Let's assume the host is not encrypted, and all files on it are accessible. A VM with LUKS encryption is saved, meaning its memory is now residing as a regular file on the host, does that memory also include the LUKS master key? In a recoverable format?
1
-
1Yes. It would be strange if it was not so. – deviantfan Jun 21 '18 at 10:08
2
Yes, the memory image saved on the host will contain the LUKS master key, and if a knowledgeable person were to study the memory image, they could extract the key in a usable form.
Try resuming the VM. Notice that it picks up where it left off, without asking for a disk encryption password. Since the system can't read the disk without the key, either the key must have been in the memory image already, or the guest must have recovered the key from somewhere else (maybe the host?).
But typical VM snapshotting doesn't interact with the guest at all: since the host can capture the entire state of the guest, it's simplest and most reliable to just save that state, rather than trying to communicate with an unknown guest OS that may or may not be working properly at the time. (One good use of virtual machines is debugging operating systems code.)
One easy alternative would be to let the guest make its own saved state. Tell the guest VM to suspend to disk, and it will forget the key. Then it will ask for the disk encryption password when it resumes.
-
1To be more precise, the key itself is not present in memory, but the expanded round keys are, which are of course sufficient to decrypt the disk. For some algorithms like AES, the round keys can actually be used to compute the initial key. – forest Jun 22 '18 at 1:52
