Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I sometimes hear that encryption is used for the RAM Memory, but I don't really understand why this is needed.

Why is RAM Memory needed to be encrypted? and is this done by the hardware, the operating system or the application?

What kind of attacks is it preventing? Is it only useful if people has physical access to the computer or even when people can access the computer over a network?

I thought that the operating system is protecting so that the applications could not access each others memory. Isn't that enough?

Really, what is the benefits with "encrypted RAM Memory"?

share|improve this question
    
Is this just a confused marketing statement? Or can you point us to a product that does this or a use of this notion in the wild? –  nealmcb Apr 26 '11 at 17:04
add comment

5 Answers

up vote 6 down vote accepted

Encrypting RAM is about preventing unauthorized access to the RAM contents.

Under normal operating conditions, the Operating System maintains RAM access permissions and blocks applications from seeing memory from other applications; so we are talking about an attack context where the attacker plugs into the RAM "from the outside". It has been demonstrated in lab conditions. Theoretically, properly applied encryption could thwart such kinds of attack.

If RAM is encrypted, it must be decrypted automatically for usage by the CPU. The CPU does not operate on RAM directly; it loads code and data from the RAM into its internal caches. This loading/unloading process is transparent for both the applications and the operating system. This means that an automatic RAM encryption system is conceivable, but would have to be done in hardware, preferably in the CPU itself (if it was done in the RAM chips, the attacker could just freeze the RAM and then plug it into his own machine; similarly, decryption in an external RAM controller would not prevent active attacks).

Such CPU with RAM encryption exist (but are still pretty rare). This 15 years old article from Anderson and Kuhn cites the Dallas DS5002FP microprocessor, a 8051-compatible CPU, which is still in production today (the article explains that the encryption is actually quite weak).

Note that encrypted RAM (decrypted only in the CPU) cannot work well with DMA -- so disk and network accesses would be quite slow in a PC with encrypted RAM.

share|improve this answer
add comment

Having the RAM encryted helps against a live forensic analysis.

share|improve this answer
    
Sound like this can be easyli solved by limiting the physical access to the computer. –  Jonas Nov 23 '10 at 21:54
4  
@Jonas Usually when your machine is being analyzed by a computer forenser, you are somewhere under arrest. –  lbwtz2 Nov 29 '10 at 17:54
add comment

To answer you question about why you'd want to encrypt RAM and the threats posed to it:

Firstly RAM scrapers can read RAM memory for an attacker. Think about the sensitive data that used by computers: encryption keys, personal information, credit cards, and maybe even PIN numbers for Point of Sale devices. That data needs to be unencrypted to be used and if it lingers in RAM unencrypted (or the attacker gets lucky) then it is vulnerable to attack.

Since a RAM scraper is malware then an attacker does not need physical access to the computer if it can be installed remotely and is able send the data back to the attacker via a network.

If an attacker has physical access to your computer (e.g. stolen laptop) then there are other attacks which can take advantage of the time it takes between RAM losing its power supply and actually losing its state (cold boot attack). This can be used to circumvent hard disk encryption as well if the key is held in RAM.

I don't know how far encrypted RAM goes to mitigate these attacks but it probably depends on where the decryption key is kept.

share|improve this answer
add comment

Unless the OS has special support for it (and probably even then unless there is also hardware support) trying to encrypt RAM is the cryptographic equivalent of trying to make a perpetual motion machine, or trying to fly by pulling on your bootlaces. You can try but you won't get very far.

Where will you store the key? RAM.

Where will you store the data when you're processing it? RAM.

share|improve this answer
    
The key is stored in the CPU registers. Decrypted data also exists only in the CPU. –  A-B-B Apr 15 at 19:47
add comment

One of the cons is that it's slightly slower. It does prevent physical access issues. Also it can prevent access from viruses. I know on windows at least other apps can access the entire memory span.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.