2
$\begingroup$

I‘ve been looking around and did my research but I could not find any information if any operating system exists which would be able to encrypt all data, including RAM and the SWAP partition, to protects things while the OS is up-and-running. I found infos about disk encryption, file encryption, and much more, but I seem to have a hard time to find infos related to a “complete system being protected by the operating system”.

Simpler said: I’ld like to know if it’s possible to protect a computer system with such an OS so that – when anyone steals the hard disk of a webserver while it’s running – the thieve can’t decrypt the data.

Is there something like a fully encrypted OS, or is that impossible for some reason(s)? If, which reason(s) would that be?

Improve this question
$\endgroup$
4
  • $\begingroup$ ram encryption is not common, as the performance hit would be unacceptable in most cases. swap encryption is common, and can be done in windows and linux separate from full drive encryption $\endgroup$
    – Richie Frame
    Sep 14, 2016 at 12:39
  • $\begingroup$ I saw a build of BEAR out of Dartmouth that was fully encrypted, but i don't know the finer details. $\endgroup$
    – b degnan
    Sep 14, 2016 at 12:46
  • $\begingroup$ Full disk encryption (including swap) is easy and commonly available for most operating systems. I think on Linux you typically use LUKS for that. On Windows you'd use BitLocker or a TrueCrypt derivate. $\endgroup$
    – CodesInChaos
    Sep 14, 2016 at 13:47
  • $\begingroup$ RAM is tricky. I think Intel's SGX uses encrypted RAM. AMD is working on something for the upcoming Zen CPUs as well. $\endgroup$
    – CodesInChaos
    Sep 14, 2016 at 13:47

1 Answer 1

Reset to default
2
$\begingroup$

Yes and no.

Let's go through the requirements you have step-by-step:

So if anyone steals the hard disk [...] he cannot decrypt the data.

That is widely supported in modern operating systems and called full-disk-encryption (FDE). On Windows you'd use something like Bitlocker for this task and on Linux something like dm-crypt should do the trick. Note however that this would require entering a passphrase every, single time you boot the server up.

I mean all it's encrypted, also [...] the swap

Any decent full-disk encryption system hooks itself into the driver stack and encrypts everything going through this stack shortly before the drive is actually invoked to write, thus, as the swap is a normally written onto the drive, it will be encrypted as well by most full-disk-encryption programs.

I mean all it's encrypted, also the RAM [...]

This is where things get tricky and the answer becomes "no".
You can encrypt data in RAM, as it's just data and the algorithms don't care where the data resides. However this would also mean leaving the key in RAM, which makes this kinda pointless. BUT, there's Intel SGX and AMD's upcoming memory encryption techniques (PDF whitepaper). They both consider the OS an adversary and thus offer protection against him, even in RAM. So with a combination of standard encryption and SGX based encryption, you could get large parts of the RAM only holding encrypted content, but SGX also needs external management and because of that you can't encrypt everything in RAM (for now), as long as you don't put an encryption chip in between your CPU and the RAM. Also note: As these technologies are very recent, there isn't many products that use them right now, especially since Intel requires a business contract with SGX production-users.

"Encrypt everything" sounds nice in theory, but isn't practicable. There are trade-offs to be made. Full-disk-encryption will protect you against attackers stealing your physical disks and reading their contents and RAM-protection can at most defend against attackers who get root access and / or physically steal and try to read-out the RAM (note that RAM doesn't hold data for a long time), but the technology isn't there (yet).

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.