Most of the key protections are used to encrypt key to protect it from malware or other tenants. What if the hypervisor "steals" my key?

If I am using a VM provided by a CSP, when I input a key to encrypt or decrypt my data, how do I know the CSP doesn't store my key and "might" snoop my data without my notice.

Do CSPs provide this kind of trust that they won't do this? Is there a method or technique that can do key penetration from guest OS directly to hard drive so that I know no one except me can see my key?


The cloud you run your VM on is essentially the "hardware" for your system. As much as you don't have full control of the hardware you have at home you don't have full control of the virtual hardware in the cloud. As much as the vendor of your hardware at home might have placed a backdoor into your keyboard or into the BIOS etc the provider of the virtual hardware in the cloud could do this too - and it would be even easier (see VMI outside the virtual machine).

In other words: either you trust the CSP or not. In the latter case you should not use it. For a guest VM there is no protection against a malicious cloud provider.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.