3 ms·
If you can dump the contents of memory then you have the key (after all, the CPU has to be able to encrypt and decrypt the material, so it has to be available).
by mjg59 4y ago
If you can dump the contents of memory then you have the key (after all, the CPU has to be able to encrypt and decrypt the material, so it has to be available).
- zamnos 4y agoPedantically, if there's an HSM/similar hardware in play, the CPU only asks for material to be encrypted/decrypted and doesn't have the key in system RAM to be able to do so itself. MacOS machines with a T2 chip keep the encryption key in the T2 chip so it isn't in system RAM.
- ryan-c 4y agoApparently it's possible to keep the key in the debug registers: https://en.wikipedia.org/wiki/TRESOR https://en.wikipedia.org/wiki/TRESOR