To quote the wikipedia article on Cold Boot Attacks:

In cryptography, a cold boot attack (or to a lesser extent, a platform reset attack) is a type of side channel attack in which an attacker with physical access to a computer is able to retrieve encryption keys from a running operating system after using a cold reboot to restart the machine. The attack relies on the data remanence property of DRAM and SRAM to retrieve memory contents which remain readable in the seconds to minutes after power has been removed.

Why does storing secret encryption/ decryption keys in a removable drive help defend against cold boot attacks?

  • Please note that cold boot attack is merely an easy proxy for the old-school attack of cutting the machine apart and sniffing the bus. Cold boot is completely defeated by using SRAM but the bus is still vulnerable.
    – Joshua
    Oct 24, 2013 at 21:20
  • How is the bus still vulnerable? I had that same question in the past, and I talked with a few hardware guys who told me that it would be nearly impossible to read high speed DRAM by sniffing the bus. Of course, I didn't ask people who were DRAM specialists, but it should be worth at least something.
    – forest
    Apr 5, 2016 at 1:35

2 Answers 2


Explain why storing secret encryption/ decryption keys in a removable drive helps defend against cold boot attacks.

It doesn't.

  1. Anyone with physical access to the machine can trivially grab the removable drive and read it out. Note that I assume that the removable drive is not encrypted. The reason for this is simple: if the removable drive is encrypted we can decrypt it using the key. How can we get the key? By performing the cold boot attack. It's cold boot attacks all the way down!
  2. Assuming the above is in some really contrived example not true (the drive is in a seperate room from the computer), but the computer does use the keys, poll when the keys get read out and then immediately perform the cold boot attack.


If you store the keys on removable drive and the drive gets stolen, then it is no longer cold boot attack, as the stolen keys are not on DRAM/SRAM.

Reasonably sophisticated attacker uses the easiest attack available and therefore, it is likely not the cold boot attack.


Even if the keys are on separate device used for key loading (like USB stick), if the keys are loaded to the computers DRAM/SRAM (for purposes of using them in cryptographic processing), it is possible to use a cold boot attack against the keys. However, if the keys are also on external removable drive, the keys are just on more places: it is easier to lose one of the places with the key.

If the keys are on remote drive, be sure to protect them with some sort of authentication, including e.g. password, because it is easy to accidentally lose a stick. In addition, remote drives broke quite often (at least cheap ones) so please have a recovery strategy for loosing the remote drive.

Also note: if the keys are persistently stored on remote drive, but protected with a strong password, the cold boot attack against computer may prove more efficient means of fetching the key.


  • There is somewhat less chances of cold boot attack being applied against you
  • BUT: Using remote drive likely makes you more vulnerable to other threats
  • Overall using remote drive is likely not good means to increase your safety.
  • "remote drives broke quite often (at least cheap ones) so please have a recovery strategy for loosing the remote drive" - Or indeed a method for destroying the password on the broken drive
    – user8911
    Oct 24, 2013 at 15:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .