1

Let's assume the host is not encrypted, and all files on it are accessible. A VM with LUKS encryption is saved, meaning its memory is now residing as a regular file on the host, does that memory also include the LUKS master key? In a recoverable format?

Improve this question
1
  • 1
    Yes. It would be strange if it was not so.
    – deviantfan
    Jun 21, 2018 at 10:08

1 Answer 1

Reset to default
3

Yes, the memory image saved on the host will contain the LUKS master key, and if a knowledgeable person were to study the memory image, they could extract the key in a usable form.

Try resuming the VM. Notice that it picks up where it left off, without asking for a disk encryption password. Since the system can't read the disk without the key, either the key must have been in the memory image already, or the guest must have recovered the key from somewhere else (maybe the host?).

But typical VM snapshotting doesn't interact with the guest at all: since the host can capture the entire state of the guest, it's simplest and most reliable to just save that state, rather than trying to communicate with an unknown guest OS that may or may not be working properly at the time. (One good use of virtual machines is debugging operating systems code.)

One easy alternative would be to let the guest make its own saved state. Tell the guest VM to suspend to disk, and it will forget the key. Then it will ask for the disk encryption password when it resumes.

Improve this answer
1
  • 1
    To be more precise, the key itself is not present in memory, but the expanded round keys are, which are of course sufficient to decrypt the disk. For some algorithms like AES, the round keys can actually be used to compute the initial key.
    – forest
    Jun 22, 2018 at 1:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.