3 ms·

Does this mitigate any kind of rowhammer attacks? The kernel will be managing the keys, but if normal programs don't have access to them they would be unable t

• cobbzilla 8y ago
  I would venture that it does. It’s much, much more likely that forced bit-flips via RH would break decryption vs cause some malicious code execution.
  • nemo1618 8y ago
    If the encryption has no authentication, an attacker could still conceivably flip individual bits, much like they can when attacking a stream cipher. Does the spec say that the encryption be authenticated? If so, where are the MACs stored?
    • blattimwind 8y ago
      Intel TME uses AES-XTS, which is less malleable[1] compared to say AES-CTR, which would provide no protection against rowhammer. [1] This is a bad kind of security that's very difficult to reason about because it is unsound. This is a matter of "less worse, relatively speaking". The obviously superior and secure approach is to use AEAD, but that would be more difficult to integrate into the system.
    • a1369209993 8y ago
      I don't think this proposal supports authenticated encryption, but if you're using ECC RAM, you could batch up groups of 8x72bit DDR lines, giving you 64 non-data bits: 10 bits for single error correction on a 576bit batch, and 54 bits for MAC. If your L3 uses 64-byte or larger cache lines, this is mostly free; you could also scale this up or down depending on how many MAC bits you want versus how large youre cache lines are.