← Back to context

Comment by justinclift

2 years ago

> ... the fact that a running system must have access to the keys means that at-rest data encryption does not buy one much protection against server compromise, especially when the system must be running much/most/all of the time.

A common approach to help mitigate this is by having the keys be fetchable (eg via ssh) from a remote server.

Preferably hosted in another jurisdiction (country) in a data centre owned by a different organisation (ie. not both in AWS).

When the encrypted server gets grabbed, the staff should (!) notice the problem and remove its ssh keys from the ssh server holding the ZFS encryption keys.

---

That being said, I'm not an encryption guy whereas some of the people in this thread clearly are. So that's just my best understanding. ;)

7 comments

justinclift

Reply
cryptonector  2 years ago

> When the encrypted server gets grabbed, the staff should (!)

If the people doing the grabbing are LEO then they have ways of taking running servers such that they keep running or otherwise don't lose what's in RAM. And if it's LEO then "the staff" should absolutely not do things that can be construed as destroying evidence.

  • justinclift  2 years ago

    > ways of taking running servers such that they keep running

    That's an interesting point. Wonder how complete that approach is, and if it maintains network connectivity between the servers they're grabbing?

    Some clustering solutions automatically reboot a server if it loses network connectivity for a short period of time (ie 1 min). That would really mess up the "preserve stuff in ram" thing, if it's purely just designed to keep a server running.

    • cryptonector  2 years ago

      There's at least two ways. One is to keep the servers powered even after they are unplugged from wall power (they have special adaptors for portable PSUs). The other is to cryogenically cool the RAM then cut the power, keep the RAM cooled, and then read it later in a lab.

      1 reply →

  • justinclift  2 years ago

    Sure, if its LEO. That's not the threat model for most organisations encrypting their data at rest though. :)

    ---

    > should absolutely not do things that can be construed as destroying evidence.

    It'd be a very long stretch to successfully argue "removing access to the key" is destroying evidence. The data would still be intact, and available, to anyone with the key.

    Just not to whoever physically grabbed the server. ;)