Going Keyless Everywhere

This post details a multi-year project to enhance Cloudflare's resilience against memory disclosure vulnerabilities like Heartbleed and Cloudbleed. It explains the concept of process isolation and how these vulnerabilities exploit it. The core contribution is the 'Keyless Everywhere' initiative, which moves private keys out of internet-facing processes by using separate key servers (leveraging Keyless SSL and Geo Key Manager). This significantly reduces the risk of private key exposure, even if other memory disclosure bugs are found in web server applications. The post also touches on the technical implementation details, including the use of gokeyless-internal, lazy loading, and the tableflip package for graceful upgrades, and how this was applied to TLS 1.3 and Spectrum.