5 ms·
Even if all of the AES state is kept in cache, the data to be encrypted would still have to be copied from ram or disk, right?
by dmm 13y ago
Even if all of the AES state is kept in cache, the data to be encrypted would still have to be copied from ram or disk, right?
- mindstab 13y agoyeah but you can have an encrypted disk, encrypted ram, not so much.
- jacquesm 13y agoOpenBSD will get you halfway there, it at least encrypts (if you switch it on) the virtual memory.
- m_eiman 13y agoAs does OSX. Probably Windows too? There has to be a registry setting to tweak, somewhere.
- dobbsbob 13y agoOpenBSD does this by default. It also now directly boots cryptodisks eliminating the need to create a /boot partition and carry it around if you're concerned about evil maid attacks, though I would imagine a camera or keyboard hardware keyloggers would defeat that pretty easily
- tedunangst 13y agoThe boot loader is still on the disk, unencrypted.
- Nanzikambe 13y agoThat's what removable media is for
- dobbsbob 13y agoderp, /root correction
- sweis 13y agoHi. PrivateCore has implemented encrypted RAM as part of a secure hypervisor. Our product is currently in a private beta, but you can check out our website at: http://www.privatecore.com http://www.privatecore.com. We gave a talk on some of the vulnerabilities and mitigations at CanSecWest this year: http://cansecwest.com/slides/2013/PrivateCore%20CSW%202013.pdf http://cansecwest.com/slides/2013/PrivateCore%20CSW%202013.p...
- mikeash 13y agoIf you stream the data in from disk (e.g. read 1kB, encrypt 1kB, read 1kB, encrypt 1kB) then a cold boot attack only recovers one small chunk of data. Whereas if your keys are in RAM then a cold boot attack can recover the keys which can then be used to decrypt your entire hard drive.