0

If you have full-disk (or a partition) encrypted, and your computer crashes, without the opportunity to re-encrypt the data (I'm assuming that happens with a graceful shutdown), isn't that a security risk*? How is it handled?

*The main purpose of encryption is to keep data safe in case your hard drive/ssd is physically taken from the computer, and if your system crashes while decrypted then that invalidates the entire point of encryption

0

1 Answer 1

2

There is no such thing as “re-encrypion” or “while decrypted”. Decrypted data is never written to disk. Data is decrypted on the fly when it's loaded from the encrypted disk, and encrypted on the fly when it's written to the encrypted disk.

When you enter your encryption password or insert the smartcard with the key, the system doesn't instantly decrypt all your data. What happens is that the system loads the key into memory (or unlocks the key if the key is resident in a secure enclave such as a TPM).

Therefore a crash does not leave any unencrypted data on the disk.

A crash, or even a normal shutdown, can leave unencrypted data in RAM. RAM contents become unreadable quickly after the RAM loses power, but not instantly: it takes a few seconds. Of course, having the computer stolen while powered on carries the same risk. So it's all part of the same concern: having the computer stolen while powered on or while being shut down.

2
  • Thanks, understood. Can the master decryption key itself also be found in RAM?
    – belkarx
    Commented Nov 6, 2021 at 20:06
  • 1
    @belkarx Generally, yes. Sometimes it might be kept out of RAM, but this is uncommon because it's hard to have decent performance. The key can be kept in a separate tamper-resistant hardware, but that is limited by the processor speed of this separate device and the speed of communication with that device. Another option is to keep the key in the processor registers (e.g. TRESOR, but because there aren't many registers, it takes them away from other things. So in practice, yes, the key is in RAM. Commented Nov 6, 2021 at 20:11

Not the answer you're looking for? Browse other questions tagged .