Post #3643872
2026-06-21 22:28 UTC
@nixos_org@chaos.social @leah@blahaj.social @identical9213@mastodon.social Announcing experimental secure suspend-to-RAM for NixOS
Normally (and somewhat embarrassingly, considering that it's the 21st century), full-disk encryption gives you no protection while your laptop is suspended: the keys sit in memory, susceptible to cold boot attacks and other ways of exfiltrating your RAM.
This project fixes this, by resurrecting an old kernel patch by Pali Rohár to wipe the LUKS encryption keys on suspend. Inspired by Debian's cryptsetup-suspend, but, thanks to the kernel patch, without the (harmless but) inconvenient race condition which sometimes blocks the laptop from going to sleep, and with a couple of extra precautions.
Fully supports the root filesystem being encrypted. Integration test available.
Enjoy; bug reports are welcome!
Both the kernel patch and the userspace tooling around it could be adapted to other Linux distributions.
https://codeberg.org/iblech/secure-suspend
Replies (3)
-
@mio@shrimp.mio19.uk 2026-06-21 22:38
@iblech@mathstodon.xyz @nixos_org@chaos.social @leah@blahaj.social Thank you for the work! It would be great if this could be adapted to zfs encryption
-
@jdw@mathstodon.xyz 2026-06-22 04:53
@iblech@mathstodon.xyz @nixos_org@chaos.social @leah@blahaj.social Great that you're on Codeberg now :)
-
@anselmschueler@ieji.de 2026-07-05 07:40
@iblech@mathstodon.xyz @nixos_org@chaos.social @leah@blahaj.social @identical9213@mastodon.social I don't understand this sequence of posts. Are these posts talking about subtly different issues? Or is the one-line fix mentioned in the earlier post precisely the patch mentioned here?