How secure is TRESOR on a virtual machine?

Question

I'm investigating TRESOR as a way to prevent stealing of encryption keys from RAM by someone with physical access to the machine.

This seems solid in the case of a dedicated server, but what about a virtual machine? I saw in this answer that TRESOR stores the key in the CPU DR registers, and patches the kernel to tell userland that the number of DR registers is 0.

On a virtual machine however, where are these registers stored when the CPU switches to another virtual machine? Is this a concern?

Answer 1

In a virtual machine environment, the debug registers will be dumped to the host's RAM while the VM is not running. This means that, in this environment, TRESOR adds no meaningful security. In fact, it may reduce overall security by placing sensitive encryption keys in a predictable location.