Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I recently had been wondering if there is a way to erase my LUKS keys from RAM before I suspend my device (usually a laptop) to S3 mode. I am interested in a solution that would work for my / partition. The way I imagine this, I'd like my system to ask me for password again when I resume it.

If such a solution does not exist, I'm wondering if a VM-based one would work. Before suspend, the VM would also be suspended (on in some other way paused), a debugger would look for the LUKS private key, save it to some secure location, wipe all its occurrences from RAM and on power resumption, decrypt the secret using the user's password and restore it to all saved offsets. The same could probably be done with GPG/SSH/Bitcoin keys. Would this be a secure approach? If not, why?

share|improve this question

2 Answers 2

The solution is called "Hibernate" or suspend to disk.

By design, suspend to RAM wakes instantly, and is intended more as a power-saving mode than a version of "switched off".

Software can get notifications that suspend-to-ram is about to occur, and things like Password Safe programs should - and typically do - automatically clear their keys. You could readily alter e.g. SSH clients to do the same, if they don't already.

However disk encryption programmes cannot necessarily do this, as files open on those disks may need to be accessed as part of the resume process.

share|improve this answer

Non-system partition

For partitions other than the system partition you can use the following systemd unit:

[Unit]
Description=Wipe Keys before <target>
After=<target>

[Service]
Type=oneshot
ExecStart=/path/to/wipe

[Install]
WantedBy=<target>

<target> is the corresponding target of your desired mode. From the systemd-suspend.service Manpage: suspend.target, hibernate.target, or hybrid-sleep.target

And the wipe script:

dmsetup suspend "$name"
dmsetup message "$name" 0 key wipe

or if you use LUKS

cryptsetup luksSuspend <name>

After you resume your system your need to issue:

dmsetup message "$name" 0 key set  "$key"
dmsetup resume  "$name"

or

cryptsetup luksResume <name>

Virtual Machine

If you put your whole virtual machine on an encrypted disk of the host, you can use the same approach, but you need to stop the guest with "Save the system state", and ensure, that this state is also saved on the encrypted disk. Wou would prepend something like the following commands to your wipe script:

VBoxManage controlvm "$vboxname" savestate

and to resume

VBoxManage controlvm "$vboxname" resume

Keep in mind that failing to actually stop the guest would not expose your encryption keys. It would only leave the RAM of the guest unencrypted in your RAM or swap.

Full system encryption

There is a solution for Hibernation (saving RAM to the drive) with whole system encryption. Basically you also have to encrypt your swap. See here and here This does not help you when suspending to RAM.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.