Decryption keys are wiped from memory after use
Level 2 workloads are decrypted on the edge node, so the node holds the content key while it serves a request. Edge nodes and the control plane now overwrite keys as soon as they are finished with them, instead of leaving them in memory until it is reclaimed.
A Level 2 workload is decrypted on the edge node before it is sent to the visitor, so for the length of each request the node has to hold the key. What matters is how long the key stays in memory after that. Until now, it stayed until memory was reclaimed at some later point. A crash dump, or memory written to disk, could keep a copy even longer.
Keys are now overwritten as soon as they’re no longer needed:
- on the edge node, when a Level 2 request finishes
- on the edge node, right after keys are derived from a workload’s secret, whether or not that succeeds
- in the control plane, when a workload build finishes or an index is decrypted
This shortens the time a key stays in memory. It does not guarantee that no copy remains: the runtime can make copies of its own that can’t be wiped.