Assuming there is a LUKS volume that uses a keyfile and the keyfile is autogenerated before opening the volume and deleted after use, does changing the keyfile prevent it from being stolen from the RAM in this scenario?
Creating the LUKS volume using a keyfile:
- Create a keyfile using an OTP algorithm, like HOTP with a secret key and counter
- Store the counter value
- Create the LUKS volume and assign the keyfile
- Securely delete the keyfile
Using the volume:
- Recreate the keyfile using the secret key + counter
- Open LUKS volume via:
cryptsetup --key-file keyfile luksOpen /dev ..
- Increment the counter
- Create a new keyfile with the new counter value
- Add the new keyfile to the LUKS volume via:
cryptsetup --key-file keyfile luksAddKey /dev newkeyfile
- Remove the old key from the container via:
cryptsetup --key-file newkeyfile luksRemoveKey /dev keyfile
- Securely delete keyfile and newkeyfile
What I want to know is that if the system memory was probed after step 7 and while the volume is still mounted, would it be possible to recover the volume masterkey, or the key used to open the volume in step 2, or the new key assigned to the volume in step 5?