reedalex01

The original cold boot paper was released in 2008 and they only demonstrated the attack on DDR2 memory [1]. A paper published in 2013 [2] discussed cold boot on modern hardware.

"This study is based on 5 different computer systems. While we demonstrate that simple warm reset attacks (not cutting power) are effective even against DDR3 systems, we were not able to detect any data remanence for DDR3 after cold boots. Even cooling the RAM chips did not reveal data remanence beyond cold boots. This leads us to the claim that cold boot attacks relying on RAM remanence beyond cold boots are not possible against modern DDR3 RAM chips."

[1] https://www.usenix.org/legacy/event/sec08/tech/full_papers/h...

[2] http://www1.cs.fau.de/filepool/projects/coldboot/fares_coldb... (search for DDR3 to find the relevant sections)

More info on their relationship with Debian: https://tails.boum.org/contribute/relationship_with_upstream

"For various reasons Tails tries to diverge by the smallest possible amount from its upstream projects, and especially from Debian"

"We try to push our changes upstream when we need to modify software we ship. This often requires us to write code in a generic way, rather than implementing ad-hoc hacks to fit our specific needs: e.g. we often need to make the stuff we need opt-in and add configuration options."

The official term for this is "Debian derivative" rather than "fork."

OpenVPN defaults to tunneling over UDP, but optionally supports TCP. SSH is always over TCP. Here's a bit of info from the man page [1] for anyone who's curious:

" OpenVPN is designed to operate optimally over UDP, but TCP capability is provided for situations where UDP cannot be used. In comparison with UDP, TCP will usually be somewhat less efficient and less robust when used over unreliable or congested networks."

[1] https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage

More detailed info: http://sites.inka.de/sites/bigred/devel/tcp-tcp.html

You can use LVM to make the swap partition inside the encrypted container. If you don't want to use LVM, you can just use a swap file on an encrypted partition (but this isn't supported with btrfs).

Speed isn't the only consideration. If you're using disk encryption, the only way to remove keys from RAM is to power off or hibernate. Preserving state between sessions with hibernation is much more convenient. Also, Linux only uses RAM * 2/5 as the size of the hibernation image [1]. You can make this even smaller by changing /sys/power/image_size. So with 16GB of RAM, it only has to write/read about 6.4GB.

[1] https://www.kernel.org/doc/Documentation/power/interface.txt

In this case it will just prompt you for for the recipient. This command is too verbose though. You can type:

gpg -e file

The output will be file.gpg. It will ask you for a recipient unless you have "default-recipient" or "default-recipient-selt" set in gpg.conf.