freebsd security - Jan 2018 - Potential band-aid for Meltdown

On 1/4/2018 10:27 AM, Eric McCorkle wrote:
> I was thinking over meltdown mitigations this morning, and a thought
> occurred to me (which falls in line with general ideas I've been
pursuing)
A pretty neat idea.  But in terms of keeping crypto keys safe, why not
something behind a pkcs11 interface (e.g. eToken) or tpm ?

	---Mike
> 
> I realize it's not a perfect solution by far, but it would provide some
> level of mitigation (especially for things like GELI) that could hold
> people over until they can replace their hardware.


-- 
-------------------
Mike Tancsa, tel +1 519 651 3400
Sentex Communications, mike at sentex.net
Providing Internet services since 1994 www.sentex.net
Cambridge, Ontario Canada   http://www.tancsa.com/

On 01/04/2018 10:58, Mike Tancsa wrote:
> On 1/4/2018 10:27 AM, Eric McCorkle wrote:
>> I was thinking over meltdown mitigations this morning, and a thought
>> occurred to me (which falls in line with general ideas I've been
pursuing)
> 
> A pretty neat idea.  But in terms of keeping crypto keys safe, why not
> something behind a pkcs11 interface (e.g. eToken) or tpm ?
If you have them (and trust the vendors), sure.  My thinking here is for
folks with laptops or commodity hardware, who want some measure of
security while waiting for fixed hardware to come out.