3

I'm using sedutil and LinuxPBA for full disk encryption on my Samsung Evo 850 SSD.

Everything works fine, except that I am unable to suspend while encryption is "enabled" since the disk loses power in suspend and locks. Now, I know this is a known bug, but I can't live without suspend.

I thus have thought of two solutions:

  • Run the "disable" command before going for suspend and the "enable" when resuming.
  • Suspend to S1

I have tried the first and failed. Got locked out and running a clean install now. The latter has proved quite evasive to enable in Ubuntu, and I would prefer the first option if at all possible due to battery usage(I like to keep my laptop either on or suspended 24/7).

At the moment I've disabled encryption, but I would really like to enable it again. It's better than LUKS for me in the regard that it's hardware based and none of the partitions can be edited without unlocking.

1

Well, I am facing the same problem. Actually, not yet, but I bought an SED without knowing that limitation.

There are some SED-enabling software solutions out there that DO enable S3-suspend, but they are a) subscription-based solutions aimed at a corporate level, and b) quite expensive. And maybe they don't work with linux.

You have identified the underlying problem already: on S3, power to the drive gets cut, disabling it effectively. On resume, the drive is locked, what the data in your RAM doesn't know, so your system will crash. To circumvent this there would need to be a mechanism which somehow stores the password for unlocking in RAM and also runs first after resume to make sure the drive is accessible again. I know that this poses a severe security issue, as the key would need to be in ram all/most of the time, making it possible to be read by a malicious software. But this is not OPAL compliant. Maybe those commercial programs use the help of BIOS implementations (possibly the ATA security features?). I do think however that having the key disclosed in memory is an acceptable risk for most users and still protects against theft/spying from random encounters. It should be worth noting that also any software-based FDE also has to store the unencrypted key in RAM all the time!

I really hope that the developer of sedutil could find a way to achieve a similar solution to enable S3. It is really what hold me back from enabling the SED functionality. On the other hand, since Windows 10 also truecrypt causes a bluescreen after resuming from S3 on my(!) laptop.

  • If only :( I have turned the SED feature off for now. I always suspend my computer so that's a dealbreaker for me. – Wilhelm Erasmus Feb 19 '16 at 19:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.