Using Linux, I have system and swap/hibernation partitions encrypted with LUKS, and data partitions encrypted with Truecrypt, and I am wondering when I put my laptop to hibernation if the encryption keys are wiped from the RAM before the computer is shutdown, or if I have to wait a few minutes to be quite immune against cold boot attacks.
Technically I guess it is complicated for the encryption software to do that even if it detects that the laptop is going to hibernate, because if it alters the memory before it is copied to the disk then the encrypted volumes won't be restored on resume.
Probably only the kernel can safely alter the memory and not the memory image on the disk, but it would not know about the encryption keys, and would have to wipe the whole RAM, which is probably not done by default.
But maybe there is a kernel option to do that?
Or maybe it is possible to run some pm-utils script after the hibernation has completed but before the computer shuts down?
Or there is another way to run some program after hibernate but before shutdown?
Or maybe the kernel could have a more advanced option, allowing software to publish to the kernel some memory address ranges that need to be wiped after hibernate but before shutdown?
Apparently it is possible to create a shutdownramfs that gets executed after shutdown (see here for an implementation in systemd), so it would become possible to wipe the RAM there for shutdown. However it does not seem to be called for hibernation, and setup seems tricky, at least when not using systemd.