Is LUKS susceptible to memory attacks on recently powered down systems?

Meson · 04-17-2008, 07:08 PM

As far as I can tell, full disk encryption software needs to store your password and/or key in memory in plain text while the system is on. If someone is able to quickly power down your system and read your ram before it loses its data, they can potentially find your password/key.

Does LUKS/dm-crypt work this way?

If it does, could this be fixed by generating temporary keys at boot-time?

jschiwal · 04-17-2008, 08:05 PM

The key information is cleared when you log out. The attack uses intermediate information to reveal the keys. If you pay attention to the demo video, the keyboard on the keyboard was already unscrewed before shutting down to enable quick enough access to the ram chips. For more recent ram sticks, the information is valid for only 5-10 seconds rather than like 30 seconds so there is less time to locate the chips.

More information on this theoretical attack can be found in the podcast Security Now episode 137.
www.twit.tv/sn/sn137