Re: [TuxOnIce-devel] RFC: Suspend-to-ram cold boot protection by encrypting page cache

[Jeremy Maitin-Shepard <jeremy@jeremyms.com>]

"Rafael J. Wysocki" <rjw@sisk.pl> writes:

> [snip]

> What is the particular attach scenario you'd like to prevent

The standard cold boot attack, which basically allows the attacker to
obtain a copy of the data in RAM.  System is powered on.  RAM is
optionally cooled.  RAM is then quickly removed from the original
machine, placed in another machine, and copied.  See
http://en.wikipedia.org/wiki/Cold_boot_attack

The wikipedia page links to this Youtube video that nicely demonstrates
the attack:

http://www.youtube.com/watch?v=JDaicPIgn9U

The cooling helps to preserve the data for longer, but is not always
even necessary.  Special hardware is not even needed.  Depending on
whether the BIOS clears the memory during the POST, it might also be
possible to do the attack on the same machine (i.e. without having to
move the RAM into another machine) by rebooting it and booting from
e.g. a CD-ROM or USB drive.

> [snip]

> There's one problem with this approach, which is that we're not sure if the
> encrypted pages won't be written to by someone else.  TuxOnIce makes the
> assumption that it won't, but that has yet to be demonstrated.

Yes, it certainly depends on that assumptions, but it is not necessarily
a problem that it does.

There are really two parts to that assumption:

1. Whether the current Linux kernel in a particular (or perhaps any)
   configuration _does_ satisfy that assumption.

2. Whether Linux _should_ satisfy that assumption.  This is important
   because if something comes along later that violates the assumption,
   it would be nice to be able to consider that something a bug and fix
   it.

It is really the second part that is most important, though evaluating
the extent to which the first part holds would help in determining the
feasibility of the second part.

-- 
Jeremy Maitin-Shepard