> So hibernating is really the only proper way to protect against cold boot.
replyI agree; or resurrecting FridgeLock: https://www.sec.in.tum.de/i20/publications/fridgelock-preven...
Interesting idea. On the other hand on the latest SSD with hardware encryption the raw disk speed under Linux can be over 5 GB/s so on my laptop with 64 GB of RAM the full restoration from disk takes like 45 seconds. With LUKS it is like 2 times slower. Which is not a problem at all. So I do not see much value in memory encryption in suspend.
replyHmm, where does it get a key to decrypt memory on resume?
replyAFAIK it's practical only if you make use of TPM. And if you do, you're basically at mercy of TPM.
> where does it get a key to decrypt memory on resume?