3 ms·
If the encryption has no authentication, an attacker could still conceivably flip individual bits, much like they can when attacking a stream cipher. Does the
by nemo1618 8y ago
If the encryption has no authentication, an attacker could still conceivably flip individual bits, much like they can when attacking a stream cipher.
Does the spec say that the encryption be authenticated? If so, where are the MACs stored?
- blattimwind 8y agoIntel TME uses AES-XTS, which is less malleable[1] compared to say AES-CTR, which would provide no protection against rowhammer. [1] This is a bad kind of security that's very difficult to reason about because it is unsound. This is a matter of "less worse, relatively speaking". The obviously superior and secure approach is to use AEAD, but that would be more difficult to integrate into the system.
- a1369209993 8y agoI don't think this proposal supports authenticated encryption, but if you're using ECC RAM, you could batch up groups of 8x72bit DDR lines, giving you 64 non-data bits: 10 bits for single error correction on a 576bit batch, and 54 bits for MAC. If your L3 uses 64-byte or larger cache lines, this is mostly free; you could also scale this up or down depending on how many MAC bits you want versus how large youre cache lines are.