For maximum FileVault2 security, why is hibernation recommended?

Solution 1:

1. During normal use, the keys are stored in RAM, which makes them vulnerable to a DMA attack over Firewire or Thunderbolt (using something like Inception). This is an old set of attacks, and Apple does actually disable some of the functionality of those devices during some sleep modes (e.g., hibernatemode 25 which removes power from the RAM after dumping its contents to disk; for added security, you should also disable Fast User Switching, as it's another attack vector.)

2. That is the only thing that makes sense for Apple to do, since it's pretty trivial. More details might be culled from this analysis of FileVault 2, courtesy of a few security researchers from Cambridge.

3. RAM can also be written to (see Inception) in order to bypass the actual password; dumping to disk and reloading on wake will ensure the contents is tamper-proof.