How do Linux and OSX handle sensitive memory pages (e.g. cryptographic keys) when running OS is suspended to disk? If the memory image written is encrypted, how are its keys handled?
Tell me more
×
Unix & Linux Stack Exchange is a question and answer site for
users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
|
|
|
When you hibernate a computer all the memory (including all cryptographic keys) is written to the swap. I can't speak for all the Linux distributions and I am not familiar with OSX but Ubuntu uses cryptsetup and LVM by default (on the alternate install CD). The swap is a logical volume backed by the same encrypted physical volume that holds all the data. When you boot, the initramfs ask for the password, opens the encrypted volume and restores the content from swap. So in this case your keys are safe. I recommend that you try it with your system before you put any sensitive data on it. Check if the swap is encrypted and you can really resume from it. If it's not encrypted or you can't resume don't use it. Power down the computer instead. Suspend to ram prevents the keys from hitting the disk but there are ways one can get past the screensaver password. |
|||
|
|
Wikipedia entry that explains what gets preserved and what gets turned off in different power states. |
|||
|
|
