AMD Secure Processor Support In Linux 4.14

[phoronix]

Phoronix: AMD Secure Processor Support In Linux 4.14

The crpyo subsystem updates have been pulled in for the Linux 4.14 kernel and it includes more complete AMD Secure Processor support, among other changes...

http://www.phoronix.com/scan.php?page=news_item&px=Linux-4.14-Crypto-AMD-SP

[tildearrow]

Typo:

The crpyo subsystem updates

[artivision]

Any AMD processors without it?

[gnarlin]

How can any key signed with the use of this ever be trusted?

[juno]

OK and where are the pushes to the kernel and core/libreboot to enable an actually trusted environment without ring -2 backdoors?

[torsionbar28]

Any AMD processors without it?

Sure, the Opteron 4300 and earlier, Opteron 6300 and earlier, and the FX series and earlier. Basically anything from 2013 and earlier. With intel, you have to go back to 2008 to find anything without a proprietary security coprocessor.

[Luke]

Here's a thought: Suppose a future AMD proc (maybe just the Black Editions to go "totally unlocked?") were to support adding your own signing key so you could replace the PSP firmware with your own? Remember that the PSP is just a small ARM core (from what I've heard) and that at least the Intel equivalent actually uses a Unix-type OS to run it. For security the CPU would display a warning message on a red background along with the name attached to the signing key, so covert key replacement could be detected pre-boot.

Now it would be possible to use the Linux kernel itself as the basis for a new open firmware (not supporting DRM/Netflix) that not only has the critical function of bringing up the main CPU, but is also say, the only core handling decryption of encrypted disks? If the network stack is disabled at build-time and curtained memory used as it is for the DRM case, the result is that all online attacks on encyption become impossible, and even detecting that an encrypted disk is in use becomes beyond the reach of an online attacker. The PSP core used for software decryption might be a bit slow, but hopefully not Intel Atom slow.

Barring an unlocked chip release, some future hacker might find a backdoor to replacing/adding keys. Until then, the problem is NOT the addition of the PSP core, it's just another CPU core given access to its own dedicated area in RAM. The problem is what amounts to an entire closed min-OS designed for things like 4K Netflix on Windows to run it, and the fact that this makes the whole PSP no more trustworthy than MS Windows is.

Simplest "right now" fix for AMD: split out the portion of the firmware that just brings up the main proc, sign that by itself like Intel does that one partition, and let the proc function with the rest removed if an ME-cleaner type approach is not already possible. Also let board makers turn off the rest of the "features" in their UEFI and Coreboot do the same, so as to reduce the attack surface for those not interacting with the DRM media corporations.

[eydee]

How can any key signed with the use of this ever be trusted?

How can anything ever be trusted? You may walk in the street and a brick might fall on your head.

[AndyChow]

I'm surprised to see SEV being supported so soon, as it is built on top of SME. I'm not sure how you get the keys for each VM, but I'm guessing you have to buy each one from an authorized third-party. Most likely, it's strictly going to be an enterprise feature.

You don't need to use it, but it's the only thing that ensures that your VM isn't being watched by your VM provider. Currently, if you buy a VM from say Amazon, what tells you that Amazon can't just read your encrypted data from the ram sticks? Well, if you buy a key from a third party, make the handshake with the VM and encrypt your RAM with a key that Amazon doesn't have, that pretty much covers you.

Nothing is absolute, but if someone really wanted to know your secrets, a $5 lead-pipe smashed to your knees is a lot more efficient than trying to decrypt your RAM.

[Henriques]

Does amd ryzen 1600 has it? I am asking because i have read that only some apu's have it. Not sure if is true...