grayway2 How would encrypted RAM works ?
Memory encryption works by the device securely generating random encryption keys per-boot to encrypt the memory contents, which the CPU uses to access the encrypted memory when in use.
An example of this is Intel's Total Memory Encryption and AMD Secure Memory Encryption for desktops.
Additionally you can have hardware-based memory encryption that integrates with hardware virtualization to create separate encryption keys per virtual machine to isolate them.
grayway2 What real benefits ?
Memory encryption protects against advanced forensic analysis and physical attacks targeting memory. When a device is in use the RAM stores sensitive information such as derived encryption keys and data of in-use applications. Targeted attacks may involve using a cold-boot attack or creating specialist equipment to extract the RAM to attempt brute forcing/decrypting a device with disk encryption. Having a derived encryption key from memory allows a threat actor to brute force that key (if they know the key derivation parameters) with their only bottleneck being the computational strength they have and the security of the credential the key is derived from. Since they wouldn't need to interface with the device once they have keys, they aren't restricted by the OS throttling attempts or any security features that could erase the device.
With memory encryption, a threat would need to have both a highly resourceful and sophisticated attack to access the data in-use by the processor, this being exponentially more difficult to perform than a physical attack on the memory that it would almost not be worth attempting. It could be better to get data of the device through remote attacks instead.
An example of a similar attack involving RAM dumps to brute force the device is CVE-2024-29745 - which was used against Stock OS Pixels before April 2024. We reported this vulnerability: https://discuss.grapheneos.org/d/11860-vulnerabilities-exploited-in-the-wild-fixed-based-on-grapheneos-reports
While we have other features that protect against similar attacks such as automatic inactivity reboots and zeroing of freed memory, encrypted RAM would compliment the other features very well. It is something we'd like to see mobile devices have in the future, especially future GrapheneOS devices.
You can find info of current features at: https://grapheneos.org/features#exploit-mitigations
https://grapheneos.org/features#clearing-sensitive-data-from-memory