Re:Decrypting the Signal App
by MacsHeadroom on Friday December 11, 2020 @06:43AM
(#25384650)
If the keys are in RAM then they aren't in an HSM- they're in RAM (as well as the HSM, but that's irrelevant).
More importantly, the app is already unlocked anyway if the keys are in RAM. So that just lets you keep it unlocked. It doesn't help you unlock an app that was locked when you got access to the device.
Indeed. It is still very useful to an investigator who has to examine an unlocked device -- in most corporate investigations this is unlikely to be an issue. Forensic examiners working for the police are likely to have more of a hard time getting codes etc., but they have access to more advanced services[1][2].
[1] https://www.msab.com/2018/12/11/msab-introduces-access-servi... [2] https://www.cellebrite.com/en/advanced-services/
On some more expensive devices keys can be obtained from RAM[1].
[1] https://www.cellebrite.com/en/blog/decrypting-databases-usin...