Hi everyone, I found the great question on booting encrypted drives, and since I’m somewhat paranoid I’d like to ask a follow-up:

When the key to decrypt the drive is input into the system, I’m assuming it stays in the RAM till the time the computer shuts downs. We know that one could, in theory, get a dump of the contents of the RAM in such a state, if done correctly. How would you deal with this problem? Is there some way to insert the USB, decrypt the drive, and then remove the USB and all traces of the key from the system?

Thanks!

Edit: link to the question I referenced: https://feddit.de/post/6735667

  • 4am@lemm.eeEnglish
    6·
    11 months ago

    If an attacker wants your encrypted data that bad, they will attack the running machine and use it to access the data, they will not steal a key and then attempt to physically remove the drive.

    Drive encryption is for prevention of access when the drive is offline, it doesn’t protect a running system which can access that data.

    If you are worried about the key being accessed while the machine is running, focus on hardening access to the machine via network, etc.

    • MigratingtoLemmy@lemmy.worldOPEnglish
      1·
      11 months ago

      This machine will not be connected to the Internet, and the only way to get to it would be a VLAN-hopping attack (in which case, I’ll have to think of something else)