Messages in this thread | | | Date | Fri, 27 Jan 2023 10:02:43 +0100 | From | Jörg Rödel <> | Subject | Re: Linux guest kernel threat model for Confidential Computing |
| |
On Thu, Jan 26, 2023 at 04:13:11PM +0100, Richard Weinberger wrote: > On Thu, Jan 26, 2023 at 3:58 PM Dr. David Alan Gilbert > <dgilbert@redhat.com> wrote: > > > > * Richard Weinberger (richard.weinberger@gmail.com) wrote: > > > On Wed, Jan 25, 2023 at 3:22 PM Daniel P. Berrangé <berrange@redhat.com> wrote: > > Are you aware of anything that you'd use instead? > > Well, I'd think towards iSCSI over TLS to protect the IO transport.
In the context of confidential computing this makes only sense if the scsi target is part of the trusted base, which means it needs to be attested and protected against outside attacks. Currently all CoCo implementations I know of treat disk storage as untrusted.
Besides that the same problems exist with a VMs encrypted memory. The hardware does not guarantee that the HV can not fiddle with your private memory, it only guarantees that you can detect such fiddling and that the private data is encrypted. The HV can also still trace memory access patterns of confidential guests by setting the right permissions in the nested page table.
So storage and memory of a CoCo VM have in common that the transport is not secure, but there are measures to detect if someone fiddles with your data on the transport or at rest, for memory implemented in hardware, and for storage in software by using dm-crypt together with dm-verity or dm-integrity.
Regards,
Joerg
| |