Hacker News new | past | comments | ask | show | jobs | submit login
Intel Memory Encryption Technologies [pdf] (intel.com)
59 points by ingve on Dec 26, 2017 | hide | past | favorite | 10 comments



Seems similar to the technologies already adopted by AMD's Ryzen (EPYC):

https://www.anandtech.com/show/11551/amds-future-in-servers-...


I'd rather they opened up Intel CAT to consumer products to help protect against side channel attacks. Memory encryption isn't enough and doesn't address current exploits that are already being used against VM providers.


I'm not aware of any stories of side-channel attacks being executed in the wild. Do you have links to any such post-mortems?


The sorts of organizations which get targeted by attackers sophisticated enough to use side channel attacks generally don't publish post-mortems.

But I've heard enough through unofficial channels to be very very confident that such attacks are indeed taking place.


Can someone explain the context here? Is the intended use for this to prevent a cold boot attack, or also provides protection against an active buffer overflow attack or something?

Intel ME can obviously still lookup this key..


VM isolation. Once the key is set, a subverted hypervisor won't be able to read other machines' memory. (Modulo side channels...)


On the first page of the Introduction, it's clear that the ME should not have access to the actual key in TME. In MKTME, there seems to be one key that is held only by the CPU while the others can be provided by software.

I think the use case for this is a) to defend runtime application memory on systems that use non-volatile memory as RAM (e.g., 3D XPoint), b) to defend against cold boot attacks, and c) to defend against attacks where one VM can read the data pages of another VM, possibly through an re-assignment of a previously used and uninitialized memory page.


too many interfaces for applications to control keys / entropy imo. risky considering attacks against previous low level interfaces. i'd prefer to see less control by/from applications. it's even stated in the spec there's a lot for the programmer to consider and implement to make it really secure. probarbly itl or "that bald guy who breaks all low level things" (forget his name, sorry guy!) will show how to subvert / break this when it gets implemented more widely.

in my eyes: a root mode hypervisor can break al lthe things for it's guests (nothing new, but no added benefit for that.) pconfig command might be used to influence system if BIOS is compromised early on. SOC vulnerabilities will break this for sure. (and they seem common enough glares at ME).

Ofcourse, can't complain that they try to add these kinds of layer. change has to start somewhere! :-)


I’m going to keep posting this short tech report until people stop making new broken shit: https://www.ssrc.ucsc.edu/Papers/wasptr-15-03.pdf


IBM z14 (released on July 17, 2017) comes to mind...




Consider applying for YC's W25 batch! Applications are open till Nov 12.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: