Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Possibly, but memory is accessed using plain CPU instructions, so it would be hard to transparently encrypt all memory for an application at the kernel level. You do have virtual memory, but I dont think that could be leveraged for this. But who knows whats possible there, maybe if you align and address each memory value at the page boundaries and always force a page fault you could have a really poor implementation :)

Transparent disk encryption, not a problem since devices have filesystems which can implement encryption at that layer.



Modern Intel chips can encrypt memory on the fly without performance loss (SGX does this). However I think it's not exposed for non-enclave use. Perhaps it should be.

Note: inside the enclave there is a performance loss but that's due to MAC checks. If you just want encryption without integrity against tampering you don't need that.


But that wouldn't prevent (mitigate) cloudbleed anymore as the problem is about isolating contexts within process boundaries.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: