Encrypted swap -> No hibernate

Hans asked about if it is meaningless to do encryption if you just suspend/hibernate your laptop. When I answered that it did not crossed my mind that hibernation will not work, but if you think it is quit obvious. The swap is encrypted with a random key, which is generated each time the computer boot. The memory information at hibernation is stored on the swap partition and the computer will not remember what key the information was encrypted with. Therefore is it not possible to wake your computer up from the hibernation, since you do not have the key.

Okay, too bad. But if we skip to encrypt the swap, what will happened then. Is my computer safe? The thief, Bill, can either boot the computer from a liveCD or removes the hard disk from the laptop and put it in in another computer. So password on BIOS and GRUB is not enough. Bill can not access you home directory since it is encrypted. If Bill is very interested in your information he can probably break the encryption with some super-computers. Is your information that interesting? If yes, do not store it on a laptop or a computer connected to the Internet.

If Bill is more skilled in computers, he knows that the swap might be interesting. Let us do an experiment on your own computer. Can we find our own password in the data stored on the swap partition? As root, run:
grep yoursecretpassword /dev/yourswap
You can find the name of your swap partition in /etc/fstab.
When I did this on my computer I got:
Binary file /dev/myswap matches

This means that my password can be found by Bill. But how will Bill know what part of the data on the swap is a useful password. He can extract all strings from the swap that is longer than six characters:
strings -n 6 /dev/myswap
I got less than 2 000 000 possible passwords on my computer. If I remove all duplicates, I am down to 500 000. This output can then be used to crack the /etc/shadow-file in no time. When /etc/shadow is cracked Bill has access to your home directory.

I will not tell you how to crack the shadow-file. If you do not know, you probably should not know it either. The important here is to show how easy it is to find your password.

Back to the question from Hans, is it meaningless to encrypt your home partition if you do not encrypt your swap. All is about to estimate risks and probabilities. What is the chance that your computer is stolen? Will the thief just sell it to buy drugs? Will the buyer take a closer look on the computer or just install MS Windows on it? How much closer look will he take? Maybe he gives up when he finds out that home is encrypted, maybe not. How sensitive is the information?

The answers to all the questions are individual. But why not encrypt your home directory just for fun? It is so easy. It would not hurt.

Comments

Hans Persson said…
I think the vast majority of stolen laptops get reinstalled with a bootleg copy of XP immediately (unless they happen to boot into XP already, which mine doesn't).

In my opinion, the gain of encrypting is not worth the loss of suspending.
December 31, 2006 at 12:12 PM
Post a Comment

Popular posts from this blog

Circles in PostGIS

Image
OGC and PostGIS has no data type to represent a circle. Instead one use ST_Buffer(geom, distance) to get a geometry that covers the area within the distance to geom . So if geom is a point you get a circle. But it does not return an exact circle. The circle is approximated represented by a polygon using eight points. One can increase the precission by adding a third argument to ST_buffer that is the number of points in the polygon returned. The unit for distance depends on what SRID is used. But what if you have a geometry that you know is a circle created with the method above? There is no exact method as far as I know, but her comes a good approximation. First we want the origo of the circle. ST_Centroid(geom) comes to handy. It returns the centeroid point of the geometry, in this case the origo of the circle. To get the radius we pick out the first point in the polygon returned by ST_Buffer with PointN(ExteriorRing(geom),1) . We need to call ExteriorRing to get the polygon of
Read more

Create your own CA with TinyCA2 (part 1)

Image
A Certificate Authorities (CA) issues certificates to people and organization that gives us the possibility to know that we surf to the right web site and not a phising site. This concept can be nice to use on your private sites too, but you may not want to spend a lot of money to get a certificate for your site. Most common when one installs a web-mail server at home is using a self signed certificate. When one surf to the web-mail server from a friends computer one can not be sure that nobody listens to the traffic if one not verifies the signature of the self signed certificate. Maybe an easier and definitely a more scalable solution to this is to create ones own CA structure. When we are ready with this how to you will have installed a certificate on your web server, installed the root certificate into your Firefox, and you will have the root certificate stored on a USB-memory stick. First time you want to read your mail from a friends computer you install the root certificate f
Read more

Create your own CA with TinyCA2 (part 2)

Image
In part one of this series we created a root CA, a sub-CA and a certificate for our web site All certificates are stored in TinyCA2 s configuration. In this part we will: export the root CA:s certificate import the root CA:s certificate into Firefox export the certificate for the web site configure our web server to use the web site certificate To be able to import the root CA certificate to Firefox we must export it from TinyCA2. In the main window of TinyCA2, open the CA-menu and select Open CA. Select your root CA. Select Export CA Certificate in the toolbar, which is the second icon from the right. You may change the file name. Press Save when ready. Start Firefox, select the Edit-menu and Preferences. Click the Advanced icon and then the Encryption tab. Select View certificates and then the Authorities tab. You can see all the CA:s you trust. Click Import and select the file with your exported root certificate. You can in the Downloading Certificate window control what purpo
Read more