lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Wed, 8 Dec 2021 14:05:36 +0000
From:   Richard Hughes <hughsient@...il.com>
To:     Mike Rapoport <rppt@...nel.org>
Cc:     Martin Fernandez <martin.fernandez@...ypsium.com>,
        linux-kernel@...r.kernel.org, linux-efi@...r.kernel.org,
        platform-driver-x86@...r.kernel.org, linux-mm@...ck.org,
        tglx@...utronix.de, mingo@...hat.com, bp@...en8.de,
        dave.hansen@...ux.intel.com, x86@...nel.org, hpa@...or.com,
        ardb@...nel.org, dvhart@...radead.org, andy@...radead.org,
        gregkh@...uxfoundation.org, rafael@...nel.org,
        akpm@...ux-foundation.org, daniel.gutson@...ypsium.com,
        alex.bazhaniuk@...ypsium.com, alison.schofield@...el.com
Subject: Re: [PATCH v3 0/5] x86: Show in sysfs if a memory node is able to do encryption

On Tue, 7 Dec 2021 at 07:25, Mike Rapoport <rppt@...nel.org> wrote:
> Can you please describe the actual check for the memory encryption and how
> it would impact the HSI rating?

The problem HSI is trying to solve is that customers are buying
systems where the CPU supports memory encryption, where the
motherboard and dram controller support memory encryption and where
the vendor says it's supported. But in some cases it's not working,
either because the system firmware is not working properly, or some
component requires updating to enable the feature. We're found quite a
few cases where people assumed this was all working fine, but on
looking closer, finding out that it's not working at all. The higher
HSI rating would only be available where most of the system RAM is
encrypted, although we've not worked out a heuristic number for "good
enough" yet.

> I wonder, for example, why did you choose per-node reporting rather than
> per-region as described in UEFI spec.

I think Dave is better to answer this question.

Richard.

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ