AES Finder – the utility to find AES keys in running process memory

Re:AES Finder – the utility to find AES keys in running proc... by koolba on Sunday September 06, 2020 @10:46AM (#24391687)

You can freeze the computer, remove the DIMMs, and then pop them into a different machine to read them: https://electronics.stackexchange.com/questions/32189/freezi...

[ Parent | on HN ]

Re:AES Finder – the utility to find AES keys in running proc... by Drip33 on Sunday September 06, 2020 @10:51AM (#24391720)

I thought that wasn't possible since DDR3 or 4?

[ Parent | on HN ]

Re:AES Finder – the utility to find AES keys in running proc... by ATsch on Sunday September 06, 2020 @04:11PM (#24394284)

Smaller capacitors will keep their charge less long, which makes this more difficult, but I understand that there are no fundamental mitigations.

[ Parent | on HN ]

Re:AES Finder – the utility to find AES keys in running proc... by jleahy on Sunday September 06, 2020 @07:25PM (#24395482)

The fundamental mitigation is full memory encryption using a randomly generated key that changes each time the CPU boots. That exists for some CPUs.

[ Parent | on HN ]

Re:AES Finder – the utility to find AES keys in running proc... by ATsch on Sunday September 06, 2020 @09:32PM (#24395987)

Well, that's not part of the ddr3 or ddr4 spec :)

[ Parent | on HN ]

Re:AES Finder – the utility to find AES keys in running proc... by Spivak on Sunday September 06, 2020 @10:27PM (#24396176)

Where do you store the key?

[ Parent | on HN ]

Re:AES Finder – the utility to find AES keys in running proc... by danielheath on Sunday September 06, 2020 @11:21PM (#24396357)

CPU registers - much harder to pull off and reattach elsewhere.

[ Parent | on HN ]

Re:AES Finder – the utility to find AES keys in running proc... by Avamander on Sunday September 06, 2020 @05:28PM (#24394813)

There's (T)SME.

[ Parent | on HN ]