Re: [T(A)ILS-dev] BHDC11 - De-anonymizing Live CDs through Physical Memory Analysis

2011-01-14 Thread intrigeri
Hi, berta...@ptitcanardnoir.org wrote (13 Jan 2011 12:29:22 GMT) : When you luksClose a disk/volume, it's key material is forgotten by the kernel, but still in memory (if I understood how it works). But it seems that in the kernel the code to wipe a key material is already there, and used by

Re: [T(A)ILS-dev] BHDC11 - De-anonymizing Live CDs through Physical Memory Analysis

2011-01-14 Thread bertagaz
On Fri, Jan 14, 2011 at 12:26:13AM +0100, intrigeri wrote: Hi, Still, if the kexec method don't help in wiping key material, I suppose writing a very simple wrapper to cryptsetup that use luksSuspend then luskClose when cryptsetup is called to luksClose an encrypted disk might be an

Re: [T(A)ILS-dev] BHDC11 - De-anonymizing Live CDs through Physical Memory Analysis

2011-01-13 Thread bertagaz
Hi, This thread on or-talk made me discover a way that might be interesting to implement to actually wipe encrypted disks key material. When you luksClose a disk/volume, it's key material is forgotten by the kernel, but still in memory (if I understood how it works). But it seems that in the