3

After noticing the feature in Keeppass having the option to "Enable in memory protection" I began wondering, how can memory be encrypted and still be useful?

enter image description here

Without going into homomorphic encryption how does the OS actually use APIs to protect memory content? I find the wikipedia artical to be lacking of technical details of how it works. Obviously before something is used it must be decrypted so how does this work?

  • I'd call it obfuscation. If the Keepass software itself can decrypt the sensitive data, so can a process (like malware) which has access to its memory. Their "protection" may work by erasing sensitive data from memory so that generic malware that merely takes a snapshot of the RAM data may not have all the data needed to reconstruct and decrypt the data (maybe some of the data required was on disk), but malware specifically designed to steal Keepass data will steal it no matter what. – André Borie Nov 19 '15 at 21:20
2

I believe the answer can be found here, under the 'Process Memory Protection' section.

The first part:

While KeePass is running, sensitive data (like the hash of the master key and entry passwords) is stored encryptedly in process memory.

This describes the data that is stored in RAM that is encrypted, which it can do, as this data is never displayed in it's raw form to the user.

And the second part relating to your actual passwords and usernames:

Additionally, KeePass erases all security-critical memory when it's not needed anymore, i.e. it overwrites these memory areas before releasing them (this applies to all security-critical memory, not only the password fields).

This describes that your passwords are not actually encrypted whist in RAM, but are erased and the memory freed as soon as they are no longer required.

It is a little confusing that they say 'In memory protection', because as this documentation proves, this doesn't necessarily mean 'encrypted'.

  • That's kind of what I'm asking, how does KeePass store encrypted process in memory? It must be displayed in it's raw form to the user somewhere e.g. the column named 'credit card' would in fact say 'credit card'. – Celeritas Nov 12 '15 at 12:56
  • Those fields aren't stored in RAM encrypted, just erased and freed when no longer needed. – Just Lucky Really Nov 12 '15 at 13:00
  • You sure? The statement "stored encryptedly in process memory." makes it sound like they are somehow encrypted in RAM. – Celeritas Nov 13 '15 at 0:44
  • They are encrypted in memory. When they need to be used, they are decrypted, with a key that's sitting in plaintext in memory too. However, if an attacker dumps process memory and runs "strings" on it, they won't find the password; they'd have to get fancier, like looking for high-entropy sections or something. – Reid Rankin Nov 13 '15 at 2:24
  • quick note: once the database is locked, RAM no longer contains anything but the file path. There is a setting near the bottom of the Security tab to lock before hibernate (seems like a really good idea if you don't want unencrypted data on disk). – NH. Nov 27 '17 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.