#978644 Wipe LUKS Disk Encryption Key for Root Disk from RAM during Shutdown to defeat Cold Boot Attacks from Dracut Initramfs

Package:
dracut-core
Source:
dracut
Description:
dracut is an event driven initramfs infrastructure (core tools)
Submitter:
Patrick Schleizer
Date:
2026-07-13 17:35:05 UTC
Severity:
normal
Tags:
#978644#5
Date:
2020-12-29 17:02:51 UTC
From:
To:
Dear maintainer,

systemd does not wipe the LUKS disk encryption key for root disk from
RAM during shutdown.

Quote myself [0]:
for the record and please correct me if I am wrong... Summary:


Quote systemd developer Lennart Poettering [0]:
matter what systemd does, it matters what the initrd/distro do. hence
ping the maintainers of those.


The purpose of this is to defeat a cold boot attack. [1] [2] [3] [4]

I reported this bug against Debian cryptsetup. [5]

Cheers,
Patrick

[0] https://github.com/systemd/systemd/issues/17887
[1] https://www.youtube.com/watch?v=JDaicPIgn9U
[2] https://en.wikipedia.org/wiki/Cold_boot_attack
[3] https://blog.f-secure.com/cold-boot-attacks/
[4]
https://www.usenix.org/legacy/event/sec08/tech/full_papers/halderman/halderman.pdf
[5] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978642

#978644#10
Date:
2020-12-29 17:19:38 UTC
From:
To:
Posted a feature request against upstream dracut just now:

https://github.com/dracutdevs/dracut/issues/997