suspend to disk + cryptoswap + trousers + fingerprint

[byns]

I run a luks root on a logical volume on an X41 Thinkpad. It seems to be necessary for the swap to be encrypted so the keys don't get leaked onto the hard drive (Although with the heavy use of the key I wonder why the kernel should do that). I'd like to be able to do suspend to disk for faster boot times. This would write the ram to the swap, so even if the swap wasn't encrypted before, you would want it to be encrypted now, because this way the cryptokey is definitely written to the disk.

So now my idea. The X41 has a TPM chip. This is some high tech thing that is build to store crypto info in a secure way. So now my idea:
The kernel does the usual random encryption of the swap, but when going into suspend it writes the key to the tpm. The tpm is locked with a previously stored fingerprint.

When resuming the initrd loads trousers (the interface for the tpm), reads a fingerprint, unlocks the key, sets up the cryptoswap and finally resumes the suspended state.

Did anyone ever do that. Can I still resume even after booting into an initrd. Has anyone ever done something similar?
_________________
-----------------------------------------
It's easier to get forgiveness for being wrong than forgiveness for being
right.

[frostschutz]

[Hu]

It is not only possible, but often required, that you resume directly from the initrd. Mounting a filesystem, even as a read-only mount, when that filesystem was also mounted in a suspended image can be very dangerous. According to the TuxOnIce documentation, several people have suffered irreparable filesystem corruption because of that mistake. The documentation explains the details, but the summary is that the suspended image remembers certain things about the filesystem, and will make a mess if the filesystem is not as expected when the suspended kernel resumes.

The typical way to do software suspend is that the system boots with an initrd that prepares any devices necessary for resume, then triggers the kernel to resume. In particular, if you use an encrypted hibernation volume like you should, then the initrd should create the cryptographic mappings, but not mount any filesystems. If the resume is successful, control is never returned to the initrd, but instead resumes where the suspended kernel stopped.

I cannot speak to whether anyone has used the TPM chip and fingerprint reader as a method of securing the hibernation volume. The typical way is to have either a USB key containing the cryptographic key or to use a passphrase that can be entered on the system console.

[byns]

Thanks that answers the main question as to whether it is possible to resume from the initrd. The rest is a question of good scripting.
I would not like to save the resume password on my hard drive. There is a reason why we save hashes for the login passwords. It is possible to set up the hibernation partition with a password at boot just in case we will need it later, but I think the tpm is still nicer.
_________________
-----------------------------------------
It's easier to get forgiveness for being wrong than forgiveness for being
right.

[Hu]