We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Hacker News·Jul 2·5 min read
Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory
TL;DR
Prior to Linux 6.9, the Linux Unified Key Setup (LUKS) would wipe disk-encryption keys from memory during suspend to enhance security. With the release of Linux 6.9, this behavior was changed, and LUKS no longer clears these keys.
✦ Why It Matters
Engineers must reassess their security protocols for systems using LUKS, especially regarding data protection during suspend states.
Key Takeaways
- Review security practices for systems using LUKS.
- Consider potential risks of suspended systems retaining encryption keys.
- Evaluate the need for additional security measures during suspend.
- Stay informed about changes in Linux kernel security features.
Full Summary
Linux Unified Key Setup (LUKS) is a standard for disk encryption on Linux systems, designed to secure data by encrypting it with a key. In previous versions, LUKS would wipe encryption keys from memory when the system entered a suspended state, reducing the risk of unauthorized access.
However, starting with Linux 6.9, this functionality was removed, meaning that encryption keys may remain in memory during suspension. This change was not accompanied by a clear rationale, leading to concerns about the security implications of potentially exposing sensitive keys.
The decision could affect systems that rely on LUKS for data protection, especially in environments where physical access to machines is possible. Engineers and researchers must now consider the risks associated with this change and evaluate their security practices accordingly.