1

I'm investigating TRESOR as a way to prevent stealing of encryption keys from RAM by someone with physical access to the machine.

This seems solid in the case of a dedicated server, but what about a virtual machine? I saw in this answer that TRESOR stores the key in the CPU DR registers, and patches the kernel to tell userland that the number of DR registers is 0.

On a virtual machine however, where are these registers stored when the CPU switches to another virtual machine? Is this a concern?

3
  • The site seems to say you can also use TRESOR with the BitVisor hypervisor (never heard of it) – multithr3at3d Aug 26 '19 at 11:21
  • Note: the hypervisor is not under my control. – BenMorel Aug 26 '19 at 13:04
  • Maybe not realistic attack but there is a Tresor Hunt – kelalaka Aug 26 '19 at 14:05
1

In a virtual machine environment, the debug registers will be dumped to the host's RAM while the VM is not running. This means that, in this environment, TRESOR adds no meaningful security. In fact, it may reduce overall security by placing sensitive encryption keys in a predictable location.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.