[arch-general] Encrypted ram disk?

[Tamir Daniely]

On Tue, Oct 27, 2009 at 10:34 PM, Karol Babioch <karol at babioch.de> wrote:

> Hi,
>
> after setting up a full system encryption, which works just fine
> basically, I know want to create a ram disk.
>
> I though that /tmp could be outsourced to a ram disk, to speed things
> up.
>
> However I'm wondering whether it really makes sense to encrypt this. If
> there is someone able to read my ram, there is nothing I can do about
> it, so encryption wouldn't work, would it? Furthermore the content of
> the RAM gets encrypted when suspending, as my swap partition is
> encrypted. Moreover I think that it would slow down the ram disk, and
> that the benefit wouldn't be that great at all.
>
> So what do you think, is there any rational reason to encrypt a ram
> disk, or is it fair enough, when I just create an unencrypted one
> for /tmp?
>
> Is there anything I can read about this topic?
>
> --
> Best regards,
> Karol Babioch <karol at babioch.de>
>

Hi,

>From a technical prospective, reading ram post system shutdown or crash is
definitely possible, the data is preserved for several minutes depending on
the ram technology, and the time the data can be accessed can be increased
significantly by cooling or freezing the ram itself.

I might be wrong and this is generally speaking because I'm not a linux
expert, but in my opinion a standard home pc wouldn't manage the processing
requirements for encrypting a file system on the ram in real-time (At least
not for any reasonable encyrptions) without major slowdowns. There are
though hardware encryption solutions that could handle the workload of
encrypting the ram in real time. You can look up information on
cryptographic hardware if it interests you.

I don't think this is realistic or necessery for home systems, I personally
am not afraid of someone stealing my ram to get to my facebook password. And
of course there are a lot easier ways to get the information.

Shauros