Is it safe to suspend my computer if I'm using encrypted hard drive?

Question

I'm using disk encryption to protect my data and sensitive information - but only one partition.

I used to suspend my computer instead of shutting it down because of very fast resume and very low battery usage.

My question is: Is it somehow possible to access the temporarily decrypted data while my computer sleeps? or Is it insecure? Should I rather shutdown the computer instead of suspending ?

---

UPDATE

I'm using ecryptfs for encryption. So when I log in it uses my 27-long password to decrypt my data and when I log off or unmount the encrypted partition it wont be readable anymore. Probably logging off and then suspending the computer might be a solution but it isnt my question.

Answer 1

The decryption key is in active memory so it's not benefiting you. You're depending on the physical and OS level security features (exposed ports, screen locks, file shares, device drivers).

A sophisticated advesary could capture the active key or attack the operating system. Side channel attacks (e.g., http://en.wikipedia.org/wiki/DMA_attack ), weak passwords, information leaks from your running programs and operating system vulnerabilities (present or future) are all realistic attacks against such a machine.

Most theives would probably not expect encryption. They'd turn the machine off to try to get past the login screen, losing the decryption key and protecting your data.

If you're not dealing with sophisticated advesaries (e.g, law enforcement or governments), then you're probably fine. Probably.

"Hibernation" may be more secure, as the system will be "off", with the active memory stored on the encrypted volume. It depends on the details of the implementation of your hardware, encryption software and OS.

Answer 2

There are several levels of "suspension" for a computer. The basic level keeps the RAM contents untouched; the RAM is still powered. For longer suspension (often called hibernation), the RAM is written to the disk, allowing for the machine to be completely unpowered (thus without any limitation in time). Hibernation will normally be triggered automatically when the battery level is too low.

If the machine can be awakened from suspension or hibernation without typing a password or doing anything like that, then someone who steals your laptop can do the same. So, for effective protection, the system must necessarily require your password (at least) when awakening -- but it requires some configuration. If your disk encryption technology is TrueCrypt, see this page.

With well-configured disk encryption (including encryption of virtual memory files), you could reduce the problem to a laptop thief trying to read the contents of still-powered RAM (when the machine is suspended but does not hibernate yet). This has been demonstrated to be possible in lab conditions, and is often called cold boot attacks; but it is more complex and expensive than simply unplugging the hard disk. To protect against such attacks, you would have to use encrypted RAM, which will require special hardware (not off-the-shelf) because in normal computers, CPU caches are automatically flushed to RAM and the OS cannot anything against that.