Debug register access is not necessarily as optimized as access to (e.g.) L1 cache.

There is no application, it is a kernel patch.

Even if all of the AES state is kept in cache, the data to be encrypted would still have to be copied from ram or disk, right?

yeah but you can have an encrypted disk, encrypted ram, not so much.

Hi. PrivateCore has implemented encrypted RAM as part of a secure hypervisor. Our product is currently in a private beta, but you can check out our website at: http://www.privatecore.com.

We gave a talk on some of the vulnerabilities and mitigations at CanSecWest this year: http://cansecwest.com/slides/2013/PrivateCore%20CSW%202013.p...

OpenBSD will get you halfway there, it at least encrypts (if you switch it on) the virtual memory.

OpenBSD does this by default. It also now directly boots cryptodisks eliminating the need to create a /boot partition and carry it around if you're concerned about evil maid attacks, though I would imagine a camera or keyboard hardware keyloggers would defeat that pretty easily

The boot loader is still on the disk, unencrypted.

That's what removable media is for

derp, /root correction

As does OSX. Probably Windows too? There has to be a registry setting to tweak, somewhere.

If you stream the data in from disk (e.g. read 1kB, encrypt 1kB, read 1kB, encrypt 1kB) then a cold boot attack only recovers one small chunk of data. Whereas if your keys are in RAM then a cold boot attack can recover the keys which can then be used to decrypt your entire hard drive.

Hm. Maybe Linux should fold this into the kernel.

Debug registers are only accessible in Ring 0. I haven't looked at the implementation described, but I'd be surprised if it isn't a kernel module or something equivalent.

Are they available to a JTAG probe? I've not looked at a modern motherboard in ages, but I wouldn't be too surprised to find unpopulated JTAG pads near the CPU.

Only boundary scan on Intel.

I don't think x86 uses JTAG.

Why not? Even if it doesn't use JTAG for debug, it almost certainly would need it for boundary scan. I just checked volume 1 of the Intel i7 processor family datasheet, and it does show a JTAG port.

You are correct - it looks like it is distributed as a kernel patch.