6 ms·

What does this mean for me? I have all my interal + external hard drives encrypted as well as my system drive.

• shawnz 13y ago
  This article is just an analysis of one of the inherent and well-documented weaknesses in truecrypt: the fact that the encryption key must stay in RAM the entire time you are using an encrypted volume. So, as has always been the case, treat the contents of your RAM as precious when a truecrypt volume is mounted.
  • Xymak1y 13y ago
    Thank you.
  • mrfusion 13y ago
    How would you treat your RAM contents as precious? Just making sure you're on a pristine machine, and nothing else is running? Can other unrelated processes access the key from RAM?
    • shawnz 13y ago
      > How would you treat your RAM contents as precious? For one, don't let anyone get physical access to the computer while it is running and the volume is mounted (even if the screen is locked). This may even apply for several minutes after the machine is turned off: https://freedom-to-tinker.com/blog/felten/new-research-result-cold-boot-attacks-disk-encryption/ https://freedom-to-tinker.com/blog/felten/new-research-resul... > Can other unrelated processes access the key from RAM? Processes running as the root user can.
      • MichaelGG 13y ago
        >Processes running as the root user can. Unless you're using a trusted computing environment, right? In which case, if you trust the processor and startup environment, the kernel can be assured to run safely and prevent such attacks. Correct?
    • gambiting 13y ago
      Well, in theory, let's say you've got a laptop encrypted with Truecrypt. You put it in sleep mode instead of switching it completely off or hibernating,because you are just nipping out for a coffee. An attacker could then steal it, lower its temperature(let's say they put it in a freezer for a while), and then extract - literally take out - the RAM from that machine and plug it into a specially prepared station which would then be used to extract the contents of that memory. In low temperatures, RAM data retention is measured in minutes, so all data you had in your system would be preserved, including the encryption key. Unlikely? Quite, unless someone like NSA or FBI want your data. Possible? Yes, with the right resources.
      • dobbsbob 13y ago
        Cold boot attacks don't work on DDR3
        • sigterm 13y ago
          Why? Do you have any reference?
          • nickles 13y ago
            Here's a paper on the subject http://www1.cs.fau.de/filepool/projects/coldboot/fares_coldboot.pdf http://www1.cs.fau.de/filepool/projects/coldboot/fares_coldb...
            • sigterm 13y ago
              Note the comment at the end of the paper. The authors had not been able to do it successfully with their relatively simple methodology. Sure it is harder than DDR2 but this doesn't mean it is impossible. As pointed out by the authors, the failure can simply be due to the memory controller implementation (or DDR3 protocol itself) on their test setup. If this is the case, then all it takes is a custom memory controller that is optimized for this type of extraction.
    • reubenmorais 13y ago
      Avoid using Thunderbolt/IEEE 1394/DisplayPort or any interface that has DMA to connect devices to your computer.
• pudquick 13y ago
  It means if you're worried about the contents of your encrypted drives being uncovered, you need to make sure no malicious processes gain access to a dump of your system's memory while it's booted / running / encrypted drives are mounted.