Disk encryption: Difference between revisions

Revision as of 13:46, 5 November 2020

Revision as of 02:12, 18 November 2020

Line 56:

==Security concerns==

Most full disk encryption schemes are vulnerable to a [[cold boot attack]], whereby encryption [[key (cryptography)|keys]] can be stolen by [[Cold boot attack|cold-booting]] a machine already running an [[operating system]], then dumping the contents of [[static random access memory|memory]] before the data disappears. The attack relies on the [[data remanence]] property of computer memory, whereby data [[bit]]s can take up to several minutes to degrade after power has been removed.<ref name="ColdBoot">{{cite paperdocument|url=http://citp.princeton.edu/memory/|title=Lest We Remember: Cold Boot Attacks on Encryption Keys|author=[[J. Alex Halderman]], [[Seth Schoen|Seth D. Schoen]], [[Nadia Heninger]], William Clarkson, William Paul, Joseph A. Calandrino, Ariel J. Feldman, Jacob Appelbaum, and [[Edward Felten|Edward W. Felten]]|publisher=[[Princeton University]]|date=2008-02-21|accessdate=2008-02-22|journal=|archive-url=https://web.archive.org/web/20110722182409/http://citp.princeton.edu/memory/|archive-date=2011-07-22|url-status=dead}}</ref> Even a [[Trusted Platform Module]] (TPM) is not effective against the attack, as the operating system needs to hold the decryption keys in memory in order to access the disk.<ref name="ColdBoot"/>

Full disk encryption is also vulnerable when a computer is stolen when suspended. As wake-up does not involve a BIOS boot sequence, it typically does not ask for the FDE password. Hibernation, in contrast goes via a BIOS boot sequence, and is safe.

Line 109:

==Further reading==

*{{cite journal |last=Casey |first=Eoghan |authorlink= |author2=Stellatos, Gerasimos J. |year=2008 |title=The impact of full disk encryption on digital forensics |journal=Operating Systems Review |volume=42 |issue=3 |pages=93–98 |doi=10.1145/1368506.1368519 |s2cid=5793873 |url= |accessdate= |quote= }}

==External links==