Securely booting confidential VMs with encrypting disk
summary
Compares concrete workflows for SEV, SEV-ES, SEV-SNP and TDX: current encrypted-qcow has the VMM hold keys so it is not confidential; one option uses embedded GRUB in OVMF with early secret injection so unlocking happens inside the measured boot chain (GRUB patches pending upstream); another uses measured direct boot where initramfs asks for a nonce, attests kernel+initrd hashes, then fetches the passphrase (kernel/initrd remain unencrypted); and a third explores a secure vTPM in VMPL0 plus questions about persistent sealed storage and resource costs.
AI-written summary · about
chapters (6)
- 0:00Introduction to confidential VMs
- 2:29Decryption inside guest with GRUB
- 4:58Decryption during initrd boot
- 10:17Approaches using virtual TPM
- 14:18Discussion and open questions
- 17:57Q&A and closing
related talks
20mEncrypted Virtual Machine Images for Confidential Computing
13mVM Security with Confidential Computing
24mThe Common Challenges of Secure VMs
36mConfidential VMs in the cloud
41mConfidential Computing, from host to workload
45mFull Disk Encryption for Confidential Computing Guests
19mSecuring Linux VM boot with AMD SEV measurement
41mUnifying Confidential Attestation