News for hackers. Stuff that matters.

A comment on TRESOR Runs Encryption Securely Outside RAM. Parent comment

Re:TRESOR Runs Encryption Securely Outside RAM by dmm on Friday September 27, 2013 @09:53AM (#6456989)
Even if all of the AES state is kept in cache, the data to be encrypted would still have to be copied from ram or disk, right?
[ Parent | on HN ]
Re:TRESOR Runs Encryption Securely Outside RAM by mindstab on Friday September 27, 2013 @09:56AM (#6457011)
yeah but you can have an encrypted disk, encrypted ram, not so much.
[ Parent | on HN ]
Re:TRESOR Runs Encryption Securely Outside RAM by sweis on Friday September 27, 2013 @04:43PM (#6459425)
Hi. PrivateCore has implemented encrypted RAM as part of a secure hypervisor. Our product is currently in a private beta, but you can check out our website at: http://www.privatecore.com.

We gave a talk on some of the vulnerabilities and mitigations at CanSecWest this year: http://cansecwest.com/slides/2013/PrivateCore%20CSW%202013.p...

[ Parent | on HN ]
Re:TRESOR Runs Encryption Securely Outside RAM by jacquesm on Friday September 27, 2013 @10:03AM (#6457047)
OpenBSD will get you halfway there, it at least encrypts (if you switch it on) the virtual memory.
[ Parent | on HN ]
Re:TRESOR Runs Encryption Securely Outside RAM by dobbsbob on Friday September 27, 2013 @01:05PM (#6458020)
OpenBSD does this by default. It also now directly boots cryptodisks eliminating the need to create a /boot partition and carry it around if you're concerned about evil maid attacks, though I would imagine a camera or keyboard hardware keyloggers would defeat that pretty easily
[ Parent | on HN ]
Re:TRESOR Runs Encryption Securely Outside RAM by tedunangst on Friday September 27, 2013 @02:46PM (#6458750)
The boot loader is still on the disk, unencrypted.
[ Parent | on HN ]
Re:TRESOR Runs Encryption Securely Outside RAM by Nanzikambe on Saturday September 28, 2013 @01:49AM (#6461079)
That's what removable media is for
[ Parent | on HN ]
Re:TRESOR Runs Encryption Securely Outside RAM by dobbsbob on Friday September 27, 2013 @03:27PM (#6458968)
derp, /root correction
[ Parent | on HN ]
Re:TRESOR Runs Encryption Securely Outside RAM by m_eiman on Friday September 27, 2013 @11:13AM (#6457380)
As does OSX. Probably Windows too? There has to be a registry setting to tweak, somewhere.
[ Parent | on HN ]
Re:TRESOR Runs Encryption Securely Outside RAM by mikeash on Friday September 27, 2013 @11:12AM (#6457374)
If you stream the data in from disk (e.g. read 1kB, encrypt 1kB, read 1kB, encrypt 1kB) then a cold boot attack only recovers one small chunk of data. Whereas if your keys are in RAM then a cold boot attack can recover the keys which can then be used to decrypt your entire hard drive.
[ Parent | on HN ]