3 ms·
On my laptop with Fedora I just configured Linux to hibernate to disk after 15 minutes of suspend. Powering memory off ensures that bugs like this Debian-specif
by fpoling 3mo ago
On my laptop with Fedora I just configured Linux to hibernate to disk after 15 minutes of suspend. Powering memory off ensures that bugs like this Debian-specific would not matter.
Plus what Debian extension to Linux tooling does although nice in theory, but in practice if one really worries about cold-boot attacks, then all keys and important documents has to be wiped out from memory, not only LUKS keys.
So hibernating is really the only proper way to protect against cold boot.
- killerstorm 3mo agoHmm, where does it get a key to decrypt memory on resume? AFAIK it's practical only if you make use of TPM. And if you do, you're basically at mercy of TPM.
- teravor 3mo ago> where does it get a key to decrypt memory on resume? you enter it...
- IngoBlechschmid 3mo ago> So hibernating is really the only proper way to protect against cold boot. I agree; or resurrecting FridgeLock: https://www.sec.in.tum.de/i20/publications/fridgelock-preventing-data-theft-on-suspended-linux-with-usable-memory-encryption https://www.sec.in.tum.de/i20/publications/fridgelock-preven...
- fpoling 3mo agoInteresting idea. On the other hand on the latest SSD with hardware encryption the raw disk speed under Linux can be over 5 GB/s so on my laptop with 64 GB of RAM the full restoration from disk takes like 45 seconds. With LUKS it is like 2 times slower. Which is not a problem at all. So I do not see much value in memory encryption in suspend.