5 ms·
Intel TME and AMD SME (both on boot discardable unique memory encryption technologies running in silicon) are both pretty common in consumer grade hardware and
by TrueDuality 2y ago
Intel TME and AMD SME (both on boot discardable unique memory encryption technologies running in silicon) are both pretty common in consumer grade hardware and has great Linux kernel support.
Both Android and iPhone's use their secure enclave's for storing their encryption keys limiting the effective targets of these attacks (and would be quite difficult to physically extract from).
I suppose this is still useful for older hardware and ultra budget phones... But this is a protection against state actors and high end espionage which wouldn't use those classes of devices...
Soooooo who is this for? What threat model is this meaningful for? In what world am I trusting a random unaudited security module that taints my kernel for _any_ security sensitive application?
- snvzz 2y ago>great Linux kernel support For some definition of great. E.g. Ryzen-based Thinkpad, not enabled by default, hangs on boot if requested via mem_encrypt=on kernel command line[0]. https://www.kernel.org/doc/html/v5.8/x86/amd-memory-encryption.html https://www.kernel.org/doc/html/v5.8/x86/amd-memory-encrypti...
- gertop 2y agoI concur, SME on Linux is only usable in full memory encryption mode (ie the kernel doesn't even know about it) on my ryzen laptop as well.
- deleted 2y ago[deleted]