Does not hibernate completely void the meaning of filevault?

Question

Hi,
A though about encryption and mac os sleep modes. In leopard under some
circumstances (depending on settings and so on) the contents of RAM is
written to /var/vm/sleepimage (pmset -g), either to save battery power
or to prevent loss of data when battery is about to run out when already suspended/sleeping.
I was under the impression that when using encrypted swap, this hibernation image would also be encrypted with the users password, but I made some tests and this seems not to be the case. After hibernate and restart, the memory is restored and the running programs restarted, disk images mounted etc, without any need for the user to give a password (independently of auto-login). So - it seems all what is needed to read the cleartext data is saved on disk (or RAM?)
I found some info on the web about the different sleep modes, and I though that could be the problem. It turned out I had sleep mode 5, which means means cleartext sleepimage (I verified this - my mails are there...), but with mode 3 or 1, the image is encrypted but apparently the encryption key/password is also stored?
I think most users don't realize this ... what good is filevault or other encrypted images if the application data and open user sessions (with mounted filesystems) are stored to disk together with the key?
Many users may not even know about the hibernate feature and are not given an option to disable it. Afaik the image is quietly written, automatically (at least) when battery is running out.
Please tell me I got it all wrong - this seems to bad to be true. If someone has some details on what keys are used for the encrypted swap and hibernate it would be very interesting. In linux the typical solution (I always did this myself) is to have random new keys generated at each boot for the swap file, and a user prompt for decrypting the hibernation file.
cheers, Johan
somewhat related; http://db.tidbits.com/article/9115

Answer 1

just some details; (man pmset)
0001 (bit 0) enables hibernation; causes OS X to write memory state to hibernation image at sleep time. On
wake (without bit 1 set) OS X will resume from the hibernation image. Bit 0 set (without bit 1 set) causes
OS X to write memory state and immediately hibernate at sleep time.
0010 (bit 1), in conjunction with bit 0, causes OS X to maintain system state in memory and leave system
power on until battery level drops below a near empty threshold (This enables quicker wakeup from memory
while battery power is available). Upon nearly emptying the battery, OS X shuts off all system power and
hibernates; on wake the system will resume from hibernation image, not from memory.
hibernatemode is set to 3 (binary 0011) by default on supported portables.
Ironically, hibernate is also called 'Safe sleep'
mode 0 means off
your settings:
defaults read /Library/Preferences/SystemConfiguration/com.apple.PowerManagement
Here's the apple doc on the subject - no hint that 0 should be used to be safe.
http://images.apple.com/server/macosx/docs/LeopardSecurity_Config20080530.pdf
Message was edited by: johan.lundberg