Is laptop "secure sleep" mode theoretically possible?

Yes. It could be easily achievable, although it would require kernel support do this properly.

In the suspend-to-RAM case, the key should be deleted from the RAM, and in the suspend-to-disk case, from the RAM and also from the disk (or it can be stored encrypted on the disk).

A minimal input should be also provided to get the key/reauthentication credentials in the early boot/wakeup stage.

I don't see any technical obstacles; the probable reason that it wasn't developed until now was the lack of interest. Scenarios where direct RAM access of a working laptop is a real security risk are very rare.


This would be a case for choosing Hibernate options over sleep. Sleep needs to keep the memory active, which allows for a quick boot; in sleep mode, the machine isn't completely off.

In hibernate the memory is written out to disk to allow the computer to have its power removed. This, in turn, removes the encryption key as well. This is why, in hibernate, you must enter the boot decryption key.

If security is more important than speed of 'booting' with sleep, go with hibernate.

One of the risks if it is stolen while in sleep mode is that the encryption key is stored in memory and can be read if an attacker knows how.

It's more likely that the attacker wouldn't bother recovering the encryption key. They would attempt to get OS level access at this point if they were attempting to steal your data.


Secure sensitive data (like texts of the E-mails viewed) can be anywhere in RAM, it is not enough just to preserve some encryption key (if already to go into this direction).

Having encrypted RAM may be possible but would require developments in hardware layer. RAM is random access, any cell must be possible to read at any time. This limits the choice of ciphers. But it may be possible to use a very large key that is encrypted during the sleep with the cipher of your choice.