4

This question is a spin-off the following one: Are encryption keys wiped from RAM before hibernate, or how to do it (Luks and Truecrypt).

In this question, an answer quoted the following message (the initial source was a comment left by a visitor on Bruce Schneier's blog):

If people use hibernate or sleep mode, or lock the keyboard, they are potentially vulnerable in other ways. Just bring the computer back up to the login prompt, and start attacking the ports looking for an unpatched vulnerability. So a computer that is not completely shut down effectively bypasses the protection of full disk encryption -- even without the cold boot memory attack.

I fully agree for the sleep mode and locked keyboard, but regarding the hibernation is there really any OS or disk encryption product that weak?

As per the different Linux boxes I went through, this scenario is clearly impossible. The hibernated boxes have got the same properties as the shut down ones (the only difference being the possibility of a configuration mistake since one must not forget to encrypt the swap partition too, since it is where the RAM data is stored during the hibernation, but this is done by default by the installer so it remains unlikely).

For this to be possible (get back to a login prompt when retrieving from hibernation without being asked for the disk encryption password) it would require that the OS stores its RAM data, including the disk encryption key, outside of the encrypted partitions, which if not caused by a configuration mistake just seems to me as a complete dumb architectural choice.

WhiteWinterWolf
  • 19,142
  • 4
  • 59
  • 107
  • 1
    Just as a note: Windows 7, 8 and 10 with BitLocker store the key during sleep but after hibernation it has to be entered again. – Josef Oct 19 '15 at 14:18
  • Related: [I am always Hibernating my System, is there any risk for my Encrypted drive with BitLocker?](https://security.stackexchange.com/q/39129/32746) – WhiteWinterWolf Aug 30 '16 at 07:31

1 Answers1

1

2 months later, there is still no evidence that computers in hibernation are less safe than shut-down computers, as far as FDE is concerned.

I therefore consider that the quoted comment was erroneous and mark this question as closed to avoid it to pop-up on SE front-page.

However, if anyone else has got such evidence or if there is any evolution of the situation, feel free to add a new answer, SE will notify me :) !

WhiteWinterWolf
  • 19,142
  • 4
  • 59
  • 107