During the spring of 2024, Google engaged NCC Group to conduct a design review of Confidential Mode for Hyperdisk (CHD) architecture in order to analyze how the Data Encryption Key (DEK) that encrypts data-at-rest is protected. The project was 10 person days and the goal is to validate that the following two properties are enforced:
- The DEK is not available in an unencrypted form in CHD infrastructure.
- It is not possible to persist and/or extract an unencrypted DEK from the secure hardware-protected enclaves.
The two secure hardware-backed enclaves where the DEK is allowed to exist in plaintext are:
- Key Management System HSM – during CHD creation (DEK is generated and exported wrapped) and DEK Installation (DEK is imported and unwrapped)
- Infrastructure Node AMD SEV-ES Secure Enclave – during CHD access to storage node (DEK is used to process the data read/write operations)
NCC Group evaluated Confidential Mode for Hyperdisk – specifically, the secure handling of Data Encryption Keys across all disk operations including:
- disk provisioning
- mounting
- data read/write operations
The public report for this review may be downloaded below:
Senior Security Consultant with NCC Group