3 ms·
It's because of vulnerabilities like this that I enable Intel's "total memory encryption" feature. No plaintext leaves the CPU package. DIMM swap attacks become
by quotemstr 4mo ago
It's because of vulnerabilities like this that I enable Intel's "total memory encryption" feature. No plaintext leaves the CPU package. DIMM swap attacks become useless. Moreover, it's basically free: the cryptography happens directly in the memory controller, in hardware, inline with the bus transactions the CPU is doing anyway.
- fsckboy 4mo agoI don't see how that solves this problem. there is a string in memory that gets saved on suspend. that string when read by the CPU has the same properties it had before. if the CPU is using rot-13, the string is still rot-13 and the attacker doesn't need to spend the compute needed to crack rot-13, the CPU will simply do that as normal.
- deleted 4mo ago[deleted]
- ltbarcly3 4mo agoThis is correct, the memory encryption stuff is to prevent side channel attacks, not secure data.
- quotemstr 4mo agoMemory encryption is secure under a certain threat model. It makes cold boot attacks, DIMM transfer attacks, and rowhammer much harder to pull off. It doesn't protect against everything and doesn't pretend to do so, but IMHO it's valuable anyway.