Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

To quote the wikipedia article on Cold Boot Attacks:

In cryptography, a cold boot attack (or to a lesser extent, a platform reset attack) is a type of side channel attack in which an attacker with physical access to a computer is able to retrieve encryption keys from a running operating system after using a cold reboot to restart the machine. The attack relies on the data remanence property of DRAM and SRAM to retrieve memory contents which remain readable in the seconds to minutes after power has been removed.

Why does storing secret encryption/ decryption keys in a removable drive help defend against cold boot attacks?

share|improve this question

migrated from crypto.stackexchange.com Oct 24 '13 at 16:07

This question came from our site for software developers, mathematicians and others interested in cryptography.

    
Please note that cold boot attack is merely an easy proxy for the old-school attack of cutting the machine apart and sniffing the bus. Cold boot is completely defeated by using SRAM but the bus is still vulnerable. –  Joshua Oct 24 '13 at 21:20
add comment

2 Answers 2

Explain why storing secret encryption/ decryption keys in a removable drive helps defend against cold boot attacks.

It doesn't.

  1. Anyone with physical access to the machine can trivially grab the removable drive and read it out. Note that I assume that the removable drive is not encrypted. The reason for this is simple: if the removable drive is encrypted we can decrypt it using the key. How can we get the key? By performing the cold boot attack. It's cold boot attacks all the way down!
  2. Assuming the above is in some really contrived example not true (the drive is in a seperate room from the computer), but the computer does use the keys, poll when the keys get read out and then immediately perform the cold boot attack.
share|improve this answer
add comment

Nitpicking

If you store the keys on removable drive and the drive gets stolen, then it is no longer cold boot attack, as the stolen keys are not on DRAM/SRAM.

Reasonably sophisticated attacker uses the easiest attack available and therefore, it is likely not the cold boot attack.

Reality

Even if the keys are on separate device used for key loading (like USB stick), if the keys are loaded to the computers DRAM/SRAM (for purposes of using them in cryptographic processing), it is possible to use a cold boot attack against the keys. However, if the keys are also on external removable drive, the keys are just on more places: it is easier to lose one of the places with the key.

If the keys are on remote drive, be sure to protect them with some sort of authentication, including e.g. password, because it is easy to accidentally lose a stick. In addition, remote drives broke quite often (at least cheap ones) so please have a recovery strategy for loosing the remote drive.

Also note: if the keys are persistently stored on remote drive, but protected with a strong password, the cold boot attack against computer may prove more efficient means of fetching the key.

Summary

  • There is somewhat less chances of cold boot attack being applied against you
  • BUT: Using remote drive likely makes you more vulnerable to other threats
  • Overall using remote drive is likely not good means to increase your safety.
share|improve this answer
    
"remote drives broke quite often (at least cheap ones) so please have a recovery strategy for loosing the remote drive" - Or indeed a method for destroying the password on the broken drive –  user8911 Oct 24 '13 at 15:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.