Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have seen on this site that many Linux users encrypt the swap partition. What are the benefits of encrypting swap?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

Encryption of swap space is used to protect sensitive information. Consider an application that deals with passwords. As long as these passwords stay in physical memory, these passwords will not be written to disk and be cleared after a reboot. If the OS starts swapping out memory pages to free space for other applications, the passwords may be written to the disk platters unencrypted. Encrypting swap space can be a solution for this scenario.

Swap partitions are not encrypted by default and should be cleared of any sensitive data before continuing.

The swap partition can hold a lot of unencrypted confidential information and the fact that it persists after shutting down the computer can be a problem.

To encrypt SWAP, see Encrypting your Ubuntu swap partition

Source:C. Brüffer

share|improve this answer
add comment

I assume you're talking about a home directory or full disk encryption installation.

Swap is allocated space on persistent storage (because it's cheaper), providing more virtual memory to the operating system. All your applications run in the virtual memory holding all unencrypted data for the operations. Chances are fairly high that portions of the data you've got on encrypted on disk are ending unencrypted on the swap storage. Also temporary in-memory stuff like encryption keys could be moved from the physical memory to swap for some time (if the kernel decides so). With a plain encryption key an attacker is for certain able to decrypt your whole hard drive.

Moreover, swap doesn't get wiped after you turn your PC off, unlike physical memory.

Also note that if you hibernate your system, all of the physical memory will be written to swap. This provides an even larger amount of data for a possible attacker.

Summarized, in the context of encryption of data on your machine, it is a very bad thing not to encrypt swap if you handle encrypted files, from a security standpoint. It can even breach the complete security you're trying to achieve.

share|improve this answer
add comment

For the same reasons you would want to encrypt main memory. Programs have clear text copies of your information and they get swapped out to disk (swap partition) by the scheduler from time to time. If one were sufficiently motivated and enabled, swap could be mined for that personal data.

However, encrypting swap doesn't matter much if you haven't encrypted your root disk.

encryption is not cheap, expect a significant performance hit.

The only folks I know who "do it all" travel extensively. If you just want to tinker, go for it.

P.S. before someone makes a wisecrack about not being able to encrypt main memory please visit http://bluerisc.com/, even the instruction set is encrypted.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.