Full Disk Encryption for Confidential Computing Guests
summary
Argument: confidential VMs need disk confidentiality as well as memory protection; the proposed stack combines dm-verity + LUKS with systemd/dracut boot flow and UKI signing so the root hash is measured into PCR11 for attestation. systemd v260 adds LUKS2 integrity tags to detect tampering; deployment options are pre‑encryption by cloud or self‑encrypt-on-first-boot, but rollback/replay, IO placement leaks, and EFI (unencrypted) remain unsolved operational challenges.
AI-written summary · about
chapters (10)
- 0:00Confidential computing basics
- 3:55Data at rest in VMs
- 6:24DM-Verity for disks
- 12:54LUKS for writable disks
- 19:55DM-Verity + encryption
- 24:52Encrypting VM disks
- 28:25LUKS v2 integrity
- 30:10EFI partition security
- 32:17Storage confidentiality
- 35:32Q&A
related talks
36mConfidential VMs in the cloud
18mSecurely booting confidential VMs with encrypting disk
34mAuthenticated and Encrypted Storage on Embedded Linux
13mVM Security with Confidential Computing
41mConfidential Computing, from host to workload
44mAdvancements in Confidential Computing
30mTrust No One: Secure Storage With Confidential Containers
20mEncrypted Virtual Machine Images for Confidential Computing