Error correction with aes-looback / cryptoloop?

[Lennart Sorensen]

On Thu, Feb 28, 2008 at 12:09:43AM -0500, Jamon Camisso wrote:
> One thing I haven't heard anyone mention is encrypted swap. If you're 
> using encrypted filesystems (especially) or encrypted files (even), it 
> is possible that decrypted files could be paged to the disk in the event 
> you run low on memory, or decide to suspend/hibernate. Thus while the 
> circumstances in which sensitive data might be on disk are low, 
> encrypting your swap will help mitigate against that particular set of 
> risks.
> 
> OTOH, see http://citp.princeton.edu/memory/ for an interesting piece on 
> retrieving encryption keys from suspended/hibernated machines from a 
> cold boot. The story made the rounds a few days ago:
> 
> "Contrary to popular assumption, DRAMs used in most modern computers 
> retain their contents for seconds to minutes after power is lost, even 
> at operating temperatures and even if removed from a motherboard. 
> Although DRAMs become less reliable when they are not refreshed, they 
> are not immediately erased, and their contents persist sufficiently for 
> malicious (or forensic) acquisition of usable full-system memory images. 
> We show that this phenomenon limits the ability of an operating system 
> to protect cryptographic key material from an attacker with physical 
> access. We use cold reboots to mount attacks on popular disk encryption 
> systems ? BitLocker, FileVault, dm-crypt, and TrueCrypt ? using no 
> special devices or materials."
> 
> If you're really paranoid, encrypt your files on an encrypted disk, with 
> encrypted swap. And if you really value your data, don't put it on your 
> computer in the first place...

Get a good lock and a very mean looking dog (or maybe cat). :)

Or make sure that you are physically present at the computer at all
times and stay there for 30 minutes after turning it off, or perhaps you
should boot memtest and run a complete pass before turning off the
system when you leave just to overwrite all memory contents.

--
Len Sorensen
--
The Toronto Linux Users Group.      Meetings: http://gtalug.org/
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://gtalug.org/wiki/Mailing_lists