11

I have been on the web for a while today and came across the Intel Xeon processors. In the feature list, it mentions security.

I remember in many other places, I've seen security somehow linked with processors. Here is the link for the Xeon and here is the page it links to.

As far as I know, processors just execute instructions given to it.

What's the link between a processor and security? How can a processor enhance security?

|improve this question
16

A lot of newer processors have parts of their core dedicated to doing AES instructions. This means the 'cost' of encryption, in terms of power and processor use is less, since these parts do that one job more efficiently and faster. This means its easier to encrypt things, and as such you have better security.

You can use this for things like openssl, or encrypting the hard drive, or any library designed to use it, with less of a hit on performance for regular tasks.

|improve this answer
  • 1
    Yup. No different from looking up any other extension like vt x – Journeyman Geek♦ Feb 12 '14 at 4:07
  • 1
    The question after NSA now is - can we trust this encryption anymore? – davidbaumann Feb 12 '14 at 6:38
  • 2
    @davidbaumann as Bruce Schneier said: "Trust the Math", not implementations. So far the problem is not with AES-NI sets, since they must follow the math. The problem is with RDRAND random number generator, which was called into question by some FreeBSD devs. Don't use hardware RNG exclusively, use it as part of a set of other sources. – Mxx Feb 12 '14 at 7:34
  • 3
    An AES-NI based implementation doesn't have timing leaks, most traditional AES implementations do have them. So you don't only gain performance by using AES-NI. – CodesInChaos Feb 12 '14 at 9:47
  • 1
    You should also notice that intel proc add feature to avoid stackoverflow with more thorough control on memory and thinks like that – Kiwy Feb 12 '14 at 10:04
12

Modern processors incorporate various protection techniques which facilitate an increase in the overall security of the system.

One example is the flagging of data areas in memory as No-eXecute in order to prevent over- and underrun vulnerabilities.

An older and more fundamental capability is the protection mechanisms provided by the virtual memory management system. The very nature of the conventional VMM techniques prevent one process from accessing another process's memory.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.