Professor Ed Felton has published research that demonstrates conclusively that disk encryption can be defeated quite easily due to a hardware leak: even when you turn off power, modern memory chips will hold their contents for minutes without any special actions. If you cool the DRAM chips they can hold their contents for hours. This is important because it allows an attacker to retrieve the encryption key from memory and use it to decrypt the hard disk.
This news doesn't make disk encryption useless. It will still protect your data in the event of casual theft, but it does mean that if you have sensitive data, and you believe you could be targeted by people wanting that data, you can't rely on disk encryption. At this time, there is no work-around, and the operating system you use is irrelevant. I expect that the eventual fix will be a circuit to fill the DRAM chips with random data when the computer is turned off.
Monday, February 25, 2008
Major security hole in encryption products
Posted by Vlad the Impala at 2/25/2008 12:33:00 am
Labels: security
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment