Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm using disk encryption to protect my data and sensitive information - but only one partition.

I used to suspend my computer instead of shutting it down because of very fast resume and very low battery usage.

My question is: Is it somehow possible to access the temporarily decrypted data while my computer sleeps? or Is it insecure? Should I rather shutdown the computer instead of suspending ?


UPDATE

I'm using ecryptfs for encryption. So when I log in it uses my 27-long password to decrypt my data and when I log off or unmount the encrypted partition it wont be readable anymore. Probably logging off and then suspending the computer might be a solution but it isnt my question.

share|improve this question
5  
If you can access your files without typing in your encryption key, so can I. –  lynks Mar 27 '13 at 13:15
    
This is a very interesting question: yesterday a tool was announced (YoNTMA) that supposedly protected your pc against theft and cold boot attacks by hibernating when it detected certain things. But during hibernation, the RAM contents are written to the disk, making it even easier to recover the key..? Suspending (or sleeping) and hibernating are different things, but it's related so perhaps it'll answer my question as well. –  Luc Mar 27 '13 at 13:39
    
This article from Ars Technica should be of your interest. –  sk0yern Mar 27 '13 at 17:10

2 Answers 2

up vote 4 down vote accepted

The decryption key is in active memory so it's not benefiting you. You're depending on the physical and OS level security features (exposed ports, screen locks, file shares, device drivers).

A sophisticated advesary could capture the active key or attack the operating system. Side channel attacks (e.g., http://en.wikipedia.org/wiki/DMA_attack ), weak passwords, information leaks from your running programs and operating system vulnerabilities (present or future) are all realistic attacks against such a machine.

Most theives would probably not expect encryption. They'd turn the machine off to try to get past the login screen, losing the decryption key and protecting your data.

If you're not dealing with sophisticated advesaries (e.g, law enforcement or governments), then you're probably fine. Probably.

"Hibernation" may be more secure, as the system will be "off", with the active memory stored on the encrypted volume. It depends on the details of the implementation of your hardware, encryption software and OS.

share|improve this answer

There are several levels of "suspension" for a computer. The basic level keeps the RAM contents untouched; the RAM is still powered. For longer suspension (often called hibernation), the RAM is written to the disk, allowing for the machine to be completely unpowered (thus without any limitation in time). Hibernation will normally be triggered automatically when the battery level is too low.

If the machine can be awakened from suspension or hibernation without typing a password or doing anything like that, then someone who steals your laptop can do the same. So, for effective protection, the system must necessarily require your password (at least) when awakening -- but it requires some configuration. If your disk encryption technology is TrueCrypt, see this page.

With well-configured disk encryption (including encryption of virtual memory files), you could reduce the problem to a laptop thief trying to read the contents of still-powered RAM (when the machine is suspended but does not hibernate yet). This has been demonstrated to be possible in lab conditions, and is often called cold boot attacks; but it is more complex and expensive than simply unplugging the hard disk. To protect against such attacks, you would have to use encrypted RAM, which will require special hardware (not off-the-shelf) because in normal computers, CPU caches are automatically flushed to RAM and the OS cannot anything against that.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.