Comments on: Cleartext Passwords in Linux Memory

By: Is your RAM chained to your servers? « South African Networker

Is your RAM chained to your servers? « South African Networker — Fri, 01 Aug 2008 16:05:01 +0000

[...] To read Sherri’s post please visit http://philosecurity.org/research/cleartext-passwords-linux [...]

By: sherri

sherri — Thu, 31 Jul 2008 21:35:48 +0000

AW: Very interesting! I’ve just downloaded it and I’m looking forward to reading it. Thanks!

By: AW

AW — Thu, 31 Jul 2008 21:18:45 +0000

If you are interested in finding TrueCrypt keys in memory, you may want to check out the whitepaper from our BlackHat presentation:
http://www.blackhat.com/presentations/bh-dc-07/Walters/Paper/bh-dc-07-Walters-WP.pdf

By: sherri

sherri — Sat, 26 Jul 2008 21:29:04 +0000

I haven’t specifically examined encryption keys in memory, because the Princeton/EFF/Wind River team has already been studying that in-depth (specifically including Truecrypt). It’s a fascinating topic, and I’m looking forward to hearing more of their research. I believe they’ll be presenting at USENIX next week.

By: Matt Ball

Matt Ball — Fri, 25 Jul 2008 19:40:54 +0000

Have you done any similar research to find the encryption keys in memory (in particular for TrueCrypt)? With the LRW encryption mode (a deprecated mode that TrueCrypt still supports for existing encrypted partitions), if you encrypt the tweak key with itself, it’s possible to leak the key. I’d be curious about cases where the TrueCrypt memory is swapped out to an encrypted swap file.