Re: [TuxOnIce-devel] RFC: Suspend-to-ram cold boot protection by encrypting page cache

[Jens Gustedt <Jens.Gustedt@loria.fr>]

[-- Attachment #1: Type: text/plain, Size: 1346 bytes --]

Hello Jeremy,

> Of course, hibernating to encrypted swap protects against this risk, but
> having to resort to this effectively limits the usefulness of
> suspend-to-ram.

I don't see how you come to this quick conclusion. If you are only
interested in suspend-to-ram, it is fairly easy set up dmcrypt with a
random key (determined at each boot) for your swap partition. The
performance issues are not noticeable but for extreme swap loads or
intensive parallel applications. In particular on a modern bi-core
processor you will never see a difference.

Such an approach has the advantage of crypting everything that
eventually is written to disk, in particular other privacy relevant
data such as memory used by editors or web browsers.

If you also want to do hibernation, the setup is a bit more complex,
but very much doable for an average linux user nowadays, AFAIKS
support exists in the major distributions. This works equally well
with both hibernation implementations. I use this since several years
now and I am much satisfied with the setup.

Best
Jens

--
:: INRIA Nancy Grand Est :: http://www.loria.fr/~gustedt/ ::
:: Bat B - AlGorille :::::::::::::::::: fon +33 383593090 ::
:: campus scientifique, BP 239 :::::::: gsm +33 688495246 ::
:: 54506 Vandœuvre lès Nancy, France :: fax +33 383278319 ::


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 260 bytes --]