3 ms·

So with AMDs SEV (and I'm guessing similar systems) what's the interface by which a customer will get that information? What I'm interested in is, is there not

So with AMDs SEV (and I'm guessing similar systems) what's the interface by which a customer will get that information? What I'm interested in is, is there not a CSP controlled API between the literal hardware and the CSP customer, that might be subject to attack?

mjg59 4y ago
The OS running inside the VM hits an external API (one you control, not the CSP), that returns a challenge, the CPU signs a response that includes that challenge and its state, you verify that the signature chains back to AMD. The CSP isn't directly involved in the exchange.
- raesene9 4y ago
  So the CSP has physical access to the CPU (and the rest of the hardware), is it possible to attest that it hasn't been tampered with after it leaves the CPU manufacturer's control? (I'm not saying that's it's in anyway easy to modify, but if our threat model here is a malicious company with the resources of AWS/Azure/GCP then it seems sensible to consider even difficult attacks)
  - m1ghtym0 4y ago
    The thing you're looking for is called remote attestation. That means there is a direct channel from the hardware to the user that attests the confidentiality and integrity of the VM. Such attestation statement is signed by a key burned into the CPU at production time. The remaining attack vector is leaking that key from the hardware itself. There is academic research on this topic. In essence, while technically possible, it is considered not practical, especially not at scale.
- candiddevmike 4y ago
  Do you know of anyone offering this at the moment? I wonder if you could use that for Vault authentication somehow.
  - derpsteb 4y ago
    Constellation (a Kubernetes distro) [1] on Azure would give you this attestation feature. You could then run sth like HashiCorp's Vault in that cluster. You will know that all nodes of that cluster are in the state that you expect them to be through the attestation statement. [1] https://github.com/edgelesssys/constellation https://github.com/edgelesssys/constellation Disclaimer: I work for Edgeless Systems.

mjg59 4y ago

The OS running inside the VM hits an external API (one you control, not the CSP), that returns a challenge, the CPU signs a response that includes that challenge and its state, you verify that the signature chains back to AMD. The CSP isn't directly involved in the exchange.

raesene9 4y ago
So the CSP has physical access to the CPU (and the rest of the hardware), is it possible to attest that it hasn't been tampered with after it leaves the CPU manufacturer's control? (I'm not saying that's it's in anyway easy to modify, but if our threat model here is a malicious company with the resources of AWS/Azure/GCP then it seems sensible to consider even difficult attacks)
- m1ghtym0 4y ago
  The thing you're looking for is called remote attestation. That means there is a direct channel from the hardware to the user that attests the confidentiality and integrity of the VM. Such attestation statement is signed by a key burned into the CPU at production time. The remaining attack vector is leaking that key from the hardware itself. There is academic research on this topic. In essence, while technically possible, it is considered not practical, especially not at scale.
candiddevmike 4y ago
Do you know of anyone offering this at the moment? I wonder if you could use that for Vault authentication somehow.
- derpsteb 4y ago
  Constellation (a Kubernetes distro) [1] on Azure would give you this attestation feature. You could then run sth like HashiCorp's Vault in that cluster. You will know that all nodes of that cluster are in the state that you expect them to be through the attestation statement. [1] https://github.com/edgelesssys/constellation https://github.com/edgelesssys/constellation Disclaimer: I work for Edgeless Systems.