On Tue, Jul 3, 2018 at 11:00 AM, James Morris <jmor...@namei.org> wrote: > On Mon, 2 Jul 2018, Dan Williams wrote: > >> If an attacker can run arbitrary code in the kernel they can get the >> key from the ring directly, or turn on ACPI debug. A platform could >> arrange for the DIMMs to be unlocked pre-OS to minimize passphrase >> exposure, > > So, either from within UEFI secure boot, or via the bootloader?
Correct. The ATA security model that these commands are based on assumes a laptop/desktop style interactive input of the hardware passphrase. However, for servers that do unattended boots and potentially retrieve the key from a hosted data center key service, the proposal is to use the kernel's keyctl service to communicate the passphrase to the kernel. _______________________________________________ Linux-nvdimm mailing list Linux-nvdimm@lists.01.org https://lists.01.org/mailman/listinfo/linux-nvdimm
