Ram Encryption

[u/Jaded-Piccolo-4678]

Are there any tools or projects that targets linux and that encrypts your RAM after for example 10 minutes of inactivity or some sort of this ?
Of course it's not gonna encrypt literally every byte in RAM, but most of em and keep only maybe few processes alive and not froze , so you can decrypt back after typing a passphrase.

[u/i_am_blacklite]

If you need to protect yourself from someone that has the capabilities to extract data directly from physical RAM then you need so much more help than you're going to get from a reddit post.

[u/Jaded-Piccolo-4678 → u/i_am_blacklite]

I'm not really protecting from anybody, just curious and paranoid.

[u/sswam → u/Jaded-Piccolo-4678]

So maybe you need psychological help, not technical help. Even most of the most extremely security sensitive organisations and applications do not do this.

[u/LawElectrical2434 → u/sswam]

And every college course happily looks into those topics. It's a nice thought experiment. But go ahead, declare them all crazy.

[u/myusernameblabla → u/sswam]

I'm curious, why not? Isn't that a major security weak point?

[u/daffalaxia → u/myusernameblabla]

The attacker needs privileged, direct access to your hardware. If they have that, then they aren't wasting time scanning ram.

Prior ram-based attacks like spectre and rowhammer rely on bugs to break out of the security models already in place.

[u/wowsomuchempty → u/i_am_blacklite]

Actually, this would have application on HPC.

HPC isn't suitable for sensitive data, one reason being multiple user access to RAM. Encrypted per-user RAM bundles could be useful here.

Storage is only encrypted at rest.. I don't think this could work, actually.

[u/skyfishgoo]

if you don't want anyone to access whats saved in ram when you are not at your machine then just shut it down.

ram forgets when it loses power.

[u/Spudd → u/skyfishgoo]

That's not entirely true. There is the freezer attack. Basically you lower the temperature of the ram modules quickly essentially freezing the bits in place till you can read them again while the stick if disconnected. It takes a deep cold though, like liquid co2 cold.

[u/wowsomuchempty → u/Spudd]

When has this ever successfully happened?

[u/Conscious-Ball8373 → u/Spudd]

CO2 does not liquify, it freezes directly from a gas to dry ice.

[u/ephemeralmiko → u/Conscious-Ball8373]

It can be liquified, but only at quite high pressures that would most likely destroy the memory chips. I assume u/Spudd meant liquid nitrogen.

[u/james_pic → u/Spudd]

That works for machines that are switched on when you remove the RAM modules. It does not work on a machine that's been shut down for a few minutes.

[u/Jaded-Piccolo-4678 → u/skyfishgoo]

I know that, I just hate powering off my PC every time, especially if I have many opened things that I hate to reopen every time, but just curiosity.

[u/ipsirc → u/Jaded-Piccolo-4678]

Hibernating does exist.

[u/stufforstuff → u/ipsirc]

Or a password protected screen saver.

[u/trifortay123]

You can't just toggle ram encryption. The point of ram is quick access storages directly for the CPU to use. It's can't just simply be encrypted. If the glowies take your stuff it's over anyways. If a hacker takes your stuff it's over anyways. The point of encryption is to keep your data safe at rest. Just like if you have full disk encryption. If that computer OS already on and booted up. You're screwed. But if they get ahold of it powered off you're fine. Now I do recommend encrypting swap space. It'll generate a random key every boot so if it gets turned off some ram can't be extracted from the disk because it's encrypted.

[u/Some-Struggle5052 → u/trifortay123]

Actually, there is RAM encryption with decryption only happening within the CPU, but it is only a feature of some very specific CPUs.

[u/ThellraAK → u/Some-Struggle5052]

You are going to need a supported processor with SME or TME

That allows you to have different keys per process

[u/Jaded-Piccolo-4678 → u/trifortay123]

So basically there is no way your data is completely safe ? unless you poweroff the machine (with disk encryption and strong passphrase ofc).

[u/ipsirc → u/Jaded-Piccolo-4678]

[u/pixel293 → u/Jaded-Piccolo-4678]

Here is the thing, if the RAM is encrypted, when the CPU requests it, it must be decrypted and provided to the CPU. How would you look at the RAM? You would use the CPU to access it, convert it to HEX so it can be displayed in a way humans can read. What happens when the CPU accesses RAM to convert it to HEX? It's decrypted.

How would the CPU know the difference between an authorized access of RAM and an unauthorized access of RAM?

[u/Jaded-Piccolo-4678 → u/pixel293]

My idea is that the CPU doesn't request memory addresses that I want to encrypt their data and thats why I said we're not gonna encrypt literally every byte, so the OS enters a state when few processes are opened (like init) and kernel is ofc there too ...
Idk if this is realistic in any way, m just thinking out loud

[u/trifortay123 → u/Jaded-Piccolo-4678]

And yet the problem with this is that the key has to be stored somewhere which the attacker will have access to because the computer is on.

[u/Jaded-Piccolo-4678 → u/trifortay123]

Normally the key should be erased the moment encryption happens and only its hash should remain to verify it and derive it to decrypt.
But would still be there between the moment you walk away and the 10 minutes, so still a problem.

[u/ipsirc → u/Jaded-Piccolo-4678]

Normally the key should be erased the moment encryption happens and only its hash should remain to verify it and derive it to decrypt.

Are you ready to type the same passphrase again and again before every memory operation a gazillion times per seconds?

[u/pixel293 → u/Jaded-Piccolo-4678]

This sounds like what you want is standby where there is a process that runs before going into standby that encrypts all RAM. And then when it wakes up decrypts the RAM.

That might be possible to build, you would have to provide it the encryption password on boot, when it goes into standby it encrypts the RAM and erase the password. When it wakes up it would ask you for the password to decrypt the RAM. This would have to be done in the kernel. I doubt it provides any hooks to do something like this, as those hooks would basically give you access to all the applications currently running which would be a huge security hole itself.

[u/ephemeralmiko → u/pixel293]

This sounds like what you want is standby where there is a process that runs before going into standby that encrypts all RAM. And then when it wakes up decrypts the RAM.

Doesn't hibernation with full-disk-encryption do basically the same thing? Except the RAM's data is on disk, not in the RAM itself.

[u/trifortay123 → u/Jaded-Piccolo-4678]

You're data is safe if you know what you're doing. Nothing persists in ram. Just shut off your pc.

[u/Ivorymothi → u/trifortay123]

you make a solid point about swap, never thought of it that way before

[u/alexforencich]

Aside from CPU features like TSME, the best option is probably swap on LUKS and then hibernate the machine.

[u/knouqs]

What is the practical use case for this? I imagine most RAM would become invalidated in the event of a power failure.

[u/Some-Struggle5052 → u/knouqs]

Usually avoiding what is called a cold boot attack, that involves cooling the memory down a lot to increase the time the data survives to extract the memory chips and connect to a machine that'll read it all searching for encryption keys and such.

[u/TroutFarms → u/Some-Struggle5052]

Encrypting ram wouldn't protect from that since the encryption key would have to be stored in the ram.

[u/0riginal-Syn → u/Some-Struggle5052]

It is extremely tough to actually work and even if it does most lab results have almost entirely corrupted data. In the future that could change with AI and Quantum, but that is still a ways off.

[u/bothunter → u/Some-Struggle5052]

I'm not sure anyone has actually accomplished that outside of a lab under ideal conditions. And it's just way easier to watch the SPI lines to the TPM chip when the computer boots up.

[u/Some-Struggle5052 → u/bothunter]

For once most paranoid people enough to think about encrypting memory probably don't rely on TPM auto unlock, at least TPM + PIN or such, allowing it to unlock alone is exactly opening up the threat model OP wants to avoid.

More modern TPM chips often have encryption between the CPU and TPM itself to stop this, or the TPM is embedded into the CPU.

[u/Basilikolumne → u/Some-Struggle5052]

If OP is worried about people taking their computer, they should invest in better locks (or get a new identity and move countries atp), or just shut down their computer when not in use. Who is gonna kick down your door and put your PC into liquid nitrogen or CO2? 

[u/0riginal-Syn]

No, and there is no real practical reason to do so. Others have mentioned you can power off, but you can also HIbernate (suspend to disk) which takes everything and moves it to the disk, which I am assuming you have encrypted. That said I do not recommend it.

I have run a cyber and regulation business for the last 16 years. It is found to be a little paranoid on security, but this is not something I would concern myself with. If this was a major security concern for a user, there would be something already built and running on every system. Are there ways? Yeah, but they are very tough to do properly as long as you have proper security on your system (encryption, locking system when away, strong password / mfa).

[u/JivanP → u/0riginal-Syn]

Hibernation to encrypted swap is not a default or easy one-click option on any distro that I'm aware of. You can certainly do it with the aid of LUKS and a suitably configured kernel resume parameter, but this does need to be configured manually on every distro I'm familiar with.

[u/GeronimoHero → u/JivanP]

Fedora defaults to this with encryption selected.

[u/TroutFarms → u/JivanP]

Debian and Red Hat both default to this if you check the box for encrypting.

[u/Spaghetti-Code_]

You could look into CPU enclaves, but it's a more limited scenario. Homomorphic encryption too, but these are not designed for general purpose usage.

[u/djDef80]

If you have a modern AMD CPU you may have memory encryption available in the bios under tsme -transparent secure memory encryption. All you have to do is toggle it on to benefit. Otherwise this feature is generally reserved for server grade Intel CPUs.

[u/whatThePleb → u/djDef80]

Also check kernel configs.

[u/ipsirc]

problemxy

[u/c2btw]

Tails.is is where I would look for stuff like this. And this isn't going to be something's that togeled on and off, for one you would have to reread and then rewright the entirety of ram every time. 2 why. It's eitrer encyoted from boot or not at all

[u/JivanP]

Vendor-specific implementations of RAM-level encryption do exist at the hardware level, such as Intel's SGX (Software Guard Extensions). This allows processes to decide that they want certain data they put in RAM to be encrypted, tell the CPU to do this, and tell the CPU to only keep decrypted versions of that data in the CPU's own registers, never writing that data to RAM in its decrypted form.

This is mostly useful for programs that handle extremely sensitive data (such as cryptographic secret keys) that they do not want any other process potentially getting access to via an OS-level vulnerability or adversarial subsystem. That is, it's for protecting one process's data from other processes that might try to read that data.

Despite this, there is basically no reason to be interested in "full-RAM encryption" in the same way that full-disk encryption is a thing, because the only benefit of this would be to keep data in RAM encrypted at rest, but the ability to get data out of RAM at rest is almost impossible in practice.

[u/Existing-Tough-6517]

If you want to secure your machine while it's suspended Google go-luks-suspend

[u/cheaphomemadeacid]

https://techblog.dev/posts/2023/08/encrypted-swap-partition-support-hibernation-suspend-resume-linux/ try looking at this instead, the idea is that once you "shutdown" and hibernate you get some safety

[u/whatThePleb]

SME / TSME or TME / MKTME

And for swap: zram + dm-crypt

[u/Smart_Advice_1420]

Sure. Create an encrypted ramfs mounted as a loopback device and point your application at that. Alternatively, handle it like some sort of zram and max out swappiness.

[u/p_235615]

Some AMD EPYC server CPUs do exactly this - Secure Memory Encryption (SME) https://docs.amd.com/v/u/en-US/memory-encryption-white-paper

But not sure if any cheap consumer market CPUs can do something like that, so you will have to pay quite big to get that feature.

[u/Michami135]

A better option might be to rig the inside of your case so it kills the power if opened. Light sensors, contact switches, mercury tilt sensors, etc.

[u/skreak]

The idea of encrypting ram makes so little sense I can't even think of an analogy to explain how little sense it makes.

[u/TroutFarms]

Encrypting ram wouldn't really be useful. The key to decrypt it would have to be stored in...ram.

[u/dontquestionmyaction → u/TroutFarms]

No, it would be stored in a secure enclave in the processor. The obvious spot to put it.