From owner-freebsd-security@freebsd.org Thu Jan 4 15:58:24 2018 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id A735BEBF253 for ; Thu, 4 Jan 2018 15:58:24 +0000 (UTC) (envelope-from mike@sentex.net) Received: from smarthost2.sentex.ca (smarthost2.sentex.ca [IPv6:2607:f3e0:80:80::2]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (Client CN "smarthost.sentex.ca", Issuer "smarthost.sentex.ca" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 5D9527005E for ; Thu, 4 Jan 2018 15:58:24 +0000 (UTC) (envelope-from mike@sentex.net) Received: from lava.sentex.ca (lava.sentex.ca [IPv6:2607:f3e0:0:5::11]) by smarthost2.sentex.ca (8.15.2/8.15.2) with ESMTPS id w04FwMGm025021 (version=TLSv1 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO) for ; Thu, 4 Jan 2018 10:58:22 -0500 (EST) (envelope-from mike@sentex.net) Received: from [192.168.43.26] (saphire3.sentex.net [192.168.43.26]) by lava.sentex.ca (8.15.2/8.15.2) with ESMTP id w04FwLkS026377; Thu, 4 Jan 2018 10:58:21 -0500 (EST) (envelope-from mike@sentex.net) Subject: Re: Potential band-aid for Meltdown To: Eric McCorkle , "freebsd-security@freebsd.org" References: <30300a34-d0d9-efbf-c9b3-6375703f65a0@metricspace.net> From: Mike Tancsa Organization: Sentex Communications Message-ID: <599c8fe0-3745-2fa8-4bd6-d89f061f29f4@sentex.net> Date: Thu, 4 Jan 2018 10:58:21 -0500 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 MIME-Version: 1.0 In-Reply-To: <30300a34-d0d9-efbf-c9b3-6375703f65a0@metricspace.net> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.78 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Jan 2018 15:58:24 -0000 On 1/4/2018 10:27 AM, Eric McCorkle wrote: > I was thinking over meltdown mitigations this morning, and a thought > occurred to me (which falls in line with general ideas I've been pursuing) A pretty neat idea. But in terms of keeping crypto keys safe, why not something behind a pkcs11 interface (e.g. eToken) or tpm ? ---Mike > > I realize it's not a perfect solution by far, but it would provide some > level of mitigation (especially for things like GELI) that could hold > people over until they can replace their hardware. -- ------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike@sentex.net Providing Internet services since 1994 www.sentex.net Cambridge, Ontario Canada http://www.tancsa.com/