GPG stores the password after encription?

[Jacob Bachmeyer]

On 9/10/26 02:59, Werner Koch via Gnupg-users wrote:
> [...]
>
> The passphrases in the cache are actually stored encrypted in the RAM
> but obviously the symmetric key for tha is still hold in the clear in
> the RAM .-)

Suggestion/feature request:  store /N/ shadows that must be XORed 
together to recover the symmetric key.  Periodically "shuffle" the 
shadows by XORing the same random value into all of them.  (/N/ must be 
even; 2 is the simplest case.)  Initially generate the key by simply 
randomly generating the shadows.

This addresses the tail risk of memory cells "taking a set" which I 
understand can happen if the same data is stored for a very long time.  
The effect is that the state of those cells upon powerup is biased 
towards (or away---I forget which...) from the pattern that was stored 
in them.

As far as I know, the attack is theoretical, but it could be addressed 
for extra paranoia points.  :-)


-- Jacob