linux-kernel - Re: encrypted hibernation (was Re: Hibernation considerations)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b14e81f00708121930n7d9eab99r6fa776120c6287c1@mail.gmail.com>
Date:	Sun, 12 Aug 2007 22:30:39 -0400
From:	"Michael Chang" <thenewme91@...il.com>
To:	"Dr. David Alan Gilbert" <linux@...blig.org>
Cc:	"Pavel Machek" <pavel@....cz>, "Vojtech Pavlik" <vojtech@...e.cz>,
	seife@...e.de, "Rafael J. Wysocki" <rjw@...k.pl>,
	LKML <linux-kernel@...r.kernel.org>,
	"Alan Stern" <stern@...land.harvard.edu>,
	"Andrew Morton" <akpm@...ux-foundation.org>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	"Huang, Ying" <ying.huang@...el.com>,
	"Jeremy Maitin-Shepard" <jbms@....edu>,
	"Kyle Moffett" <mrmacman_g4@....com>,
	"Nigel Cunningham" <nigel@...el.suspend2.net>,
	"pm list" <linux-pm@...ts.linux-foundation.org>, david@...g.hm,
	"Al Boldi" <a1426z@...ab.com>
Subject: Re: encrypted hibernation (was Re: Hibernation considerations)

On 8/11/07, Dr. David Alan Gilbert <linux@...blig.org> wrote:
> * Pavel Machek (pavel@....cz) wrote:
> > Hi!
> >
> > > > > Two things which I think would be nice to consider are:
> > > > >    1) Encryption - I'd actually prefer if my luks device did not
> > > > >        remember the key accross a hibernation; I want to be forced to
> > > > >        reenter the phrase.  However I don't know what the best thing
> > > > >        to do to partitions/applications using the luks device is.
> > > >
> > > > Encryption is possible with both the userland hibernation (aka uswsusp) and
> > > > TuxOnIce (formerly known as suspend2).  Still, I don't consider it as a "must
> > > > have" feature for a framework to be generally useful (many users don't use it
> > > > anyway).
> > >
> > > If a user uses an encrypted filesystem, then he also needs an encrypted
> > > swap and encrypted hibernation image: Otherwise the fileystem encryption
> > > is not very useful.
> >
> > Actually, we can do most of that stuff already.
> >
> > We can encrypt filesystems, encrypt swaps (LVM), and encrypt hibernation.
>
> But can you do what my original question was; find a way to lose a luks
> encrypted device key and cleanly unmount the filesystem that was
> using it?  (and preferably put it all back together after resume).
>

If you lose the device key, how are you going to get luks to find it
again when resuming? Wouldn't it make more sense to have it remember
the key? I can't see it being advisable to allow input or similar
before resume has completed...

-- 
Michael Chang

Please avoid sending me Word or PowerPoint attachments. Send me ODT,
RTF, or HTML instead.
See http://www.gnu.org/philosophy/no-word-attachments.html
Thank you.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/