Hacker News Reader

AFAIK there is no curent, practical "encrypted VM" that can protect itself from the hypervisor. Homomorphic encryption can theoretically do that, but is very slow and unproven right now.

View on HN

There are tricks you can do with Intel TXT to trust only the CPU and cache (TRESOR is an example) http://www1.informatik.uni-erlangen.de/tresor

It's missing a few elements you'd need to build a really awesome secure cloud, though. (actually, intel hardware was missing it)

I only glimpsed it some years ago, but I got the impression that "anything the vendor can do, the attacker can circumvent one level deeper", especially as a criticism of TXT:

http://www.blackhat.com/presentations/bh-dc-09/Wojtczuk_Rutk...

STM fixed that particular set of problems in 2010/2011. There are still issues with making all of this stuff useful, though.

Reply on news.ycombinator.com