How do Linux and OSX handle sensitive memory pages (e.g. cryptographic keys) when running OS is suspended to disk? If the memory image written is encrypted, how are its keys handled?


When you hibernate a computer all the memory (including all cryptographic keys) is written to the swap. I can't speak for all the Linux distributions and I am not familiar with OSX but Ubuntu uses cryptsetup and LVM by default (on the alternate install CD). The swap is a logical volume backed by the same encrypted physical volume that holds all the data. When you boot, the initramfs ask for the password, opens the encrypted volume and restores the content from swap. So in this case your keys are safe.

I recommend that you try it with your system before you put any sensitive data on it. Check if the swap is encrypted and you can really resume from it. If it's not encrypted or you can't resume don't use it. Power down the computer instead. Suspend to ram prevents the keys from hitting the disk but there are ways one can get past the screensaver password.

  • The way Ubuntu encrypts the swap prevents a restoration after the system hibernates. Because the encryption key is generated differently at each boot, the swap content cannot be recovered. So it is better to disable hibernation when the swap is encrypted. – Huygens Jul 6 '12 at 13:10

Wikipedia entry that explains what gets preserved and what gets turned off in different power states.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.