3 ms·

Isn't this basically why modern server CPUs support Secure Boot and memory encryption? If I understand it correctly, it should be possible to set up your machin

by crote 2y ago

Isn't this basically why modern server CPUs support Secure Boot and memory encryption? If I understand it correctly, it should be possible to set up your machines in such a way that 1) the server can only boot genuine firmware images, and 2) unencrypted data is only available inside the CPU itself. That is going to rule out most attacks which don't involve dragging the server into a high-end laboratory, is it not?

rollcat 2y ago
Tangential: how does memory encryption mesh with features like DMA (which I imagine would be key on high-throughput NICs)?
- bri3d 2y ago
  For DMA, DMA endpoint buffers will generally be unencrypted and live in the "host domain," outside of the secure enclave running trusted code. This has been used to construct exploits against AMD's Secure Virtualization (which relies on memory encryption), for example: https://www.usenix.org/system/files/sec19-li-mengyuan_0.pdf https://www.usenix.org/system/files/sec19-li-mengyuan_0.pdf . There are some emerging technologies like SEV-TIO and PCI-IDE which attempt to extend the trust chain down into PCIe devices, allowing trusted devices to form a relationship with trusted code in a secure execution environment: https://www.amd.com/content/dam/amd/en/documents/developer/sev-tio-whitepaper.pdf https://www.amd.com/content/dam/amd/en/documents/developer/s... Anyway, the best protection here is to terminate protocol or application-level encryption (TLS or whatever sits on top of your protocol) inside of the secure environment, so that decryption only occurs through encrypted memory. It's slower, but this way an attacker sitting as a RAM snoop could only see encrypted network traffic hit the DMA buffers, which wouldn't help them much.
- tredre3 2y ago
  This answer covers it well: https://security.stackexchange.com/a/189978 https://security.stackexchange.com/a/189978 Basically depending on the scenario, DMA region will either be unencrypted or transparently encrypted/decrypted.

by crote 2y ago

rollcat 2y ago

Tangential: how does memory encryption mesh with features like DMA (which I imagine would be key on high-throughput NICs)?

bri3d 2y ago
For DMA, DMA endpoint buffers will generally be unencrypted and live in the "host domain," outside of the secure enclave running trusted code. This has been used to construct exploits against AMD's Secure Virtualization (which relies on memory encryption), for example: https://www.usenix.org/system/files/sec19-li-mengyuan_0.pdf https://www.usenix.org/system/files/sec19-li-mengyuan_0.pdf . There are some emerging technologies like SEV-TIO and PCI-IDE which attempt to extend the trust chain down into PCIe devices, allowing trusted devices to form a relationship with trusted code in a secure execution environment: https://www.amd.com/content/dam/amd/en/documents/developer/sev-tio-whitepaper.pdf https://www.amd.com/content/dam/amd/en/documents/developer/s... Anyway, the best protection here is to terminate protocol or application-level encryption (TLS or whatever sits on top of your protocol) inside of the secure environment, so that decryption only occurs through encrypted memory. It's slower, but this way an attacker sitting as a RAM snoop could only see encrypted network traffic hit the DMA buffers, which wouldn't help them much.
tredre3 2y ago
This answer covers it well: https://security.stackexchange.com/a/189978 https://security.stackexchange.com/a/189978 Basically depending on the scenario, DMA region will either be unencrypted or transparently encrypted/decrypted.