AMD Posts Secure Memory Encryption For The Linux Kernel (SME)

[phoronix]

Phoronix: AMD Posts Secure Memory Encryption For The Linux Kernel (SME)

Well, today seems to be the day for x86 CPU vendors to push out memory security related features for the Linux kernel... After Intel posted the Secure Guard Extensions driver for Linux, AMD has come out with a patch-set for "Secure Memory Encryption" (SME) that looks like it will be a hardware feature of Zen...

http://www.phoronix.com/scan.php?page=news_item&px=AMD-Secure-Memory-Encryption

[SaucyJack]

That actually sounds pretty badass.

[microcode]

Seems like this would help guard against cold boot attacks; very cool. I'm wondering who asked for this. :-)

[Tomin]

That PDF link doesn't seem to work.

[Luke]

Good idea in theory, but we don't have a trustable processor to apply it on due to that underlying management processor the LIbreboot folks warned about on post-AM3+ procs/boards.

Would AMD really let you encrypt your keys against their own blob or the government's modified versions signed with AMD's key? We won't know until someone steps through that underlying "security processor" and that firmware blob that LIbreboot warned about instruction by instruction. To do so might require X-ray analysis of the processor to work out the hardware instructions used by that firmware.

[Adarion]

1. Yes, as Tomin said the link is broken / 404.

2. I wondern if that can also be used AGAINST us, the users, the dev community. This feature could also be used e.g. in new gaming consoles (next PS Neo or plus or whatev. it was called, Nintendo is planning something that does involve AMD,...) - thus making it much harder to get our beloved penguin onto them.
Other than that, yes, it might help against cold boot attacks, unless the means of decryption are also accessible somewhere.

[Adarion]

Michael, I highly DISAPPROVE of this approve-posts-thing.

[nanonyme]

Good idea in theory, but we don't have a trustable processor to apply it on due to that underlying management processor the LIbreboot folks warned about on post-AM3+ procs/boards.

Would AMD really let you encrypt your keys against their own blob or the government's modified versions signed with AMD's key? We won't know until someone steps through that underlying "security processor" and that firmware blob that LIbreboot warned about instruction by instruction. To do so might require X-ray analysis of the processor to work out the hardware instructions used by that firmware.

Guess we'll see whether MPAA or NDA have more leverage. It's in MPAA's best interest there are no backdoors as this will probably be used for copy protection

[oglueck]

Key question: where are the keys stored.

[shiki87]

That PDF link doesn't seem to work.

http://amd-dev.wpengine.netdna-cdn.com/wordpress/media/2013/12/AMD_Memory_Encryption_Whitepaper_v7-Public.pdf

This is the full link :3