AMD SME (Secure Memory Encryption, Memory Guard) in Ryzen Pro and Epyc CPUs, Intel Cuts Prices
From a more technical perspective, the answer is that the Ryzen Pro
https://www.cnet.com/news/intel-dramatically-cuts-prices-of-top-end-i9-gamin... Intel been cutting prices across all lines, typically in topend parts, in response to AMD's new lead in hardware. Shows customers of (and vocally supporting of) monopolie$ like Intel just how hard they themselves have been getting raped by monopolies over the years. https://arstechnica.com/gadgets/2019/10/amd-ryzen-pro-3000-series-desktop-cp... https://www.amd.com/en/ryzen-pro Could solve ColdBoot attacks, but only if encryption keys are not accessible via solder pin readout or proprietary or OS software access... Monday, AMD announced Ryzen Pro 3000 desktop CPUs would be available in Q4 2019. This of course raises the question, "What's a Ryzen Pro?" The business answer: Ryzen Pro 3000 is a line of CPUs specifically intended to power business-class desktop machines. The Pro line ranges from the humble dual-core Athlon Pro 300GE all the way through to Ryzen 9 Pro 3900, a 12-core/24-thread monster. The new parts will not be available for end-user retail purchase and are only available to OEMs seeking to build systems around them. line includes AMD Memory Guard, a transparent system memory encryption feature that appears to be equivalent to the AMD SME (Secure Memory Encryption) in Epyc server CPUs. Although AMD's own press materials don't directly relate the two technologies, their description of Memory Guard -- "a transparent memory encryption (OS and application independent DRAM encryption) providing a cryptographic AES encryption of system memory" -- matches Epyc's SME exactly. AMD Memory Guard is not, unfortunately, available in standard Ryzen 3000 desktop CPUs. If you want to build your own Ryzen PC with full memory encryption from scratch, you're out of luck for now.
https://arstechnica.com/gadgets/2019/10/amd-ryzen-pro-3000-series-desktop-cp... https://www.amd.com/en/ryzen-pro
https://rambleed.com/ https://www.phoronix.com/forums/forum/hardware/processors-memory/1106009-mit... https://github.com/AMDESE/AMDSEV/issues/1 https://arstechnica.com/gadgets/2019/08/a-detailed-look-at-amds-new-epyc-rom... https://developer.amd.com/wordpress/media/2013/12/AMD_Memory_Encryption_Whit... https://caslab.csl.yale.edu/workshops/hasp2018/HASP18_a9-mofrad_slides.pdf https://libvirt.org/kbase/launch_security_sev.html https://developer.amd.com/sev/ https://www.reddit.com/r/amd "AMD is also using its Secure Processor to enable a couple of key features that we believe aren't getting enough attention: Secure Memory Encryption and Secure Encrypted Virtualization. There's an AES-128 engine inside Epyc's memory controller, with the keys managed by the SEP. If SME is enabled in the system BIOS, all RAM in the system will be encrypted using a single key provided by the SEP and decrypted when requested by the CPU. Expanding upon SME, SEV allows guests' allocated RAM to be encrypted with individual keys, separate from the one used by the host operating system."
On Thu, 3 Oct 2019 03:48:41 -0400 grarpamp <grarpamp@gmail.com> wrote:
"AMD is also using its Secure Processor to enable a couple of key features that we believe aren't getting enough attention: Secure Memory Encryption and Secure Encrypted Virtualization.
as I mentioned, those 'features' are all attacks against the users. The only thing that's been 'secured' is the control that govcorp has over the hardware.
as I mentioned, those 'features' are all attacks against the users. The only thing that's been 'secured' is the control that govcorp has over the hardware.
Just because today's HW is fundamentally unworthy of any philosophical objective trust and should be scrapped for #Open* HW that is, does not mean that some n% of today's use cases up against certain threats are not valid. About the only case that holds worthy is keeping the system airgapped and off the net while using it as a word processor for kids to print cute "hello worlds" to the screen in a museum. Can't use it as a secure crypto keygen or signing enclave, because HW RNG/KEY is not trusted, or CPU is snooping and modding SW RNG/KEY output, or being exploited by USB transfer, or modding base64 printer output for OCR, etc. Somehow people don't think n-Billion non #Open* gates and firmware loads on a closed source CPU die could do that, those people are pretty stpuid. Yet, steering funds away from Intel that does not offer SME, permanently steering part of market funds away from monopolie$ like Intel, educating people that some security ideas for HW exist that the market is clearly choosing to buy... does have at least some impact and energy that can then be co-opted and expanded on by an #Open* movement.
Intel did not want to be left behind, so they recently made their own metoo version, but unlike AMD which you can buy today, Intel is not currently selling chips with memory encryption... https://software.intel.com/sites/default/files/managed/a5/16/Multi-Key-Total...
participants (2)
-
grarpamp -
Punk