sedutil suspend

Question

I'm using sedutil and LinuxPBA for full disk encryption on my Samsung Evo 850 SSD.

Everything works fine, except that I am unable to suspend while encryption is "enabled" since the disk loses power in suspend and locks. Now, I know this is a known bug, but I can't live without suspend.

I thus have thought of two solutions:

• Run the "disable" command before going for suspend and the "enable" when resuming.
• Suspend to S1

I have tried the first and failed. Got locked out and running a clean install now. The latter has proved quite evasive to enable in Ubuntu, and I would prefer the first option if at all possible due to battery usage(I like to keep my laptop either on or suspended 24/7).

At the moment I've disabled encryption, but I would really like to enable it again. It's better than LUKS for me in the regard that it's hardware based and none of the partitions can be edited without unlocking.

Answer 1

Well, I am facing the same problem. Actually, not yet, but I bought an SED without knowing that limitation.

There are some SED-enabling software solutions out there that DO enable S3-suspend, but they are a) subscription-based solutions aimed at a corporate level, and b) quite expensive. And maybe they don't work with linux.

You have identified the underlying problem already: on S3, power to the drive gets cut, disabling it effectively. On resume, the drive is locked, what the data in your RAM doesn't know, so your system will crash. To circumvent this there would need to be a mechanism which somehow stores the password for unlocking in RAM and also runs first after resume to make sure the drive is accessible again. I know that this poses a severe security issue, as the key would need to be in ram all/most of the time, making it possible to be read by a malicious software. But this is not OPAL compliant. Maybe those commercial programs use the help of BIOS implementations (possibly the ATA security features?). I do think however that having the key disclosed in memory is an acceptable risk for most users and still protects against theft/spying from random encounters. It should be worth noting that also any software-based FDE also has to store the unencrypted key in RAM all the time!

I really hope that the developer of sedutil could find a way to achieve a similar solution to enable S3. It is really what hold me back from enabling the SED functionality. On the other hand, since Windows 10 also truecrypt causes a bluescreen after resuming from S3 on my(!) laptop.

Answer 2

Set up Linux to be able to wake up from S3 Suspend with a Self Encrypting Drive

We will need to:

1. Set up the linux kernel to allow access to sed configurations,
2. Compile a modified version of sedutil,
3. Make a systemd service to store the hash password on the kernel itself, so it is ready to unlock the drive when waking up.

ps.:
I. the drive must have being setup with sedutil first.
II. tested on Debian Stable.
III. Before starting, backup all your data.

Configure linux kernel to allow access to SED:

edit /etc/default/grub and add "libata.allow_tpm=1" as a parameter to boot. Example:
sudo vi /etc/default/grub

GRUB_CMDLINE_LINUX_DEFAULT="libata.allow_tpm=1"

sudo update-grub

Compile a modified version of sedutil

• install dependencies
  sudo apt install build-essential autoconf pkg-config libc6-dev make g++-multilib m4 libtool ncurses-dev unzip zip git python zlib1g-dev wget bsdmainutils automake curl bc rsync cpio git nasm
• open a terminal, and run:
  git clone --branch s3-sleep-support https://github.com/badicsalex/sedutil.git
cd sedutil
autoreconf --install
make all
sudo mv sedutil-cli /opt/sedutil-cli

Make a Systemd service

• Find hashed encryption key:
  sedutil-cli --printPasswordHash <password> <device, for example:/dev/sda>

• Make the file /etc/systemd/system/sedutil-sleep.service, with the following content:

[Unit]
Description=sedutil-sleep

[Service]
Type=oneshot
ExecStart=-+/opt/sedutil-cli -n -x --prepareForS3Sleep 0 <hash> <device>
RemainAfterExit=true

[Install]
WantedBy=multi-user.target

• Enable and start service
  systemctl enable sedutil-sleep.service
systemclt start sedutil-sleep.service

References:

1. sedutil site
2. Arch Linux Documentation
3. Issue 90