I've read that one of the vulnerabilites of ecryptfs is leaks to swap memory, and that the solution is to encrypt swap. But even if swap is encrypted, it's still open until I reboot. I've also read in this answer, from the designer of the ecryptfs crypto, that "eCryptfs makes no special effort to prevent key proliferation in memory". But I'm not sure if this means only while it is mounted/open.

Given the above I suspect ecryptfs doesn't guarantee that the key is removed from ram after unmounting, is that true? Does that mean that encrypted data is vulnerable between unmounting ecryptfs and rebooting?

The scenario I'm trying to protect against is one where an attacker has physical access to my running computer once, after I have closed my encrypted files. Is there a file based encryption solution for this scenario?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.