4 ms·
Swap files are also much easier to set up than partitions if you're using full disk encryption.
by mdspan 18d ago
Swap files are also much easier to set up than partitions if you're using full disk encryption.
- demomode 15d agoSwap files are very fragile if you are using hibernation. For FDE I prefer LVM-over-LUKS and a dedicate partition
- pasc1878 15d agoMacOS seems to have no problem with hibernating and it and its predecessor NeXT have been using swap files for over 30 years.
- killerstorm 15d agoMacOS has no problem with hibernation because hardware and software are designed together: it uses TPM to manage swap encryption. I assume "BIOS" is also optimized to enable fast boot on sleep. Linux can work with TPM but it's never as smooth. (Unless I guess you make it custom for your specific setup.)
- cedilla 15d agoI have FDE with keys in the TPM. It's pretty smooth bit required a one time additional step in Fedora. It's also probably not very secure, but my threat model is simple theft.
- avhception 15d agoWhat's the benefit of using the TPM compared to a simple passphrase at boot, in that scenario?
- theblazehen 15d agoA person wouldn't be able to pull the disk to get at the information
- avhception 11d agoAssuming that the person pulling the disk doesn't have the passphrase, what's the difference?
- theblazehen 9d agoAssuming things are configured correctly, the TPM would only provide the key to unlock the drive if the correct OS has been booted. Attempting to boot from a live usb to have a look at the data wouldn't work, since the TPM wouldn't present the key required. You can see https://wiki.archlinux.org/title/Trusted_Platform_Module#PCR_policies https://wiki.archlinux.org/title/Trusted_Platform_Module#PCR... for an example of doing so
- cedilla 10d agoSorry for the late answer: the benefit is that I don't have to enter my passphrase at boot.
- gertop 15d agoWindows has no problem with hibernation and FDE and it uses a swap file. Windows and Linux run on the exact same hardware. Windows hibernation doesn't rely on secret bios features. Unreliable hibernation is 100% and undeniably a Linux problem, there is no secret advantage or conspiracy to keep it down. It's just that nobody cares enough to make Linux not suck.
- jeroenhd 15d agoThese days with cryptenroll and friends, using the TPM is hardly an issue anymore. LVM and swapfiles both work well if you just create one large "everything but EFI" encrypted volume. You'd need to keep secure boot on, preferably with your own keys loaded, to get all of the benefits, and that's a bit harder to automate. Windows does all of this and more. It's harder on Linux because of a lack of tooling/interest/business incentives, and because on average Linux users want more control over their hardware than Windows users.
- fc417fc802 15d agoHow so? It's a one time setup procedure of only a few steps to create a tiny "protective" ext4 (or whatever) partition at the front. Thereafter you configure crypttab to mount the partition via UUID with an offset and key. If you don't need to hibernate you can read the key from /dev/urandom.
- somat 15d agoFor what it's worth(not much) On OpenBSD swap is always encrypted, With or without full-disk encryption. I don't know why linux always has to make the easy things hard.