Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I would expect the unmount of an encrypted filesystem to secure delete the encryption key from memory. My understanding of the memory freezing attacks is that you don't unmount it, you just kill the power by removing the battery.

With this method, you would still be able to freeze the RAM, reboot the computer, dump the RAM, and disassemble the kernel memory, and discover where the disk encryption key was stored: in that location, you'd find all zeroes.



My preferred method is a custom kernel build that does a few extra obfuscation steps before or after encryption on each data block. While you might find my key in ram, good luck decompiling my kernel module based on a bitrotted ramdump. Simply not storing the key contiguously unless there is an actual IO operation going in is a good start - scatter it around the heap so a simple search won't find it.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: