lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <4ef5fec60802211402g345b0e51xeb4d453f7560084f@mail.gmail.com> Date: Thu, 21 Feb 2008 14:02:59 -0800 From: coderman <coderman@...il.com> To: "Elazar Broad" <elazar@...hmail.com> Cc: full-disclosure@...ts.grok.org.uk Subject: Re: round and round they go, keys in ram are ripe for picking... On Thu, Feb 21, 2008 at 12:43 PM, Elazar Broad <elazar@...hmail.com> wrote: > http://blog.wired.com/27bstroke6/2008/02/researchers-dis.html "Lest We Remember: Cold Boot Attacks on Encryption Keys" the best part is: ''' Countermeasures and their Limitations Memory imaging attacks are difficult to defend against because cryptographic keys that are in active use need to be stored somewhere. Our suggested countermeasures focus on discarding or obscuring encryption keys before an adversary might gain physical access, preventing memory-dumping software from being executed on the machine, physically protecting DRAM chips, and possibly making the contents of memory decay more readily. ''' executive summary: - don't let malware read keys from memory. (ah, security, so many holes, so many weak links...) - the ability to scrub keys out of memory is ideal, but likely fallible. can you hit that panic button fast enough? - boot from secure media. you're booting from a read-only iso into that FDE protected OS, right? - avoid pre-computation of key schedules. high throughput hardware crypto implementations are great for this. i love padlock engines... - key expansion: i'm not familiar with any FDE that does this. anyone? note that if you're not using key scrubbing in your disk encryption (loop-aes?) you've got bigger remanence problems to worry about: "Data Remanence in Semiconductor Devices" http://www.cypherpunks.to/~peter/usenix01.pdf _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists