47 ms·
Can someone explain the context here? Is the intended use for this to prevent a cold boot attack, or also provides protection against an active buffer overflow
by cypherpunks01 9y ago
Can someone explain the context here? Is the intended use for this to prevent a cold boot attack, or also provides protection against an active buffer overflow attack or something?
Intel ME can obviously still lookup this key..
- tedunangst 9y agoVM isolation. Once the key is set, a subverted hypervisor won't be able to read other machines' memory. (Modulo side channels...)
- ENOTTY 9y agoOn the first page of the Introduction, it's clear that the ME should not have access to the actual key in TME. In MKTME, there seems to be one key that is held only by the CPU while the others can be provided by software. I think the use case for this is a) to defend runtime application memory on systems that use non-volatile memory as RAM (e.g., 3D XPoint), b) to defend against cold boot attacks, and c) to defend against attacks where one VM can read the data pages of another VM, possibly through an re-assignment of a previously used and uninitialized memory page.