PSA: Upgrade your LUKS key derivation function

Re:PSA: Upgrade your LUKS key derivation function by AlexCoventry on Tuesday April 18, 2023 @04:12PM (#35619370)

If the computer is suspended at the time it's seized, does it become easier to recover the FDE key from the computer's memory? Or is that encrypted with the user password, or something like that? (On stock ubuntu, say.)

[ Parent | on HN ]

Re:PSA: Upgrade your LUKS key derivation function by mjg59 on Tuesday April 18, 2023 @10:43PM (#35623653)

If you can dump the contents of memory then you have the key (after all, the CPU has to be able to encrypt and decrypt the material, so it has to be available).

[ Parent | on HN ]

Re:PSA: Upgrade your LUKS key derivation function by zamnos on Tuesday April 18, 2023 @10:52PM (#35623718)

Pedantically, if there's an HSM/similar hardware in play, the CPU only asks for material to be encrypted/decrypted and doesn't have the key in system RAM to be able to do so itself.

MacOS machines with a T2 chip keep the encryption key in the T2 chip so it isn't in system RAM.

[ Parent | on HN ]

Re:PSA: Upgrade your LUKS key derivation function by ryan-c on Wednesday April 19, 2023 @03:11AM (#35625232)

Apparently it's possible to keep the key in the debug registers: https://en.wikipedia.org/wiki/TRESOR

[ Parent | on HN ]

Re:PSA: Upgrade your LUKS key derivation function by zamnos on Tuesday April 18, 2023 @10:47PM (#35623686)

If the DRAM is powered on at the time of seizure, recovering the key is eminently possible. If this is an issue for you, completely power off the laptop when transiting customs.

https://en.wikipedia.org/wiki/Cold_boot_attack

[ Parent | on HN ]