3 ms·

For whole-system RAM encryption (SME, i.e. not VMs), it's generated by the processor at boot time, and stored within it. Short of finding some sort of silicon

For whole-system RAM encryption (SME, i.e. not VMs), it's generated by the processor at boot time, and stored within it. Short of finding some sort of silicon backdoor, you can't get at it. For SEV (VM encryption), I believe the keys are managed by the hypervisor.

srcmap 9y ago
From the article: "Secure Virtualized Encyrption (SEV). SEV in many ways resembles the SME, but in this case, it enables owners to encrypt virtual machines, isolating them from each other, hypervisors, and hosting software. " Sounds like the keys are managed by VMs can isolated from hypervisors/hosting software.