Howard Chu (hyc.delete@this.symas.com) on December 2, 2018 4:53 am wrote:


> A lot of people travel with their laptop in Suspend-to-RAM state, so there's
> really no difference there. Don't take your hands off your laptop when traveling.


You are right, but I do not use Suspend-to-RAM, precisely for this reason.

Of course, it is good that everyone is able to choose what is more important for them, the convenience of Suspend-to-RAM or its security risk.

The problem with non-encrypted non-volatile DIMMs is that those would remove the possibility of choice in this matter.

If you would not like the risk, you would need to load a special kernel module or device driver, which would clear the memory at shutdown. That might be impossible in some environments and would nullify most advantages of a non-volatile memory.




>
> These days smartphones have as much RAM as laptops. People don't routinely
> walk around with their phones powered off, and phones are much more easily
> stolen than laptops. Seems like an unreasonable concern, or a risk that most
> people accept.


You are right again, but for this reason I take care to never have any sensitive information in my smartphone.

I also do not have any information stored in my laptop, when it is not in use, because I use an external SSD.

Non-encrypted non-volatile DIMMs would prevent me of following this policy, and unlike for the smartphone, I cannot avoid handling sensitive information with the laptop, because that is my main tool.



In its current form. AMD SME would not be applicable for NV DIMMs, because the encryption keys are not stored across resets.

It would have to be modified to receive the encryption key from an external source, at boot time.

Any form of storing the encryption keys inside, like in the existing SSDs with hardware encryption or in TPMs, is insecure by design and breaks the main assumption of cryptography.