4 ms·
> ... "If at all possible, please do not allow this value/object/whatever to be paged out of RAM?" With the precondition you're running on bare metal (no virtu
by vardump 8y ago
> ... "If at all possible, please do not allow this value/object/whatever to be paged out of RAM?"
With the precondition you're running on bare metal (no virtualization), I think you'd need a kernel mode driver for that to cover all scenarios, including system hibernation and suspend.
You can reliably zero out the secret data before hibernation or even suspend by implementing power management calls – mlock or VirtualProtect aren't going to protect you from that leak.
- blattimwind 8y agoYou don't really need a driver for that. On Linux you could use a systemd unit with Before=sleep.target (or probably a udev rule). Windows has PBT_APMSUSPEND (which some applications use to quick-save before entering stand-by mode).
- vardump 8y agoI think the systemd case is ok. But PBT_APMSUSPEND is not necessarily. There's a 2 second timeout before Windows suspends or hibernates regardless. It's possible for the event handling thread not to run until after the timeout has passed, that is, after the system has returned from suspend or hibernate. That's important considering the adversary might induce this kind of scenario to steal the secret. Kernel mode driver does not have that limitation, because it can't be pre-empted.