Subject: Re: encrypted swap?
To: Michael K. Sanders <>
From: Steven M. Bellovin <>
List: tech-security
Date: 06/04/2001 20:48:33
In message <>, "Michael K. Sand
ers" writes:

>The approach described in the paper divides swap into some number 
>count and an expiration time.

What is the point?  What is the threat model that supports such 
behavior?  More precisely, why do you want to encrypt your swap 
partition?  (Caution:  the rest of this response probably belongs in 
tech-crypto instead.)

"seized machine" attacks, not real-time attacks.  Anyone who can read 
the swap area while the machine is running presumably has root 
though anyone with operator privs can read any other private file on 
the system, though not modify it).  In other words, the risk is to 
things like PGP private keys and the like.

Given that, there's no issue of too much data encrypted with one key.  
The total amount of ciphertext available to the attacker is limited by 
the amount of swap space you have, and that's almost certainly small 
enough that you don't have to worry.

If you're using cipher block chaining, you shouldn't use one key with 
more than sqrt(blocksize) blocks of data.  Thus, for DES or 3DES, 
anything more than 2^32 8-byte blocks -- i.e., 32G -- of data would be 
a bad idea.  Most of us don't have swap areas that are that large....  
If you use AES, which has 128-bit blocks, you're safe unless your swap 
area -- the swap area you've actually *used* -- is larger than 2^4 * 2^64
bytes.  That's not within my threat model...

On the other hand, using a randomly generated key is a good idea *if* 
you have sufficiently-good random numbers available that early in the 
boot process.  

If you really want encrypted swap, and you want it with little effort, 
use CFS and swap to a file.  I ported CFS to NetBSD; you can find it
at your choice of

Follow the instructions in README.netbsd and you should be on the air.

		--Steve Bellovin,