Secure Encrypted Virtualization (SEV) and its extensions protect a VM from a malicious host by encrypting guest memory (SEV), preserving register state (SEV-ES), and enforcing page ownership/mapping rules (SEV-SNP). SNP also lets the guest request a signed report from the AMD secure processor containing a fixed launch measurement (SHA-384 over the starting image and page metadata), platform security versions, policy flags and 64 bytes of caller-supplied REPORT_DATA. On Linux an application opens /dev/sev-guest and issues an SNP_GET_REPORT ioctl with a VM privilege level (VMPL) and a fresh 64-byte challenge; the code example in Zig shows building the guest request, calling ioctl (0xc0205300), expecting a 1,184-byte report that follows a 32-byte firmware header, and returning the raw report. The verifier supplies the fresh challenge and the expected measurement/VMPL, and can reject altered firmware, unmeasured pages, or mismatched configurations.
Privileged services like Coconut SVSM and Microsoft OpenHCL run at higher VMPLs to host vTPMs whose private keys remain protected by SNP; the guest obtains reports built by those services using the vTPM public keys, since an AMD report alone only contains a hash of a public key and does not by itself prove vTPM key ownership. Verification requires checking the report signature and certificate chain (ECDSA P-384, validated against AMD root certificates), matching certificate security versions and chip identity when present, and enforcing policy checks on launch measurement, REPORT_DATA, VMPL and minimum platform security versions while rejecting debug/SMT/migration unless allowed. The zig-sev-guest package packages retrieval, parsing and verification (verify.andValidate) so callers provide expected values and handle vTPM-specific claim checks separately.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Elon Musk's ownership of X has led to increased activity from prominent figures, despite his controversial actions and statements. Musk has repeatedly made offensive remarks, including antisemitic comments and deadnaming his trans daughter, which tarnish his reputation. (lexontech.org)
Ukrainian drone strikes have disabled multiple Russian Google data centers, disrupting disinformation bot traffic. The strikes are part of Ukraine's intensified efforts to target Russian digital infrastructure in response to Moscow's attacks on Kyiv. (tomshardware.com)
Dentists perform procedures based on their expertise, but their confidence can sometimes lead to unnecessary or harmful treatments, as shown in a personal account of dental interventions. The narrative highlights concerns about whether dental professionals always act in patients' best interests and the potential for over-treatment. (mapwriting.substack.com)
Homebutler is a server monitoring tool that reports only significant changes, reducing unnecessary alerts. It is a single Go binary with no database, designed for simplicity and efficiency. (github.com)
Iran threatens to cut undersea cables in the Strait of Hormuz, risking disruption to global data traffic and economic stability. The cables are vital for international communications, financial transactions, and technology operations worldwide. (theconversation.com)
The Trump administration temporarily banned Microsoft and other tech companies from sponsoring foreign workers for US permanent residency, citing abuse of immigration rules. Microsoft disputes the claim, asserting most of its US employees are American, while the ban has caused diplomatic tensions with India. (arstechnica.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.