I'm investigating TRESOR as a way to prevent stealing of encryption keys from RAM by someone with physical access to the machine.

This seems solid in the case of a dedicated server, but what about a virtual machine? I saw in this answer that TRESOR stores the key in the CPU DR registers, and patches the kernel to tell userland that the number of DR registers is 0.

On a virtual machine however, where are these registers stored when the CPU switches to another virtual machine? Is this a concern?

  • The site seems to say you can also use TRESOR with the BitVisor hypervisor (never heard of it) Aug 26, 2019 at 11:21
  • Note: the hypervisor is not under my control.
    – BenMorel
    Aug 26, 2019 at 13:04
  • Maybe not realistic attack but there is a Tresor Hunt
    – kelalaka
    Aug 26, 2019 at 14:05

1 Answer 1


In a virtual machine environment, the debug registers will be dumped to the host's RAM while the VM is not running. This means that, in this environment, TRESOR adds no meaningful security. In fact, it may reduce overall security by placing sensitive encryption keys in a predictable location.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .