AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a Cost

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by yk on Wednesday September 09, 2020 @01:46AM (#24417622)

I can think of two scenarios where this security feature is helpful.

First, somebody breaks into a server room, replaces the motherboard with a compromised one, and notices mid replacement that they forgot a processor. (Since the processor locks during first boot, it is of no use if the supply chain is compromised before the first boot. On the other hand, I would imagine somebody willing to break into a data center to replace a motherboard would also be willing to do all kinds of other shenanigans, like bringing another processor.)

The second scenario is, somebody thinks about buying a used instead of an new processor.

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by mmis1000 on Wednesday September 09, 2020 @02:32AM (#24417918)

Well, the security key of VM is stored in the CPU, so you can't replace CPU unless you can enter the console, copy the data out and re-encrypt it with key from another CPU.

While if you can do this, you don't need to replace mother board/CPU anyway because you already pwned them and copy/modify the data whatever you want.

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by Dylan16807 on Wednesday September 09, 2020 @03:16AM (#24418216)

> Well, the security key of VM is stored in the CPU

What security key? Do you mean the memory encryption key? We're talking about a powered off machine, so that's irrelevant.

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by mmis1000 on Wednesday September 09, 2020 @10:09PM (#24428219)

I mean keys stored in cpu ftpm. So next time it boot, it can't get the disk decrypted with the key in the cpu. And the admin will notice something very incorrectly happened.

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by SaltySolomon on Wednesday September 09, 2020 @03:30AM (#24418299)

Memory and Virtual Machines

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by Dylan16807 on Wednesday September 09, 2020 @04:20AM (#24418662)

Please explain better.

The article talks about virtual machines as a subset of memory encryption. It also specifically says "ephemeral keys". Not ones that would be preserved across a shutdown.

What is encrypted on a powered-off server that the CPU knows the key to?

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by skinner927 on Wednesday September 09, 2020 @02:10AM (#24417769)

Bingo. It’s a money grab.

It’s actually easier to swap a mobo with a cpu and heatsink that’s already seated.

[ Parent | on HN ]