I don't have to re-enter my boot password after Sleep, so obviously the encryption key is still in memory.
Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory
11–20 of 247 posts
Re: Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory
#12[flagged]
Re: Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory
#13Re: Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory
#14I don't see any other way? When you sleep (suspend to RAM), everything is stored in RAM and is encrypted but the master key is present in kernel memory (if I recall correctly). However, if you hibernate (suspend to disk) the entire contents of RAM (including the master key) is written/encrypted to disk and the RAM is cleared. When you wake the machine up you have to re-enter the passphrase to decrypt the master key t…
Yes, if you simply suspend your laptop on most stock Linux distributions, then everything including the master key is still kept in memory. But Debian pioneered the (optional) cryptsetup-suspend addon. This issues a luksSuspend command which is supposed to wipe the key from memory, and on resume asks you to resupply your passphrase.
Up to kernel 6.8, this worked as described; starting with kernel 6.9, it silently didn't.
Re: Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory
#15Re: Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory
#16I don't have to re-enter my boot password after Sleep, so obviously the encryption key is still in memory.
Obviously your distro isn’t using cryptsetup-luksSuspend.
Re: Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory
#17Earlier quoted context omitted.
I am too lazy for that, and I hate that after boot you need to launch everything again.
You can usually change that in the settings of the Desktop environment.
There is no universal support for restoring state between the apps. For example, Terminal won't run the scripts that were running, the browser will not automatically restore the pages etc, some apps might not launch or launch with wrong state.
Gnome desktop environment cannot even remember the position and size of console windows, you are expecting too much.
Re: Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory
#18Re: Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory
#19I don't see any other way? When you sleep (suspend to RAM), everything is stored in RAM and is encrypted but the master key is present in kernel memory (if I recall correctly). However, if you hibernate (suspend to disk) the entire contents of RAM (including the master key) is written/encrypted to disk and the RAM is cleared. When you wake the machine up you have to re-enter the passphrase to decrypt the master key t…
Yes, if you simply suspend your laptop on most stock Linux distributions, then everything including the master key is still kept in memory. But Debian pioneered the (optional) cryptsetup-suspend addon. This issues a luksSuspend command which is supposed to wipe the key from memory, and on resume asks you to resupply your passphrase. Up to kernel 6.8, this worked as described; starting with kernel 6.9, it silently did…
FYI: VeraCrypt is not the defacto encryption software for Windows.
Re: Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory
#20[flagged]
I am too lazy for that, and I hate that after boot you need to launch everything again.
Suspend to (encrypted) swap might be a good middle ground between you and grandparent. Suspend to memory will (at best) protect your LUKS volume key, but other sensitive data remains.
A couple of years ago, three security researchers from the TU Munich implemented a prototype for also encrypting (most) parts of the memory just before suspend, to address this limitation; but as far as I know, it was not upstreamed or developed further: https://www.sec.in.tum.de/i20/publications/fridgelock-preven...