hibernate, luksSuspend/luksResume

andy123 · 2012-05-12 19:58:22

Hi, i use archlinux on may laptop with a encrypted /home partition.
I only reboot it for kernel, graphics driver, or other system update and use hibernate (via uswsusp and hibernate-script) in every other case.

The /home partition is still opened when i resume, but thats what i want to change.
What is the easiest or smartest way to run luksSuspend on hibernate and luksResume on resume?
Should I use a initrd hook or hibernate-script in some way?

How comes I can't find anything about this in the wiki, the forums or with my favourite search engine?
Did i get something wrong and this isn't a problem or do most people simply shut down their laptop?

aesiris · 2012-05-13 12:47:51

You can encrypt the swap partition with a passphrase and open it with the encrypt hook in the initrd.

In the wiki is discussed in System_Encryption_with_LUKS#With_suspend-to-disk_support

andy123 · 2012-05-13 13:02:55

But that would decrease performance/increase hibernate time if a use a strong encryption algorithm or decrease security if I go with fast but less safe encryption.
Any other idea?

This wiki article was the reason i thought about the initd. Is it possible to apply the same method to other partitions, like /home?

Last edited by andy123 (2012-05-13 13:04:19)

George · 2012-05-13 15:49:55

If you're not encrypting your swap then you're vulnerable as it will contain parts of (or maybe all of some) files from the encrypted partition, so even if you manage to unmount your encrypted partitions during suspend you'd still be leaving yourself somewhat open as any unencrypted copies of files that were in ram will be (unencrypted) on disk.

Obviously you need to make a trade-off between security and convenience depending on who or what you're protecting against.

Personally, my laptop has encrypted root, home and swap which allows a reasonably secure hibernate. I then frequently negate most of that security by using suspend to ram since the only threat I'm concerned about is the laptop being stolen and someone running some kind of info harvester against the hard drive. As your average laptop thief isn't going to have a handy bottle of liquid nitrogen and other specialised hardware to perform a cold boot attack I'm not that worried about the data in RAM but I am careful about anything (like swap) which might survive a power off.

R00KIE · 2012-05-13 15:56:18

andy123 wrote:

But that would decrease performance/increase hibernate time if a use a strong encryption algorithm or decrease security if I go with fast but less safe encryption.

Did you actually test how much slower it is on your machine?

andy123 · 2012-05-13 17:37:36

no… but i will test it soon an post my results…

I tested hibernate with firefox, eclipse and libreoffice running. It took approximately 42 seconds from executing "hibernate" to poweroff.

I will measure resuming tomorrow.

PS: I formatted the swap-partition with "cryptsetup luksFormat" and no other parameters, the ones given in wiki didn't work for me.

If there are a lot of spelling mistakes i'm sorry but I worte this with my geeksphone

Last edited by andy123 (2012-05-13 21:44:45)

Arch Linux

#1 2012-05-12 19:58:22

hibernate, luksSuspend/luksResume

#2 2012-05-13 12:47:51

Re: hibernate, luksSuspend/luksResume

#3 2012-05-13 13:02:55

Re: hibernate, luksSuspend/luksResume

#4 2012-05-13 15:49:55

Re: hibernate, luksSuspend/luksResume

#5 2012-05-13 15:56:18

Re: hibernate, luksSuspend/luksResume

#6 2012-05-13 17:37:36

Re: hibernate, luksSuspend/luksResume

Board footer