3 ms·
> transparent memory encryption designed to support end-to-end security Does this work with process isolation? I.E. can I make it so that each process's memor
by moonchild 6y ago
> transparent memory encryption designed to support end-to-end security
Does this work with process isolation? I.E. can I make it so that each process's memory is encrypted with a different key, to prevent snooping by other processes? How (if at all) does that work with debuggers?
- jiggawatts 6y agoI'm not sure about POWER, but in AMD EPYC it is implemented at the hypervisor level. So each VM can have encrypted memory with a unique key, but within a VM the processes see unencrypted memory. It's typically implemented as an extension of the virtual memory page table, and conceptually it wouldn't be too difficult to have finer-grained keys, such as one for the kernel and one for user mode processes, or even one per process.
- moonchild 6y agoInteresting. Does that allay the concerns about speculative execution side channel leaks in cloud VMs? (Because even if you can leak data from other VMs running on the same physical device, that data will be garbage without the other VM's encryption key.)