What Is mlock Memory Protection? Why Your Wallet Needs It

Your Private Keys Are Exposed in Memory

Every time you use a crypto wallet to sign a transaction, your private key must be loaded into your computer's memory (RAM). This is unavoidable — the signing algorithm needs to read the private key to compute a valid digital signature.

The problem is: most wallets don't properly handle the private key in memory after signing is complete. Worse still, your operating system may silently write the private key from memory to disk — a process called "memory swapping."

Once a private key is written to disk, it can persist for days, weeks, or even months. Anyone who gains access to your disk — whether a hacker, malware, or someone with physical access to your computer — could recover your private key and drain all your crypto assets.

mlock exists to solve this problem. It's an operating system "memory lock" that ensures your private keys are never written to disk.

What Is mlock? A Simple Analogy

Think of your computer's RAM as a desk, and your hard drive as a filing cabinet. Normally, when desk space runs low, the operating system moves some documents from the desk into the cabinet (swap), and retrieves them when needed later.

This is fine for ordinary documents. But what if there's a note on your desk with your bank password? You absolutely don't want that note going into the cabinet — because the cabinet has no lock, and anyone can open it.

mlock is like putting a sticker on that note telling the OS: "This document must never go in the cabinet. Keep it on the desk." When the computer shuts down, everything on the desk vanishes (RAM is volatile memory), but the cabinet's contents remain.

Technically, mlock is a POSIX-standard system call available on Linux and macOS. The Windows equivalent is VirtualLock. Once mlock is called, the OS guarantees that the specified memory pages will not be swapped to the swap partition.

Three Types of Memory Attacks

To understand why mlock matters, you need to know how attackers steal private keys from memory. Here are the three most common memory attack vectors:

1. Swap-to-Disk Attack

This is the attack type mlock directly defends against. When your computer runs low on RAM, the OS writes portions of memory to a swap partition (Linux) or pagefile (Windows). If your private key happens to be in one of those swapped pages, it ends up on disk in plaintext.

All an attacker needs is disk access (physical or remote), then they can scan the swap partition for private key data patterns. This doesn't require advanced skills — ready-made tools exist for exactly this purpose.

2. Cold Boot Attack

RAM doesn't clear instantly after power loss — data persists for seconds to minutes. Cold boot attacks exploit this: an attacker force-reboots your running computer and boots from a USB tool that reads out RAM contents before the data fades. If the private key is still in RAM, it gets captured.

mlock doesn't directly prevent cold boot attacks (since the data is indeed in RAM), but combined with ArcSign's "immediate zeroing after use" mechanism, the private key only exists in memory for a few milliseconds during signing, drastically reducing the capture window.

3. Memory Dump Attack

Malware or privileged attackers can perform a memory dump of running processes, capturing all data in a program's memory space. If the private key is actively in use, it could be captured.

The defense: minimize how long the private key lives in memory. ArcSign's signing takes just 1–5 milliseconds, after which the key is immediately wiped. An attacker would need to capture within this extremely narrow window — an exceptionally difficult feat.

ArcSign's Four-Layer Memory Defense

ArcSign doesn't just use mlock — it implements a comprehensive four-layer memory protection system to keep your private keys as secure as possible in every scenario:

Wallet Memory Protection Comparison

Different crypto wallets vary widely in memory protection. Here's how the major options compare:

*Ledger uses a dedicated security chip where private keys never pass through the host computer's memory, so mlock and swap protection are "not applicable." However, Ledger carries supply chain and firmware backdoor concerns.

MetaMask and Trust Wallet are browser extensions and mobile apps, respectively. They run in sandboxed environments that don't allow direct mlock system calls — this is by design in the browser security model. JavaScript also has no concept of "memory zeroing"; when the garbage collector clears memory is entirely unpredictable.

This is exactly why ArcSign chose a native desktop architecture (Go + Tauri) over a browser extension. Only native applications can call the OS's low-level security APIs to provide real memory protection.

Encrypted Backup: The Ultimate Safety Net Beyond mlock

mlock protects runtime security — keeping your private keys from leaking to disk while your wallet is in use. But what happens if your USB is lost or damaged? You need an equally secure backup solution.

Traditional cold wallets require you to write down 12 seed phrase words with pen and paper. This approach has serious problems:

• Paper is fragile: vulnerable to water, fire, fading, and even pets
• Zero encryption: anyone who sees it can steal all your assets
• Handwriting errors: one wrong letter could make recovery impossible
• Multiple copies = multiple exposure risks: each copy is another chance for discovery

ArcSign offers a better solution: one-click export of an AES-256 encrypted .arcsign backup file.

Technical Deep Dive: How mlock Works

For technically curious readers, here's a closer look at how mlock operates at the OS level.

Virtual Memory in Modern Operating Systems

Modern OSes use virtual memory to manage RAM. Each program sees a contiguous virtual address space, which the OS maps to physical RAM pages. When physical RAM runs low, the OS selects "least recently used" pages, writes their contents to the swap partition on disk, and frees those RAM pages for other programs.

This process is transparent to applications — programs don't know their memory has been swapped. When a swapped page is accessed again, a "page fault" triggers, and the OS reads the data back from swap.

The mlock System Call Interface

Cross-Platform Implementation

ArcSign is written in Go, which provides cross-platform system call interfaces:

• Linux: Uses the mlock(2) system call, subject to RLIMIT_MEMLOCK limits (default 64KB is typically sufficient)
• macOS: Uses mlock(2) — fully supported by the Darwin kernel
• Windows: Uses the VirtualLock() Win32 API — functionally equivalent

ArcSign automatically selects the appropriate platform implementation at compile time. Users don't need to configure anything.

Why Browser Wallets Can't Do This

Browser extensions like MetaMask run in the browser's sandbox. Browsers don't allow extensions to directly call system calls like mlock — this is a design choice in the browser security model. JavaScript also has no concept of "memory zeroing"; when the garbage collector clears memory is entirely unpredictable.

This is why ArcSign chose a native desktop architecture (Go + Tauri) over a browser extension. Only native applications can call the OS's low-level security APIs to provide genuine memory protection.

Frequently Asked Questions (FAQ)