User:Demindiro/Encryption

As computers are increasingly interconnected and attacks become more sophisticated it is necessary to secure data both at rest and in transit. Much of this is done in software on the CPU, but this does not cover all hardware (such as DRAM) and may add substantial overhead. Modern hardware often includes

This page documents support for encryption at various layers of common hardware and how to take advantage of it in the design of an OS.

Storage devices (HDD / SSD)

Self-Encrypting Drives (SEDs) support transparent encryption. The encryption is always on, which allows:

• Very fast "erase" by simply discarding the current key, rendering data permanently unrecoverable.
• Adding a password to an "unencrypted" drive even if it already contains data.

Typical drives use two keys: one for encrypting data and another for authorization. The data key is encrypted with the authorization key. The authorization key is derived from the password. By using a second key it is possible to change the password without re-encrypting all data.

AES-XTS is commonly used. This algorithm is unable to detect malicious changes to on-disk data. This is unlikely to be a risk for encryption that occurs fully on-disk but care should be taken.

There are multiple standards. These include OPAL.

DRAM

AMD processors support Secure Encrypted Virtualization (SEV). It enables transparently encrypting DRAM pages and CPU registers, preventing even the hypervisor from inspecting the state of a virtual machine.

PCIe

The latest PCIe standards specify link-layer encryption support. Encryption is considered necessary as PCIe starts to scale beyond single computers.

NICs

Advanced network hardware is able to handle high-level protocols typically handled by the (on-CPU) OS. Naturally this includes support for encryption.