Comments on: Cold Boot Attacks on Disk Encryption http://mjtsai.com/blog/2008/02/21/cold-boot-attacks-on-disk-encryption/ Sat, 22 Nov 2008 00:13:28 +0000 http://wordpress.org/?v=2.5.1 By: Michael http://mjtsai.com/blog/2008/02/21/cold-boot-attacks-on-disk-encryption/#comment-243497 Michael Fri, 22 Feb 2008 01:16:44 +0000 http://mjtsai.com/blog/2008/02/21/cold-boot-attacks-on-disk-encryption/#comment-243497 I was thinking of the shutdown case. I agree that the screensaver case is probably hopeless, unless it also unmounts the volume. I was thinking of the shutdown case. I agree that the screensaver case is probably hopeless, unless it also unmounts the volume.

]]> By: Drew Thaler http://mjtsai.com/blog/2008/02/21/cold-boot-attacks-on-disk-encryption/#comment-243484 Drew Thaler Fri, 22 Feb 2008 00:41:17 +0000 http://mjtsai.com/blog/2008/02/21/cold-boot-attacks-on-disk-encryption/#comment-243484 Erasing the key in memory isn't necessarily useful. It helps, of course, but with whole-disk encryption the key has to be in memory whenever the disk is mounted. Even if there's some other obstacle blocking the bad guys who've nabbed your computer (a password-protected screensaver, etc) this method would allow them to circumvent it by just extracting the key from RAM. It might help to create a RAM with a hardware scrubber which forcibly wipes the state if the RAM loses power. But things like <a href="http://www.wiebetech.com/products/HotPlug.php">WiebeTech's HotPlug</a> make me even wonder how long that would be useful. I guess physical security is still your best bet in the end. Erasing the key in memory isn't necessarily useful. It helps, of course, but with whole-disk encryption the key has to be in memory whenever the disk is mounted. Even if there's some other obstacle blocking the bad guys who've nabbed your computer (a password-protected screensaver, etc) this method would allow them to circumvent it by just extracting the key from RAM.

It might help to create a RAM with a hardware scrubber which forcibly wipes the state if the RAM loses power. But things like WiebeTech's HotPlug make me even wonder how long that would be useful.

I guess physical security is still your best bet in the end.

]]>