I recently had been wondering if there is a way to erase my LUKS keys from RAM before I suspend my device (usually a laptop) to S3 mode. I am interested in a solution that would work for my
/ partition. The way I imagine this, I'd like my system to ask me for password again when I resume it.
If such a solution does not exist, I'm wondering if a VM-based one would work. Before suspend, the VM would also be suspended (on in some other way paused), a debugger would look for the LUKS private key, save it to some secure location, wipe all its occurrences from RAM and on power resumption, decrypt the secret using the user's password and restore it to all saved offsets. The same could probably be done with GPG/SSH/Bitcoin keys. Would this be a secure approach? If not, why?