2 ms·
Why do you need to encrypt the kernel? It should not contain any secrets and it can he signed.
by usr1106 6y ago
Why do you need to encrypt the kernel? It should not contain any secrets and it can he signed.
- jejb 6y agothe encryption of the image isn't just about protecting secrets, it's also about making sure the host owner can't tamper with the image. If the kernel isn't part of the encrypted image, it can be substituted by the host owner and the new version could leak any secret they chose. Signing, as I said in the article, is a possible solution but it's more complex to implement than simply putting everything into the encrypted image to assure being both confidential and tamper proof.