3 ms·
I would venture that it does. It’s much, much more likely that forced bit-flips via RH would break decryption vs cause some malicious code execution.
by cobbzilla 8y ago
I would venture that it does. It’s much, much more likely that forced bit-flips via RH would break decryption vs cause some malicious code execution.
- nemo1618 8y agoIf the encryption has no authentication, an attacker could still conceivably flip individual bits, much like they can when attacking a stream cipher. Does the spec say that the encryption be authenticated? If so, where are the MACs stored?
- blattimwind 8y agoIntel TME uses AES-XTS, which is less malleable[1] compared to say AES-CTR, which would provide no protection against rowhammer. [1] This is a bad kind of security that's very difficult to reason about because it is unsound. This is a matter of "less worse, relatively speaking". The obviously superior and secure approach is to use AEAD, but that would be more difficult to integrate into the system.
- a1369209993 8y agoI don't think this proposal supports authenticated encryption, but if you're using ECC RAM, you could batch up groups of 8x72bit DDR lines, giving you 64 non-data bits: 10 bits for single error correction on a 576bit batch, and 54 bits for MAC. If your L3 uses 64-byte or larger cache lines, this is mostly free; you could also scale this up or down depending on how many MAC bits you want versus how large youre cache lines are.