1

I have Ubuntu 19.10 with full disk encryption. The encryption is effective as long as the system is turned off or restarted. Otherwise the data is unencrypted behind a locked screen which may not be very secured.

I wish to protect against:

  1. mechanisms that bypass screen lock (I have disabled SysRq, but there might be other ways too)
  2. cold boot attacks
  3. attacks through DMA, network, WiFi/Ethernet, physical ports, etc

What's the best way to proceed? Can I have a home encryption on top of full disk encryption, and set the screen lock such that the same password will unlock and decrypt the home drive (I don't want to enter two passwords)?

Is there any secure screen lock (no bug, no vulnerability against X11 crashes, etc)?

The OS + encryption should be able to protect the system 100 percent (except for cold boot attacks which mostly aren't practical: the data rapidly deteriorates).

0

Based on my understanding what you're looking for is a combination of a few different things that are likely too broad for a single question.

This should give you an idea of how to encrypt on suspend in Linux.

Is there any secure screen lock (no bug, no vulnerability against X11 crashes, etc)?

Nothing is totally secure and immune from bugs or vulnerabilities. I would shop around and weigh different options. One thing to keep in mind is that you may face incompatibility issues between a custom lock screen application and your desktop environment (if applicable).

Can I have a home encryption on top of full disk encryption, and set the screen lock such that the same password will unlock and decrypt the home drive (I don't want to enter two passwords)?

This will depend on the implementation of your particular lock screen and encryption setup.

Protecting against cold boot attacks and physical port access or tampering are whole other issues with plenty of material written on them at your fingertips. You'll gain more traction by doing some research on each, picking out specific areas you want clarification on and asking them as separate questions.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.