13 ms·
They document a "physical address based tweak". My understanding is that this is xoring a function of the physical address with each 128bit block before going i
by tux3 6y ago
They document a "physical address based tweak". My understanding is that this is xoring a function of the physical address with each 128bit block before going into AES-ECB (and that function is that same for every VM on your system).
- kop316 6y agoI only saw that in "A Comparison Study of Intel SGX and AMD Memory Encryption", which per my grandparent comment, is not a trustworthy source (they reference the whitepaper, and the whitepaper doesn't say anything about it). Is that documented in an actual AMD source, or even talk?
- tux3 6y agoAs far as I know, the whitepaper is all you will find publicly. It does mention the tweak (on page 4), only if you want the details and don't trust the third-party papers, you will have to reverse-engineer that yourself =]
- kop316 6y agoFair enough. That's what I assumed, but the HN crowd is pretty resourceful too.
- CodesInChaos 6y agoThe XTS/XEX modes would be a proper way to implement this. They use the same concept of xoring an address based tweak into the message. Two subtle but important features of these modes are: 1. the tweak is xored both before and after the permutation 2. the tweak is derived from a secret and the address in a secure way (I don't know if AMD chose such a secure mode, or used some insecure homebrew tweaking scheme)