Hacker News new | ask | show | jobs
by matheusmoreira 1524 days ago
> pull out the RAM and grab encryption keys in clear text

How to defend against this?

2 comments

Shut down your device, don't leave it on at all times. I don't know if there's a way to suspend and encrypt RAM though. But other than that, there's no way to keep a computer running without the miscellaneous data being kept in RAM
Besides memory encryption (AMD PRO & Epyc) you can zero-out in-use memory keys before suspend & restore on resume, preferably using sealed storage, like TPM. This is ‘the’ reason to prefer home encryption vs. full disk. The thing is if someone is prepared to attack your laptop with liquid nitrogen they might as well just wait for you to unlock your laptop and then steal it right there, or watch you type in your password; better get your privacy blanket ready ;) Not having physical security is a huge disadvantage, and there’s really no way around it—you automatically start in the defeated position, and have to stack gizmos just to break even.
there are methods to store keys in RAM in encrypted form and decrypt them only on the cache and CPU registers
Talked about a bit here: https://youtu.be/pKeiKYA03eE?t=963

Using debug registers to hold an AES key purely in the CPU is genius.