Monday, February 25, 2008

Major security hole in encryption products

Professor Ed Felton has published research that demonstrates conclusively that disk encryption can be defeated quite easily due to a hardware leak: even when you turn off power, modern memory chips will hold their contents for minutes without any special actions. If you cool the DRAM chips they can hold their contents for hours. This is important because it allows an attacker to retrieve the encryption key from memory and use it to decrypt the hard disk.

This news doesn't make disk encryption useless. It will still protect your data in the event of casual theft, but it does mean that if you have sensitive data, and you believe you could be targeted by people wanting that data, you can't rely on disk encryption. At this time, there is no work-around, and the operating system you use is irrelevant. I expect that the eventual fix will be a circuit to fill the DRAM chips with random data when the computer is turned off.

No comments: