On Fri, Nov 8, 2013 at 10:05 PM, Tom Metro <tmetro+...@gmail.com> wrote: > Bill Bogstad wrote: >> Cold Boot Attacks on Encryption Keys
> But then the scenario starts to get a bit more far fetched. The people > seizing your server apparently already know or suspect you are using > full disk encryption, and your data is valuable enough to warrant > bringing in people skilled enough to hot jumper your machine to a > portable power source before moving it back to a lab where the RAM can > be frozen and dumped. Depending on the size of the computer, they don't need any special skills to keep the juice going when they move it. I'm pretty sure that anyone who reads this mailing list could figure out how to use a HotPlug (available for less than $600) to do it. http://www.wiebetech.com/products/HotPlug.php Apparently, the "authorities" do this often enough that a commercial product was developed to make it easy. A mouse jiggler" is included so that the password protected screensaver doesn't kick in while the system is being transported. Recovering the encryption key from memory is only needed if the screensaver has a chance to come on. Of course, they can do that at their leisure; when an expert has time. > In any case, as soon as the machine is moved or a cover opened, a trip > switch cuts power internally. If they weren't expecting this, you've > increased your chances that all or most of your key will be corrupted by > the time they get some freon on your RAM. This definitely makes it tougher. They have to bring the freon with them and do everything on-site. Probably not doable in the middle of a gun battle at KAOS' headquarters. BTW, this is getting a little far afield from the circumstance where the owner of the system deliberately pulls the plug on their system. The scenario where you are running into the server room to pull the plug with the good/bad guys right on your tail is probably such that the key will not be recoverable by the attackers. Still I thought that it was worth mentioning that just because power has been removed doesn't mean that the key is gone. Bill Bogstad _______________________________________________ Discuss mailing list Discuss@blu.org http://lists.blu.org/mailman/listinfo/discuss