⚙️
Morphisms: Confidential Serverless Containers
  • Introduction
  • Preliminaries
    • What is Confidential Computing?
      • Threat Model
      • Intel SGX
        • Threat Model
        • Memory Layout
        • Memory encryption
        • Enclave Lifecycle
        • Entering and Exiting an Enclave
        • Measurement
        • Certificate
        • Key Derivation
        • Attestation
        • Gramine
        • SGX2
        • Secret Key Provisioning
      • AMD SEV-SNP
        • Encrypted CPU Registers
        • Memory encryption
        • Secure Nested Paging
        • Virtual Machine Privilege Levels (VMPL's)
        • Cryptographic Keys
        • Secret Key Provisioning
        • Guest Deployment
    • Serverless (FaaS)
      • Knative
  • Confidential Serverless Containers
    • Introduction
    • Intel SGX
      • Threat Model
      • Remote attestation verification
      • Secure Storage
        • HashiCorp's Vault
      • Architecture
        • Confidential Knative
        • Certificates
        • Session Management
      • Confidential Container Configuration
    • AMD SEV-SNP
      • Threat Model
      • Architecture
        • Network communication
        • KMS
        • Updates
        • Key rotation
      • Design Decision
  • Benchmarks
    • Hardware
    • Results
    • Architecture Comparison
  • Getting Started
    • FAQ
    • Intel SGX
    • AMD SEV-SNP
  • Glossary
    • SGX Glossary
    • AMD SEV-SNP Glossary
Powered by GitBook
On this page
  1. Preliminaries
  2. What is Confidential Computing?
  3. AMD SEV-SNP

Cryptographic Keys

PreviousVirtual Machine Privilege Levels (VMPL's)NextSecret Key Provisioning

Last updated 1 year ago

When a key is signed, this section always refers to the public part of the key pair.

  • Platform Ownership During the initialization process, the firmware running on the AMD SP generates an ECDSA key, the Platform Endorsement Key (PEK), and a Platform Diffie-Hellman Key (PDH). To provide good randomness for cryptographic purposes, a secure entropy source is used in the generation process. The PEK is used to sign the PDH. To associate an AMD SEV CPU with a specific cloud provider, the SEV firmware provides an API to issue Certificate Signing Requests (CSR) for the PEK. The cloud organization CA (OCA) must create a certificate for the PEK. Once created, the certificate is imported back into the SEV firmware.

  • Platform Authenticity Each AMD SEV Ready CPU has OTP fuses where AMD stores unique CPU specific secrets. The Chip Endorsement Key (CEK) is an ECDSA key derived from the OTP fuses and current TCB versions to reflect security updates. To prove the authenticity of an AMD SEV CPU, AMD provides a Certificate Chain of Trust. Each CEK is signed by AMD's SEV Signing Key (ASK), which in turn is signed by AMD's Root Signing Key (ARK). Note that the trust anchor is the ARK (see Figure 1). Since the CEK is unique among all CPUs, a unique identifier (Platform ID) can be obtained through the SEV API. The Platform ID can be used to retrieve the certificates from AMD.

  • Trust Model The PEK is an important part of the trust model. Its role is to connect the two certificate trust chains, the cloud provider trust chain and the AMD trust chain. AMD issues a certificate for the CEK, which proofs the CEK to be generated on an AMD SEV CPU. The additional certificate from the cloud provider (OCA) is required to provide proof of ownership. By signing the PDH with the PEK, we can attach the PDH to both trust chains. Based on the certificates, another party can verify that the PDH belongs to a cloud provider and that the PDH was created on an AMD SEV CPU.

Cryptographic keys in SEV. A check denotes the trust anchor of a certificate chain.