Attestation and Confidential Dump for IBM Secure Execution on Linux
summary
IBM Secure Execution on Linux adds two concrete features: explicit attestation via PVA test that returns ECDH-based measurements so a third party can verify a specific image instance without revealing secrets, and an encrypted hypervisor-initiated dump flow that writes AES-XTS page blobs plus GCM metadata so only the guest owner (with the CCK) can decrypt memory and vCPU state. KVM/QEMU and s390 firmware support is upstream or pending review and the tools work end-to-end.
AI-written summary · about
chapters (10)
- 0:00Attestation and Confidential Dump for IBM Secure Execution on Linux
- 4:19Use cases
- 6:52Current state
- 7:43Guest vs. hypervisor initiated guest dumping
- 9:33Problem: We don't trust the hypervisor
- 10:20Dumping: QEMU/KVM perspective
- 13:33Life Cycle
- 14:32Command lines!
- 16:55Summary
- 19:18IBM® Secure Execution
related talks
50mEnabling Hardware Security Modules for Confidential Computing
13mIBM Secure Execution for RedHat CoreOS
18mSecurely booting confidential VMs with encrypting disk
41mConfidential Computing, from host to workload
36mConfidential VMs in the cloud
20mEncrypted Virtual Machine Images for Confidential Computing
33mAMD Encrypted Virtualization Update
19mSecuring Linux VM boot with AMD SEV measurement