBuffer m_derivedKey;
             mutable Aws::String m_currentDateStr;
-            mutable Aws::String m_currentSecretKey;
+            mutable Aws::SensitiveString m_currentSecretKey;
             Aws::Vector<Aws::String> m_unsignedHeaders;
             std::shared_ptr<Auth::AWSCredentialsProvider> m_credentialsProvider;
         };

src/aws-cpp-sdk-core/include/aws/core/auth/signer/AWSAuthV4Signer.h

@@ -205,7 +205,7 @@ namespace Aws
             Aws::String GenerateStringToSign(const Aws::String& dateValue, const Aws::String& simpleDate,
                     const Aws::String& canonicalRequestHash, const Aws::String& region,
                     const Aws::String& serviceName) const;
-            Aws::Utils::ByteBuffer ComputeHash(const Aws::String& secretKey,
+            Aws::Utils::ByteBuffer ComputeHash(const Aws::SensitiveString& secretKey,
                     const Aws::String& simpleDate, const Aws::String& region, const Aws::String& serviceName) const;
             bool SignRequestWithSigV4a(Aws::Http::HttpRequest& request, const char* region, const char* serviceName,
                     bool signBody, long long expirationTimeInSeconds, Aws::Crt::Auth::SignatureType signatureType) const;
@@ -230,7 +230,7 @@ namespace Aws
             //interface can remain const.
             mutable Aws::Utils::ByteBuffer m_partialSignature;
             mutable Aws::String m_currentDateStr;
-            mutable Aws::String m_currentSecretKey;
+            mutable Aws::SensitiveString m_currentSecretKey;
             mutable Utils::Threading::ReaderWriterLock m_partialSignatureLock;
             PayloadSigningPolicy m_payloadSigningPolicy;
             bool m_urlEscapePath;

src/aws-cpp-sdk-core/include/aws/core/utils/HashingUtils.h

@@ -47,6 +47,8 @@ namespace Aws
             */
             static ByteBuffer CalculateSHA256HMAC(const ByteBuffer& toSign, const ByteBuffer& secret);
 
+            static ByteBuffer CalculateSHA256HMAC(const Aws::String& toSign, const Aws::SensitiveString& secret);
+
             /**
              * Calculates a SHA512 Hash digest (not hex encoded)
              */

src/aws-cpp-sdk-core/include/aws/core/utils/memory/AWSMemory.h

@@ -38,6 +38,21 @@ namespace Aws
              */
             AWS_CORE_API MemorySystemInterface* GetMemorySystem();
 
+            /**
+             * Installs the memory system used for sensitive data such as secret keys, regardless of USE_AWS_MEMORY_MANAGEMENT
+             */
+            AWS_CORE_API void InitializeAWSSensitiveMemorySystem(MemorySystemInterface& memorySystem);
+
+            /**
+             * Uninstalls the memory system used for sensitive data
+             */
+            AWS_CORE_API void ShutdownAWSSensitiveMemorySystem(void);
+
+            /**
+             * Get the globally installed memory system for sensitive data, if it has been installed.
+             */
+            AWS_CORE_API MemorySystemInterface* GetSensitiveMemorySystem();
+
             /**
              * Get the pointer to the SDK default memory system
              */

src/aws-cpp-sdk-core/include/aws/core/utils/memory/stl/AWSAllocator.h

@@ -98,6 +98,56 @@ namespace Aws
     template< typename T > using Allocator = std::allocator<T>;
 
 #endif // USE_AWS_MEMORY_MANAGEMENT
+
+    template <typename T>
+    class SensitiveAllocator
+    {
+    public:
+        typedef T value_type;
+
+        SensitiveAllocator() throw() {}
+
+        template <class U>
+        SensitiveAllocator(const SensitiveAllocator<U>&) throw() {}
+
+        T* allocate(std::size_t n)
+        {
+            Aws::Utils::Memory::MemorySystemInterface* memorySystem = Aws::Utils::Memory::GetSensitiveMemorySystem();
+            if (memorySystem)
+            {
+                return reinterpret_cast<T*>(memorySystem->AllocateMemory(n * sizeof(T), alignof(T), "AWSSensitive"));
+            }
+            return reinterpret_cast<T*>(malloc(n * sizeof(T)));
+        }
+
+        void deallocate(T* p, std::size_t n)
+        {
+            AWS_UNREFERENCED_PARAM(n);
+
+            Aws::Utils::Memory::MemorySystemInterface* memorySystem = Aws::Utils::Memory::GetSensitiveMemorySystem();
+            if (memorySystem)
+            {
+                memorySystem->FreeMemory(p);
+            }
+            else
+            {
+                free(p);
+            }
+        }
+    };
+
+    template< typename T, typename U >
+    bool operator ==(const SensitiveAllocator< T >&, const SensitiveAllocator< U >&)
+    {
+        return true;
+    }
+
+    template< typename T, typename U >
+    bool operator !=(const SensitiveAllocator< T >&, const SensitiveAllocator< U >&)
+    {
+        return false;
+    }
+
     /**
      * Creates a shared_ptr using AWS Allocator hooks.
      * allocationTag is for memory tracking purposes.

src/aws-cpp-sdk-core/include/aws/core/utils/memory/stl/AWSString.h

@@ -102,6 +102,8 @@ using WString = std::basic_string< wchar_t, std::char_traits< wchar_t >, Aws::Al
 
 #endif // __ANDROID
 
+using SensitiveString = std::basic_string< char, std::char_traits< char >, Aws::SensitiveAllocator< char > >;
+
 } // namespace Aws
 
 #ifdef USE_AWS_MEMORY_MANAGEMENT

src/aws-cpp-sdk-core/include/smithy/identity/resolver/built-in/AwsCredentialsProviderIdentityResolver.h

@@ -37,7 +37,7 @@ namespace smithy
 
             auto smithyCreds = Aws::MakeUnique<AwsCredentialIdentity>("AwsCredentialsProviderIdentityResolver",
               fetchedCreds.GetAWSAccessKeyId(),
-              fetchedCreds.GetAWSSecretKey(),
+              Aws::String(fetchedCreds.GetAWSSecretKey().data(), fetchedCreds.GetAWSSecretKey().size()),
               fetchedCreds.GetSessionToken(),
               fetchedCreds.GetExpiration(),
               fetchedCreds.GetAccountId());

src/aws-cpp-sdk-core/include/smithy/identity/resolver/built-in/DefaultAwsCredentialIdentityResolver.h

@@ -46,7 +46,8 @@ class DefaultAwsCredentialIdentityResolver : public AwsCredentialIdentityResolve
     auto legacyCreds = legacyChain_sp->GetAWSCredentials();
 
     auto smithyCreds = Aws::MakeUnique<AwsCredentialIdentity>(
-        "DefaultAwsCredentialIdentityResolver", legacyCreds.GetAWSAccessKeyId(), legacyCreds.GetAWSSecretKey(),
+        "DefaultAwsCredentialIdentityResolver", legacyCreds.GetAWSAccessKeyId(),
+        Aws::String(legacyCreds.GetAWSSecretKey().data(), legacyCreds.GetAWSSecretKey().size()),
         legacyCreds.GetSessionToken().empty() ? Aws::Crt::Optional<Aws::String>() : legacyCreds.GetSessionToken(),
         legacyCreds.GetExpiration(), legacyCreds.GetAccountId().empty() ? Aws::Crt::Optional<Aws::String>() : legacyCreds.GetAccountId());
 

src/aws-cpp-sdk-core/include/smithy/identity/resolver/built-in/SimpleAwsCredentialIdentityResolver.h

@@ -35,7 +35,7 @@ namespace smithy
 
             auto smithyCreds = Aws::MakeUnique<AwsCredentialIdentity>("SimpleAwsCredentialIdentityResolver",
                                                                      m_credentials.GetAWSAccessKeyId(),
-                                                                     m_credentials.GetAWSSecretKey(),
+                                                                     Aws::String(m_credentials.GetAWSSecretKey().data(), m_credentials.GetAWSSecretKey().size()),
                                                                      m_credentials.GetSessionToken().empty()? Aws::Crt::Optional<Aws::String>() : m_credentials.GetSessionToken(),
                                                                      m_credentials.GetExpiration(),
                                                                      m_credentials.GetAccountId().empty()? Aws::Crt::Optional<Aws::String>() : m_credentials.GetAccountId());

src/aws-cpp-sdk-core/source/Aws.cpp

@@ -50,6 +50,10 @@ namespace Aws
             Aws::Utils::Memory::InitializeAWSMemorySystem(Utils::Memory::GetDefaultMemorySystem());
         }
 #endif // USE_AWS_MEMORY_MANAGEMENT
+        if(options.memoryManagementOptions.sensitiveMemoryManager)
+        {
+            Aws::Utils::Memory::InitializeAWSSensitiveMemorySystem(*options.memoryManagementOptions.sensitiveMemoryManager);
+        }
         Aws::Client::CoreErrorsMapper::InitCoreErrorsMapper();
         if(options.loggingOptions.logLevel != Aws::Utils::Logging::LogLevel::Off)
         {
@@ -223,6 +227,10 @@ namespace Aws
             Aws::Utils::Logging::PushLogger(nullptr); // stops further logging but keeps old logger object alive
         }
         Aws::Utils::Logging::ShutdownAWSLogging();
+        if(options.memoryManagementOptions.sensitiveMemoryManager)
+        {
+            Aws::Utils::Memory::ShutdownAWSSensitiveMemorySystem();
+        }
 #ifdef USE_AWS_MEMORY_MANAGEMENT
         if(options.memoryManagementOptions.memoryManager)
         {

src/aws-cpp-sdk-core/source/auth/signer/AWSAuthEventStreamV4Signer.cpp

@@ -293,13 +293,12 @@ Aws::String AWSAuthEventStreamV4Signer::GenerateStringToSign(const Aws::String&
     return ss.str();
 }
 
-Aws::Utils::ByteBuffer AWSAuthEventStreamV4Signer::ComputeHash(const Aws::String& secretKey,
+Aws::Utils::ByteBuffer AWSAuthEventStreamV4Signer::ComputeHash(const Aws::SensitiveString& secretKey,
         const Aws::String& simpleDate, const Aws::String& region, const Aws::String& serviceName) const
 {
-    Aws::String signingKey(Aws::Auth::AWSAuthHelper::SIGNING_KEY);
+    Aws::SensitiveString signingKey(Aws::Auth::AWSAuthHelper::SIGNING_KEY);
     signingKey.append(secretKey);
-    auto hashResult = HashingUtils::CalculateSHA256HMAC(ByteBuffer((unsigned char*)simpleDate.c_str(), simpleDate.length()),
-            ByteBuffer((unsigned char*)signingKey.c_str(), signingKey.length()));
+    auto hashResult = HashingUtils::CalculateSHA256HMAC(simpleDate, signingKey);
 
     if (hashResult.GetLength() == 0)
     {

src/aws-cpp-sdk-core/source/auth/signer/AWSAuthV4Signer.cpp

@@ -548,10 +548,10 @@ Aws::String AWSAuthV4Signer::GenerateStringToSign(const Aws::String& dateValue,
     return ss.str();
 }
 
-Aws::Utils::ByteBuffer AWSAuthV4Signer::ComputeHash(const Aws::String& secretKey,
+Aws::Utils::ByteBuffer AWSAuthV4Signer::ComputeHash(const Aws::SensitiveString& secretKey,
         const Aws::String& simpleDate, const Aws::String& region, const Aws::String& serviceName) const
 {
-    Aws::String signingKey(Aws::Auth::AWSAuthHelper::SIGNING_KEY);
+    Aws::SensitiveString signingKey(Aws::Auth::AWSAuthHelper::SIGNING_KEY);
     signingKey.append(secretKey);
     auto kDate = HashingUtils::CalculateSHA256HMAC(simpleDate, signingKey);
 

src/aws-cpp-sdk-core/source/utils/HashingUtils.cpp

@@ -18,6 +18,7 @@
 #include <aws/core/utils/logging/LogMacros.h>
 #include <aws/core/utils/memory/stl/AWSList.h>
 #include <aws/core/utils/memory/stl/AWSStringStream.h>
+#include <aws/crt/crypto/HMAC.h>
 
 #include <iomanip>
 
@@ -48,6 +49,23 @@ ByteBuffer HashingUtils::CalculateSHA256HMAC(const ByteBuffer& toSign, const Byt
     return hash.Calculate(toSign, secret).GetResult();
 }
 
+ByteBuffer HashingUtils::CalculateSHA256HMAC(const Aws::String& toSign, const Aws::SensitiveString& secret)
+{
+    auto toSignCur = Aws::Crt::ByteCursorFromArray(reinterpret_cast<const uint8_t*>(toSign.data()), toSign.size());
+    auto secretCur = Aws::Crt::ByteCursorFromArray(reinterpret_cast<const uint8_t*>(secret.data()), secret.size());
+
+    ByteBuffer resultBuf(Aws::Crt::Crypto::SHA256_HMAC_DIGEST_SIZE);
+    Aws::Crt::ByteBuf outBuf = Aws::Crt::ByteBufFromEmptyArray(resultBuf.GetUnderlyingData(), resultBuf.GetSize());
+
+    if (Aws::Crt::Crypto::ComputeSHA256HMAC(secretCur, toSignCur, outBuf))
+    {
+        resultBuf.SetLength(outBuf.len);
+        return resultBuf;
+    }
+
+    return {};
+}
+
 ByteBuffer HashingUtils::CalculateSHA512(const Aws::String& str)
 {
     Sha512 hash;

src/aws-cpp-sdk-core/source/utils/memory/AWSMemory.cpp

@@ -16,6 +16,7 @@ using namespace Aws::Utils::Memory;
 #ifdef USE_AWS_MEMORY_MANAGEMENT
   static MemorySystemInterface* AWSMemorySystem(nullptr);
 #endif // USE_AWS_MEMORY_MANAGEMENT
+static MemorySystemInterface* AWSSensitiveMemorySystem(nullptr);
 
 namespace Aws
 {
@@ -59,6 +60,31 @@ MemorySystemInterface* GetMemorySystem()
     #endif // USE_AWS_MEMORY_MANAGEMENT
 }
 
+void InitializeAWSSensitiveMemorySystem(MemorySystemInterface& memorySystem)
+{
+    if(AWSSensitiveMemorySystem != nullptr)
+    {
+        AWSSensitiveMemorySystem->End();
+    }
+
+    AWSSensitiveMemorySystem = &memorySystem;
+    AWSSensitiveMemorySystem->Begin();
+}
+
+void ShutdownAWSSensitiveMemorySystem(void)
+{
+    if(AWSSensitiveMemorySystem != nullptr)
+    {
+        AWSSensitiveMemorySystem->End();
+    }
+    AWSSensitiveMemorySystem = nullptr;
+}
+
+MemorySystemInterface* GetSensitiveMemorySystem()
+{
+    return AWSSensitiveMemorySystem;
+}
+
 #if defined(__cpp_exceptions) || defined(_CPPUNWIND) || defined(__EXCEPTIONS)
 #define AWS_HAS_EXCEPTIONS
 #endif