Re: [PATCH encrypted swsusp 1/3] core functionality

[Herbert Xu <herbert@gondor.apana.org.au>]

On Thu, Apr 14, 2005 at 08:51:25AM +0200, Pavel Machek wrote:
>
> > This solution is all wrong.
> > 
> > If you want security of the suspend image while "suspended", encrypt
> > with dm-crypt. If you want security of the swap image after resume,
> > zero out the portion of swap used. If you want both, do both.

Pavel, you're not answering our questions.

How is the proposed patch any more secure compared to swsusp over dmcrypt?

In fact if anything it is less secure.  If I understand correctly the
proposal is to store the key used to encrypt the swsusp image in the
swap device.  This means that anybody who gains access to the swap
device can trivially decrypt it.

Compare this to the properly setup dmcrypt case where the swap
device can only be decrypted with a passphrase obtained from the
user at resume time.

> I want security of the swap image, and "just zeroing" is hard to do in
> failed suspend case, see previous discussion.

As to the failed suspend case, the two approaches yield identical
results.  In both cases we will be storing potentially sensitive
data encrypted on a physical storage device.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/