Fedora reawakens the hibernation debate [LWN.net]

Fedora reawakens the hibernation debate

Posted Sep 17, 2018 13:40 UTC (Mon) by cortana (subscriber, #24596)
Parent article: Fedora reawakens the hibernation debate

Enabling Secure Boot should have the desirable side-effect of disabling hibernation... :)

Fedora reawakens the hibernation debate

Posted Sep 17, 2018 17:24 UTC (Mon) by pkern (subscriber, #32883) [Link]

Windows does this just fine on a Secure Boot system. In fact it exactly does suspend then hibernate if you wait too long.

Fedora reawakens the hibernation debate

Posted Sep 20, 2018 14:37 UTC (Thu) by yaap (subscriber, #71398) [Link] (1 responses)

Secure boot disabling hibernation is something I find frustrating. I understand the rationale to do this by default, as it's difficult to know if the location where the RAM is saved is secured.

But with Debian at least, it's not a problem to have the swap (used for hibernation) on a LUKS partition. The Debian initrd just ask for the key at boot, and resume works perfectly fine. So the hibernation data is as safe as the OS itself. In this case, it would be nice to be able to say "don't disable hibernation" while using secure boot, with some kernel parameter for example (if such way exists, I missed it). So keep the current default, but offer a way to bypass it if needed.

As it is, I have to keep secure boot disabled to use hibernate.

Fedora reawakens the hibernation debate

Posted Sep 21, 2018 8:04 UTC (Fri) by cortana (subscriber, #24596) [Link]

I wonder how Windows does it. Also whether, upon hibernation a new key can be generated for the hibernation data, and then stored in the TPM to be used to recover on the next boot without human intervention.

OTOH, maybe this is all pointless given the increasing accessibility of cold boot attacks... after reading e.g., <https://thehackernews.com/2018/09/cold-boot-attack-encryp...> I wonder if the days of having the encryption key ever stored in RAM need to come to a close.