4 ms·

This is a linkbait title that has nothing to do with cracking. It does, however, have to do with the recovery of your encryption keys from a memory dump. And ye

by trebor 14y ago

This is a linkbait title that has nothing to do with cracking. It does, however, have to do with the recovery of your encryption keys from a memory dump. And yes, if your computer is running or put into hibernation your encryption keys will be at risk—guaranteed. For better security shut your system off. Especially if you have a firewire port (because most computers with them can have a direct memory dump taken without any need to interact with the victim's computer).

Dylan16807 14y ago
>And yes, if your computer is running or put into hibernation your encryption keys will be at risk—guaranteed. Don't get too hasty there. The default for Truecrypt at least is to dismount upon hibernation.
- trebor 14y ago
  Does it burn the encryption key out of memory prior to hibernation? I should hope so or else I'm still right. And if the system requires that the volume be mounted when resuming the hibernated state, just turning the system on could compromise the system.
  - Dylan16807 14y ago
    http://www.truecrypt.org/docs/?s=unencrypted-data-in-ram http://www.truecrypt.org/docs/?s=unencrypted-data-in-ram Short answer: Yes, it clears the keys upon dismount. Longer answer: If you have a non-critical volume encrypted, set to dismount on hibernate, it clears the keys. Beware programs that still have files in in memory, though. If you have the system volume encrypted, then nobody can get the keys out of the hibernation file. Truecrypt is forced to leave the keys in memory here, but you just hibernated. The system is shut down. Give it a minute and the RAM will clear.
rcxdude 14y ago
Not guaranteed (but still pretty likely). On linux at least, you can easily hibernate to an encrypted partition, requiring a password to wake up.
ColinWright 14y ago
It's now been changed - see my observations here: http://news.ycombinator.com/item?id=4949053 http://news.ycombinator.com/item?id=4949053
sahaskatta 14y ago
Windows 8's shut down now does some sort of kernel hibernation. Shutting down isn't really a full shutdown in the traditional sense anymore apparently. Anyone know whether this means Windows 8 machines with Bitlocker are vulnerable?

by trebor 14y ago

Dylan16807 14y ago

>And yes, if your computer is running or put into hibernation your encryption keys will be at risk—guaranteed. Don't get too hasty there. The default for Truecrypt at least is to dismount upon hibernation.

trebor 14y ago
Does it burn the encryption key out of memory prior to hibernation? I should hope so or else I'm still right. And if the system requires that the volume be mounted when resuming the hibernated state, just turning the system on could compromise the system.
- Dylan16807 14y ago
  http://www.truecrypt.org/docs/?s=unencrypted-data-in-ram http://www.truecrypt.org/docs/?s=unencrypted-data-in-ram Short answer: Yes, it clears the keys upon dismount. Longer answer: If you have a non-critical volume encrypted, set to dismount on hibernate, it clears the keys. Beware programs that still have files in in memory, though. If you have the system volume encrypted, then nobody can get the keys out of the hibernation file. Truecrypt is forced to leave the keys in memory here, but you just hibernated. The system is shut down. Give it a minute and the RAM will clear.

rcxdude 14y ago

Not guaranteed (but still pretty likely). On linux at least, you can easily hibernate to an encrypted partition, requiring a password to wake up.

ColinWright 14y ago

It's now been changed - see my observations here: http://news.ycombinator.com/item?id=4949053 http://news.ycombinator.com/item?id=4949053

sahaskatta 14y ago

Windows 8's shut down now does some sort of kernel hibernation. Shutting down isn't really a full shutdown in the traditional sense anymore apparently. Anyone know whether this means Windows 8 machines with Bitlocker are vulnerable?