It was demonstrated that dram modules can retain information up to 10 min after power off in certain conditions. My question - are there memory types which will retain data 10 sec at max even if being frozen?

EDIT. I want to secure my code on a colocated server and avoid cold boot attack and perhaps something else which I havent heard of yet :).... My idea is to split my program onto 2 pieces and run one on a separate CPU with its own memory (the example is GPU or FPGA). However I need to find out which type of memory can be erased almost instantaneously on power off before I can take another step.


I don't think you're going to find a type of RAM that is secure against cold boot attacks.

It may be possible to build application-layer defenses against this, by ensuring that all sensitive data stored in memory is stored in encrypted form. Then when you shut down, you simply need to securely overwrite the decryption key. However, this is likely to have significant performance and implementation costs, and I would question whether it is worth it.

I think you need to do some serious introspection to determine whether the cold boot attack is really a likely attack against your system. Security always needs to be directed by deliberate risk management. With some risks, the best approach is simply to accept the risk. Alternatively, you may be able to mitigate the risk by providing physical security. For instance, if you have super-sensitive data, perhaps you don't want to store it on a machine at a colo facility: perhaps you should keep it on a machine on your own premises.

If you want to tell us more about your specific application needs and scenario, and share the risk analysis you've already done, we may be able to provide more concrete suggestions. But for now, my initial reaction would be to suspect that you're over-thinking it: for most people, the cold boot attack isn't really worth worrying about.

| improve this answer | |
  • storing outside is not an option. it is very easy to power cycle the box and then snoop all the network traffic to the box to recovery the missing data. also if application is running you will have to decrypt any part of it you are using so I am not really sure how it is possible to keep it encrypted... I would love to build something like that if you explain the plan... The application itself is the target not data. and it is not big (few Kbs). Cold boot attack is the most obvious way to get it if it is secured by TPM... – Boppity Bop Feb 21 '12 at 1:14
  • 1
    @Bobb, huh? I didn't suggest "storing outside" (whatever that means). I suggested running the application on a machine located on your own premises, and providing adequate physical security to prevent unauthorized individuals from accessing the machine. – D.W. Feb 21 '12 at 1:38

Because most manufacturers try and maximise retention at low current draw, their aim is the opposite of yours, so I think your only realistic way to do this if you have to is to add circuitry that forces an overwrite or a wipe when the case is opened.

That said - the conditions in which you can successfully carry out this attack are very limited. I would put more emphasis on prevention through procedural means or other physical controls (secure cabinets etc) - nice and simple, and suitable for most uses.

If you require more security than that, then you shouldn't be in a colocated environment.

Weigh up your real risks. Do you actually need that sort of security? Or is it much more likely someone could compromise your data another way?

| improve this answer | |
  • yes if I to move to a certain colocation I will have to counter physical access somehow. – Boppity Bop Feb 19 '12 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.