3 ms·
MK-TME allows having memory encrypted at run time, and the platform TPM signs an attestation saying the memory was not altered. Malicious code can't be injecte
by Borealid 7mo ago
MK-TME allows having memory encrypted at run time, and the platform TPM signs an attestation saying the memory was not altered.
Malicious code can't be injected at boot without breaking that TPM.
- fc417fc802 7mo agoSubject to the huge caveat that the attacker does not have physical access. https://tee.fail/ https://tee.fail/
- deleted 7mo ago[deleted]
- Borealid 7mo agoAn interesting implementation flaw, but not a conceptual problem with the design.
- fc417fc802 7mo agoWell, it kind of is actually. The previous iteration of the design didn't have that vulnerability but it was slower because managing IVs within the given constraints adds an additional layer of complexity. This is the pragmatic compromise so to speak. Does it count as a conceptual problem when technical challenges without an acceptable solution block your goal?
- matheusmoreira 7mo agoThis is excellent. The ability to trick remote servers into believing our computers are "trusted" despite the fact we are in control will be a key capability in the future. We need stuff like this to maintain control over our computers.