AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a Cost

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by mmis1000 on Wednesday September 09, 2020 @02:32AM (#24417918)

Well, the security key of VM is stored in the CPU, so you can't replace CPU unless you can enter the console, copy the data out and re-encrypt it with key from another CPU.

While if you can do this, you don't need to replace mother board/CPU anyway because you already pwned them and copy/modify the data whatever you want.

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by Dylan16807 on Wednesday September 09, 2020 @03:16AM (#24418216)

> Well, the security key of VM is stored in the CPU

What security key? Do you mean the memory encryption key? We're talking about a powered off machine, so that's irrelevant.

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by mmis1000 on Wednesday September 09, 2020 @10:09PM (#24428219)

I mean keys stored in cpu ftpm. So next time it boot, it can't get the disk decrypted with the key in the cpu. And the admin will notice something very incorrectly happened.

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by SaltySolomon on Wednesday September 09, 2020 @03:30AM (#24418299)

Memory and Virtual Machines

[ Parent | on HN ]

Re:AMD PSB Vendor Locks EPYC CPUs for Enhanced Security at a... by Dylan16807 on Wednesday September 09, 2020 @04:20AM (#24418662)

Please explain better.

The article talks about virtual machines as a subset of memory encryption. It also specifically says "ephemeral keys". Not ones that would be preserved across a shutdown.

What is encrypted on a powered-off server that the CPU knows the key to?

[ Parent | on HN ]