PMEM performance in Memory mode

[Anton Gavriliuk]

Hi all

As far as I know all data written to the PMEM media using 256 bit XTS-AES algorithms.

But does it make sense to encrypt PMEM in Memory mode ?

Is it possible to disable PMEM encryption with an dea increase PMEM performance for Memory mode ?

Anton

all data written to the media using 256 bit XTS-AES algorithms

[Steve Scargall]

Hi Anton,

It is not possible to disable encryption at rest, which is handled by the controller on each PMem device. Volatility in Memory Mode is achieved by generating a new encryption key at power-on or reboot time. If it were possible to disable this feature, all the data previously written would be accessible which would create a dangerous security data leak condition, especially in a virtualized environment. 

/Steve

[Anton Gavriliuk]

Hi Steve

> If it were possible to disable this feature, all the data previously written would be accessible which would create a dangerous security data leak condition, especially in a virtualized environment.

Does DDR4 DRAM use built in encryption in virtualized environment ?  I'm talking about PMEM in Memory mode only.

Anton

ср, 6 янв. 2021 г. в 00:53, Steve Scargall <steve.s...@intel.com>:

Hi Anton,

It is not possible to disable encryption at rest, which is handled by the controller on each PMem device. Volatility in Memory Mode is achieved by generating a new encryption key at power-on or reboot time. If it were possible to disable this feature, all the data previously written would be accessible which would create a dangerous security data leak condition, especially in a virtualized environment. 

/Steve

--
You received this message because you are subscribed to the Google Groups "pmem" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pmem+uns...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/pmem/235a3790-1b51-42e2-aa64-5f7d6819522bn%40googlegroups.com.

[Steve Scargall]

On Wednesday, January 6, 2021 at 2:17:26 AM UTC-7 antos...@gmail.com wrote:

Hi Steve

> If it were possible to disable this feature, all the data previously written would be accessible which would create a dangerous security data leak condition, especially in a virtualized environment.

Does DDR4 DRAM use built in encryption in virtualized environment ?  I'm talking about PMEM in Memory mode only.

My response was in the Memory Mode context. It doesn't matter what mode Intel Optane PMem is operating in (Memory Mode, App Direct, or Mixed), it is a non-volatile media that retains the data written to it. Memory Mode volatility is achieved by generating new encryption keys at power-on or reboot time. Hence, it appears to the observer to operate like volatile DRAM. The alternative would be to have the BIOS zero the entire memory address range, which could take hours on very large memory systems, and nobody wants a system reboot time that long. There's really not much difference between Memory Mode and AppDirect from a PMem operational perspective. Either we automatically rotate the encryption keys (Memory Mode) or we don't (App Direct). The memory address layout of DRAM and PMem is handled by training the memory controller using the requested goal configuration. 

The same principle applies to disks. If I create a file system on a disk, write some data to it, then re-create the file system, the data I previously wrote initially appears to be gone at the file system level, but I can trivially access the old data by reading the contents of the raw disk. However, if I encrypted the disk, create a file system, write data, then re-encrypted the disk with new keys, and finally create a new file system, there's no way I could access the previously written data. 

HTH

    Steve