🚀 go-pugleaf

>	InfoGuard, on the other hand, is a direct extension to
>the system call processing, operates completely inside the kernel.
>InfoGuard attaches encryption passwords to UNIX processes. Passwords
>are passed to child processes just as the process' user-id and
>other inheritables.
...
>
>	Both InfoGuard and CFS are vulnerable to Memory Snooping
>attacks. In a typical memory snooping attack, a privileged user makes
>snapshot of the system memory for offline analysis. Memory snooping
>attacks are usually fruitless because it requires the sensitive
>information be loaded in the memory at the time of snooping. And 
>even when it does, to spot those information from the snapshot, and
>put them together is no easy task.

  I definitely would NOT make that last statement.
  There are two ways to 'memory snoop' the real data:

- Watch the kernel buffers for the decrypted data (fairly hard, but
do-able. I've written a program which snoop tty's using the same
technique)
- Look for the actual keys in memory (very easy). According to your own
blurb above, the keys are "passed to child processes just as the
process' user-id and ther inheritables". Presumably this is kept
somewhere in the process structure or the user credentials. This is
*very* easy to find.

  InfoGuard and CFS only provide security on machines which are "safe"
from root attacks. InfoGuard does have some very nice features, but CFS
is free. Don't believe the hype, however, that both are completely
secure unless someone wants to attack DES (or MBS?). They ARE secure if
you believe root is secure on your machine (which is definitely a
mistake unless you're being *VERY* careful about patches and access
control and know every user on the networks your machine is connected
to). :-)

-Mike Neuman
En Garde Systems
mcn@EnGarde.com