Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

How do Linux and OSX handle sensitive memory pages (e.g. cryptographic keys) when running OS is suspended to disk? If the memory image written is encrypted, how are its keys handled?

share|improve this question

2 Answers 2

When you hibernate a computer all the memory (including all cryptographic keys) is written to the swap. I can't speak for all the Linux distributions and I am not familiar with OSX but Ubuntu uses cryptsetup and LVM by default (on the alternate install CD). The swap is a logical volume backed by the same encrypted physical volume that holds all the data. When you boot, the initramfs ask for the password, opens the encrypted volume and restores the content from swap. So in this case your keys are safe.

I recommend that you try it with your system before you put any sensitive data on it. Check if the swap is encrypted and you can really resume from it. If it's not encrypted or you can't resume don't use it. Power down the computer instead. Suspend to ram prevents the keys from hitting the disk but there are ways one can get past the screensaver password.

share|improve this answer
    
The way Ubuntu encrypts the swap prevents a restoration after the system hibernates. Because the encryption key is generated differently at each boot, the swap content cannot be recovered. So it is better to disable hibernation when the swap is encrypted. –  Huygens Jul 6 '12 at 13:10

Wikipedia entry that explains what gets preserved and what gets turned off in different power states.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.