3 ms·
That is not the case for the latest CPU extensions for encrypted VMs, AMD SEV-SNP and Intel TDX, which are designed to allow remote attestation based on a key h
by comex 3y ago
That is not the case for the latest CPU extensions for encrypted VMs, AMD SEV-SNP and Intel TDX, which are designed to allow remote attestation based on a key hidden in the CPU that the hypervisor does not get access to.
The hypervisor only ever sees the VM’s memory in encrypted form, and it’s integrity-checked by the CPU to prevent replay attacks.
- immibis 3y agoSGX has been bypassed with hypervisor access. I'm sure the new extensions are different, but have similar fundamental flaws. Besides, a nation-state actor can compel Intel to disclose your CPU's key.