Re: [PATCH encrypted swsusp 1/3] core functionality

["Rafael J. Wysocki" <rjw@sisk.pl>]

Hi,

On Thursday, 14 of April 2005 10:08, Herbert Xu wrote:
> On Thu, Apr 14, 2005 at 08:51:25AM +0200, Pavel Machek wrote:
> >
> > > This solution is all wrong.
> > > 
> > > If you want security of the suspend image while "suspended", encrypt
> > > with dm-crypt. If you want security of the swap image after resume,
> > > zero out the portion of swap used. If you want both, do both.
> 
> Pavel, you're not answering our questions.
> 
> How is the proposed patch any more secure compared to swsusp over dmcrypt?

It is for different purpose.  It is to prevent swsusp from leaving a readable
memory snapshot on the disk _after_ resume, even if the resume has _failed_
(ie if you encrypt the image during suspend and then destroy the key after
reading the image during resume, you don't need to zero out the swap partition,
which you can't do anyway if the resume has failed).  IOW, please treat it as
a more sophisticated method of zeroing out the swap partition. :-)

Arguably, using dm-crypt is more secure, but it is also more complicated from
the Joe User POV.  IMHO we should not force users to set up dm-crypt, remember
passwords etc., to get some basic security.

Greets,
Rafael


-- 
- Would you tell me, please, which way I ought to go from here?
- That depends a good deal on where you want to get to.
		-- Lewis Carroll "Alice's Adventures in Wonderland"