Enable Hibernate With Encrypted Swap

Raison d'Etre

Many people have asked how to get hibernation to work with encrypted folders. The problem is that the swap partition is also encrypted, but with a random key, so on restarting there is no way to resume.
Now sharney, who uses Linux Mint, has found a way to solve this problem (on Mint, of course). The idea is to replace the random key with a password of your choice (you could use the same password as your login, but see Disclaimers and Warnings below, point 6).
Ubuntu is a little different from both Mint (despite Mint's origins in Ubuntu) and from sharney's situation, who uses full-disk encryption.

Disclaimers and Warnings

This tutorial uses the Terminal. If you do not know how to use it, please find out before proceeding.
This procedure was tested both on a virtual machine using Virtual Box and on a native installation. The Virtual Box had a strange problem — when resuming, the screen remained black, although the applications were still open and working. But the native installation worked correctly.
This procedure was tested on Ubuntu 12.04 (fully updated). Do not assume it will work on other versions or distributions.
It has also been tested to work to set up encrypted swap without hibernate on Linux Mint 20 (based on Ubuntu 20.04 LTS), so it is likely that these instructions will also work with other versions of Ubuntu.
Canonical does not support this function (yet), so use it at your own risk.
Please follow the instructions carefully, otherwise you may find your system unable to boot (but you can recover with the Recovery Option or a Live CD).
If more than one person uses your machine, every user will need to know the encryption password for the swap.

Explanation

Your existing encrypted swap partition uses a random key, generated each time you boot.
You will be replacing that random key method with a fixed key using a password of your choice. This password must be typed into the computer every time it is started or resumed from hibernation, whether by you or a different user.
It is possible to replace the password with a file, meaning that you wouldn't have to remember an extra password — but that file would be visible to anyone with physical access to your computer (e.g. via a Live USB).
If you forget your password, you will still be able to boot (after trying three times), but you won't have a swap partition. However, you can repeat this How-To to set it up again, so it's not a big deal.

Preparation

Your computer must already be set up for encryption. If not, follow instructions in Post Installation Encryption first.
Think of a password (or passphrase) for your swap partition. You can use the same as your log-in — but don't do that if other people have accounts on your computer! (See Disclaimers and Warnings point 6.)
Find out which is your encrypted swap partition.
```
 swapon --summary
```
You should see output similar to:
```
 Filename                        Type            Size    Used    Priority
 /dev/mapper/cryptswap1          partition       1998844 0       -1
```
If you do not see cryptswap1, the partition is either unencrypted or is not encrypted to Ubuntu's standard.

Find the hardware device for your encrypted swap partition.

 sudo cryptsetup status cryptswap1

Output should be similar to

 /dev/mapper/cryptswap1 is active and is in use.
   type:    PLAIN
   cipher:  aes-cbc-essiv:sha256
   keysize: 256 bits
   device:  /dev/sda1
   offset:  0 sectors
   size:    3997696 sectors
   mode:    read/write

Make a note of the device. The one in the example says /dev/sda1 — but yours could be something else, e.g. /dev/sdb3.

Back up.

How to Set Up Encrypted Swap with a Fixed Key

Turn off swap.
```
 sudo swapoff /dev/mapper/cryptswap1
```

Undo the existing mapping.

 sudo cryptsetup luksClose /dev/mapper/cryptswap1

Set up swap again, but this time with your chosen passphrase. The command will prompt you, twice, for your passphrase. Replace /dev/sdXN with the device from Preparation point 4. (The following command wraps on the browser screen, but it is a single command that you need to type.)
```
 sudo cryptsetup luksFormat --cipher aes-xts-plain64 --verify-passphrase --key-size 256 /dev/sdXN
```
Output should be:
```
 WARNING!
 ========
 This will overwrite data on /dev/sda1 irrevocably.
 Are you sure? (Type uppercase yes):
 Enter LUKS passphrase:
 Verify passphrase:
```
Type YES and enter your passphrase twice as prompted.
Re-map the swap. Replace /dev/sdXN with the device from Preparation point 4.
```
  sudo cryptsetup luksOpen /dev/sdXN cryptswap1
```
Set up the partition as swap.
```
 sudo mkswap /dev/mapper/cryptswap1
```
Turn on the swap (so it starts working again).
```
 sudo swapon --all
```

Check that it is working.

 swapon --summary

You should see output similar to this (the numbers may differ).

 Filename                        Type            Size    Used    Priority
 /dev/mapper/cryptswap1          partition       1996796 0       -1

Using gksudo with your favorite editor (the default for Ubuntu is gedit), edit the file /etc/crypttab. Comment out the existing line by adding # to the front (or just delete the line), and add the following line. Replace /dev/sdXN with the device from Preparation point 4.
```
 cryptswap1   /dev/sdXN   none   luks
```
Note: This step is only necessary for older versions of Ubuntu (13.04 or older, confirmed not necessary for 14.04).
Edit the file /usr/share/initramfs-tools/scripts/local-top/cryptroot. Search for the following line (should be line 288, but this could change over time):
```
 message "cryptsetup: unknown error setting up device mapping"
```
Skip to the next blank line (should be 291, before FSTYPE=''), and insert the following line. Replace /dev/sdXN with the device from Preparation point 4.
```
 /sbin/cryptsetup luksOpen /dev/sdXN cryptswap1
```
Note: This step is only necessary for older versions of Ubuntu (13.04 or older, confirmed not necessary for 14.04).
Edit the file /etc/acpi/hibernate.sh. At the first blank line, insert the following line.
```
 DEVICE='/dev/mapper/cryptswap1'
```
Edit the file /etc/initramfs-tools/conf.d/resume. Replace the existing RESUME line with the following line.
```
 RESUME=/dev/mapper/cryptswap1
```
If the file does not exist, create it with only that line.
IMPORTANT: Whenever new kernels are installed, this step must be repeated
Register these changes.
```
 sudo update-initramfs -u -k all
```
IMPORTANT: Whenever new kernels are installed, this step must be repeated and then the machine MUST be rebooted

New Swap First Time Use

Reboot your machine.
You will receive a prompt for swap's encryption passphrase. Remember that your mouse does not work at this point. Type your passphrase and press Enter.
If you mistype a passphrase three times, the system will boot anyway but without your swap enabled. Repeat the How-To if you have forgotten your passphrase.
After correctly typing your passphrase:

How to Enable Hibernate

See the official documentation on how to test if hibernate works for your computer, and how to enable the hibernate option in the Unity power menu.

Originally posted The Ubuntu Forums (ubuntuforums.org)

Ubuntu Documentation

EnableHibernateWithEncryptedSwap