Key material leak from initialized cipher?

Question

Let's imagine that cipher (say AES256 in CBC mode) is initialized when application starts:

C = cipher.Create
K = kdf(password, iterations, salt)
C.Initialize(K, iv)
burn(K) 

At this point I have initialized cipher C. Key K is burned. Cipher C will be used to encrypt/decrypt data on demand (data source is encrypted file).

If I plan to keep instance of initialized cipher C in memory for lifetime of my running application, can I assume the key material from inside initialized cipher can be captured (memory dump etc) and re-used by attacker? Or in other words, is keeping initialized cipher in memory basically equal to keeping key in memory? If so, what can be done to avoid this kind of leak?

Answer 1

Or in other words, is keeping initialized cipher in memory basically equal to keeping key in memory?

In the case of AES, yes, every time you encrypt (or decrypt) another block of data you need the key (or equivalent information, like the round keys), so the cipher instance must have it somewhere.

Other ciphers (like Keccak's AE mode) may allow encrypting more and more material without needing the actual key anymore. Even then knowing the cipher state would allow an attacker to at least decrypt later parts of the ciphertext, but not necessarily earlier parts.

If so, what can be done to avoid this kind of leak?

If there is some kind of key store and encryption facility in the OS or hardware, that could make the attacker's life more difficult, as they might need root access rather than just a view of the process memory.

However, access to the running application could allow the attacker to call into that secure facility anyway, allowing them to break the encryption even if they do not get the key. So better if the attacker does not have access in the first place. I.e. avoid security bugs that would allow memory dumps or code execution. Easier said than done, of course.