Prosecution based on memory forensics

[Werner Koch]

On Thu, 13 Jan 2011 11:50, nils.faerber at kernelconcepts.de said:

> I could write a very simple driver which provides a mmap()able memory
> area which the application can use, protected by the kernel, and which
> will be automatically cleared upon suspend.
> Would that solve the problem?

Yes.

> How much memory are we talking about here? Bytes? Kbytes? Or Mbytes?

For gpg-agent: 32 bytes.  One memory page should be enough for any
process.


Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.