About this talk
This talk delves into the concept of confidential computing and its significance in safeguarding sensitive data in the public cloud. The speaker, Moris Eard, a Chief Architect at Edgeless Systems, explains how confidential computing creates isolated environments with runtime encryption that protect data while in use. He discusses the challenges of cybersecurity in cloud environments, particularly for regulated industries in Europe, and how confidential computing offers solutions by enabling remote attestation to verify the security of cloud workloads. The speaker also explores different applications for confidential computing in cloud infrastructures, including its integration with Kubernetes and potential use cases in sectors like healthcare and AI.
Full transcript
[Music] hi guys today is a a second session our security award I'm Lucas nooski I'm your host and today I and next I want to introduce you the morce eard Chief Architect edgeless systems gmbh from Germany uh he serves as a Chief Architect and Ang system and Company uh dedicated to making confid Computing more scalable and accessible to everyone Pari joining andless in 20 20 he conducted
EXT extensive research on cber re um resoning systems in eurom and UC Santa Barbara morit has presented his thinkings at the various reputable conferences including usnic security RSA conference cucon he highly reged a fil and experence insights the confidential Computing demonstrating strong comments to to the uh advertising critical technology and today we going to we going to we're going to go with cloud with confidential cloud and
safeguarding sensitive data data in uh KC then we are welcome the moris eard and he will be able to talk more about himself and go forward Morris thank you thank you very much Lucas for the introduction yeah not talking so much about myself self hopefully but more about the topic but yeah okay looking for maybe maybe maybe it will be even fine to if the people will
know who they are on yeah right right right I'll give a short intro to myself for sure yeah and I leave you and byebye thank you Lucas all right um let's start the presentation um uh how do it work oh here Sor I thought can we see the presentations already no not yet not yet you should you should share the screen no I uploaded the the slides
and they are in the backstage now not sure how to activate them okay but I can also share my screen the stage I will add the stage it will be better then they are keep going byebye perfect no thanks all right right yeah um let's get going uh Lucas already gave the introduction we're going to talking about confidential Computing and and how we can Safeguard our code
and data in the public Cloud using oops just briefly about myself uh as Lucas said introduction I work as a Chief Architect for a startup from Germany called ET systems where we built open- Source software for this new technology called confidential Computing um we are in based in in B which is the the west of Germany and we're very active in this in this field of of
confidential Computing also hosting the the largest conference there um and since this is a very Cloud focused topic we're also active in the uh yeah in the uh Cloud native um related uh conferences and being a part of the the sccf the cloud foundation and so forth um yeah uh so much about uh about edas um and now I want to go bit more uh into the
background of what is confidential Computing what problem does it solve uh why is it interesting to make use of confidential Computing and then uh a more Hands-On approach in the second part of this talk where we talk we'll talk a bit more about what does it feel like to use confidential Computing where does it apply where is it visible for uh application developers uh platform Engineers uh
Cloud engineers and so forth right where where does it apply where where how do we use it uh and in the end I will talk a bit about about the the the the use cases and some some more practical examples so you get a better feeling of of of what it does so in the end you will be equipped of a good understanding of where's confidential Computing
how does it help me and if I want to use it uh what would be the next steps right so um usually uh when we talk about the the the cloud uh we think of this nice world right there's uh rainbows in the sky um but they are they are practical reasons of why people move to the cloud for sure uh it's a lot about reducing cacks
and and accelerate Innovation I think a good example right now is the the whole AI hype and all of this this AI wave uh that's hitting us where yeah people want to quickly innovate and integrate this technology and they don't want to build up everything from scratch uh build their own data centers get the in required compute uh Power the latest gpus and so forth uh they
actually just want to consume Services they want to consume um infrastructure to implement integrate and and innovate on the technology and there might be other reasons uh for for moving to the cloud I think this is this is a good example that yeah represents well a lot of these um these um use cases where people actually consume cloud computing but the other side to cloud computing is
especially if we are here in the in the cyber security uh conference is this security perspective right there are different threats now we need to deal with there's different um there's a different different threat model and also especially in Europe we're dealing with a lot of privacy sovereignity issues for a lot of Industries yeah um can talk at least for for Germany we have a lot of
uh lot of hurdles certain industries need to go through to actually make use of cloud computing this could be um yeah um the public sector this could be healthare this could be defense or or even Finance anything that's dealing with sensitive information essentially always has these additional steps and processes I need to go through if at all they are able to use cloud computing and because of
that because it's tough and it's cumbersome to go to the cloud for for these industries um this is a bit of where the need and and one of the needs for for confidential Computing comes from um so in a nutshell the underlying problem here is that we are processing our data our code on essentially somebody else's computer and because this is a remote and uncontrolled environment uh
this could be anywhere in the world and there could be anything running on that system and anybody could have access to this system so it's completely hostile and yeah um uncontrolled at least from this trust model perspective Ive where I want to control uh the access to my to my data so this is a bit of the challenge how can we establish trust in our code and
the security of our data in this in this red model in this environment and the idea of confidential Computing essentially is that we can create an isolated environment that's runtime encrypted we'll see in a second of what this means um and completely Shield it from the rest of this infrastructure and that we have a form of verifying that this is these properties are true even from a
remote location so we don't need don't need to drive to the data center and physically ourselves defend the the data but there's actually some form of remotely verifying the security and privacy of our data that's being processed in these systems right so how does confidential Computing achieve this this property and fundamentally confidential Computing adds a new state of encryption to the data so far or right now
uh before Computing what we had is we had already encryption addressed if we store data on a on a hard drive there are different methods for ensuring that this data is stored encrypted so at rest we have our data encrypted the same goes for in transit everybody that uses the web today will make use of TLS transport layer encryption uh so sending data through encrypted channels also
something that we've cut covered we haven't yet covered is protecting the data while it's being used so when you have a a cloud service uh some some workload running in the cloud when it's processing your data right it does that in in plain text and this was the missing piece of the puzzle and this is where confidential Computing comes into play um essentially there different ways of
of how this missing piece in a puzzle can be approached some of you might know homomorphic encryption right where we operate operate on on encrypted data this is maybe an algorithmic approach to um to this problem confidential Computing applies as slightly different it it's essentially a hardware based solution Hardware based technology where we extend the first of all the the the processor the CPU there's an instruction
set extension that essentially allows you to keep the the data of a a process uh isolated from all of the other processes on that on that chip keeping the main memory the the um the data of your of your process the pages encrypted at runtime so the memory engine has a key and encrypts all of the pages connected to that process and there's a for remote adastation
so the processor has a burnt in secret a private key that allows you allows it to sign a report about uh your process so essentially uh the identity the the um the the the the content of the the memory Pages um and some some meta information about uh the processor itself the firmware and so forth so there's a report and the CPU can sign it with this
key and then there's a certificate chain that goes back to the hardare vendor let's say inel AMD yeah arm is a bad example since arm doesn't really do physical silicon but um wherever processes arm chip there's a chain back to the the hardware vendor and this um yeah this allows uh to verify this attestation report actually belongs to a B9 uh CPU for example from in right
so these are the the properties these extensions to the processor and the first iteration of this technology was or was pioneered by Intel um back in a a couple years back uh I think in 2015 Intel released the secure guard extension which was maybe first real um occurrence of a confidential Computing uh CPU technology sjx was based on uh an individual process so you can isolate an
individual process uh in the system uh with these features now recently Intel has announced announced a new uh extension called the trust domain extension TD TDX which uh essentially instead of isolating a process we now go into the virtualization layer so we isol the an entire virtual machine they not going to go into all the details why this why this change or why this uh new extension
made sense but essentially by going uh into different abstraction this fits more into the abstraction we now have in the cloud right where everything is virtualization based we can apply confidential Computing on the virtualization layer uh we can make it apply it more transparently and less invasive to the actual application and how we're going to apply it we will see in the second part of this talk
but essentially um you need to think of this TDX now isolates an entire virtual machine on a system uh that runs on on such CPU and this virtualization based approach was actually pioneered by AMD uh with their technology called secure uh encrypted virtualization short sa and now arm also released a uh specification uh called confidential Computing AR architecture for CCA so there will also soon be Arm
based chips that have um more or less uh an equal solution so essentially all of these yeah server CPUs from from these vendors now have these features where we can isolate and runtime encrypt a virtual machine and we can get a form of remote attestation that allows us to verify that actually our VM our virtual machine was booted in this remote Cloud location and that it's protected
that it's isolated during his lifetime right this this is what we get um so from if we look at the stack the way it looks like is we have the hardware so the cloud providers need the the hardware there they have their hypervisor layer and now the hypervisor uses this um instruction set extension to create a virtual machine so let's say uh on um they take our
our image um for example on on AWS you have the uh uh Amazon um um what it called Amis the the the images you take the image di take this image and creates a confidential VM an isolated VM by talking to the CPU um reserving all the pages loading all of the the pages for the the operating system or the um first of all the firmware then
the operating system and so forth loads it all and basically tells the the hardware to uh lock it down um and uh Shield it from any any further access and yeah which means um after This Confidential VM has been created there's no more virt virtual or uh no uh no more um horizontal or um um no no more access from from any other part of the system
so not the hypervisor no other other part of the infrastructure no other uh virtual machine that's running on the same hypervisor can now access This Confidential VM they can also not access the the memory Pages due to the runtime memory encryption that the processor ensures even if you physical access to the data center you will not be able to dump any kind of Coda data that resides
inside this isolated environment right so this is basically the D technology and then there's the remote attestation that I briefly explained where I can now um from inside the guest here right the operating system or the application layer I can obtain an attestation statement from the CPU so there's um basically a new um uh hyper call uh that's being passed on from the gas through the hypervisor
to the hardware uh establishing a secure channel to that hardware and obtaining an assigned attestation statement about the identity of the guest of the everything that's inside the green the GRE box um signed by the CPU and this I can now use to um verify my um virtual machine from a remote location so I do a handshake with this report establish a secure channel to that to
that um to that guest and and verify its identity and from then on I know okay this is really an isolated uh machine with the correct identity uh that I expect to be there and I can securely process any kind of data inside that's roughly the um how this how this works now recently this has even be extended not only to CPUs but now to accelerators Nvidia
has released similar features for their h100 line and basically now there's a way for establishing a secure channel to the GPU verify the properties of the GPU so also that the code and data is isolated inside the GPU that it's uh um protected and that um that's actually the the correct uh Nvidia firmware and so forth and so forth you establish a secure Channel and then you
can use the accelerator as part of this isolated environment this is particularly important if we talk about AI uh use cases where often we require gpus so in summary that was the background on confidential computing what we have is now we have a hardware based solution for protecting our data in use shielding our data from the rest infrastructure through a form of runtime encryption isolation and we
can verify these properties through a form of attestation and these features are available in the latest Hardware CPUs from AMD from Intel they will also be soon be available in in arm chips and uh the good part about this is that because it's a hardware based solution it does not suffer from the same performance penalties maybe such as homomorphic encryption so due to this yeah Hardware based
approach we see overheads in a single digit percentages depending a bit on the on the workload and yeah we can roughly um yeah um for most workloads we can roughly um neglect neglect that and and just use the the infrastructure as as usual and the cool thing is is already available on the hyperscalers so AWS Azure gcp and uh a lot of other um smaller Cloud providers
so they already have this infrastructure available for us to to use now the question is how do we use it how do we make use of of confidential Computing if we want to um yeah benefit from these features so we have this nice graphic uh where we basically see three levels of where confidential Computing can be applied in a cloud uh scenario the first level is maybe
that we use confidential Computing to replace systems that require um dedicated Hardware so far and the first thing that comes to mind here is is maybe Key Management so um there are uh um offerings for let's say virtual hsms which basically Implement an H HSM completely in software and this software is then isolated through confidential Computing in a cloud environment and you can basically run the HSM
on on commodity Hardware yeah so this basically replaces uh um additional um Hardware requirements uh through confidential Computing but it does not add any um any new kind of isolation and Security benefits to to your workloads this is where level two comes into play where we say okay let's isolate an individual workloads I mean the the most basic thing you can think of is you take This
Confidential VM and uh let's if if you're on operating on a VM level you you um ship and deploy your software on a VM level for example you can uh run uh your VM in a confidential VM and if you have a mon if uh you run this in a single single VM um and this VM is then Computing same potentially can be applied to Containers we
will also see this in in um in the next part now the the level three is essentially what we we say uh or where where I see this this um going towards because in the end uh we don't need this point Solutions we need to use confidential Computing for isolating our entire environment so that our entire application whatever it consists of let's say multiple containers uh containers
a key management system uh a database and so forth that this all needs to be shielded as a whole so that we have this endtoend encryption and that any data that's flowing through this application whatever it's built up on whatever the architect looks like is really isolated from the infrastructure and basically um we need to think of more in an entire uh application deployment type of isolation
not those individual uh points so this is a bit of more abstract of how confidential Computing can apply it in more of a sense of where it can architecturally and we'll dive a bit of more into uh what this uh looks like in practice if we talk about a kubernetes uh environment so a kubernetes stack um yeah the just emphasize a bit more on the on the
fact of of what we need to think of if we want to isolate our application right U where we have a microservice architecture and this not only consists of an individ one monolith but multiple services this doesn't necessarily need to be a containerized application it could also be just that you have a yeah a monolith and a database for example right but let's think of we have
three parts of application here a webfront and the application logic in a in a database in in the end we need to connect them all together right all of these individual um parts of application need to be encrypted runtime encrypted then we need to attest them all we need to indiv individually attest them so do this remote adastation proced to verify the identity and their isolation properties
and then connect them together establish secure channels provide them with their configuration provide them with um a form of identity so they can authenticate each other and so forth um so there's a lot of this in between things we need to do so in the end uh our application gets shielded as whole so uh kubernetes and confidential Computing so we saw confidential Computing uh we saw um
how uh and and what it's um yeah how we can apply this in the different levels now we'll talk concretely about kubernetes since kubernetes is more or less the the factor of standard now as one part of our stack as the orchestration layer in our stack um not you don't need necessarily need to be exposed to kubernetes directly it could also be that you consume just consume
any type of managed service on top but underneath often somewhere in the stack there's a kubernetes layer for scalability orchestration uh software like life cycle reasons and so I think it makes sense to see how we can apply confidential Computing in a kubernetes and what this means for your application layer and and and anything on top right so if we take a look at a kubernetes cluster
right so I'm not sure if everybody's familiar with the kubernetes terms usually in kubernetes we talk about a cluster as um the anything uh in our infrastructure this cluster usually consist of the actual um yeah compute resources which we call notes so each note is usually one machine where parts of application are being scheduled on and run on yeah and in a cloud World usually every note
is a virtual machine right so every note in your kuet cluster is a virtual machine and there are spe special notes called the control plane which basically host all of the orchestrational features of kubernetes so all the the kubernetes the own the kubernetes components itself they run inside this control plane like the schedu the API server and so forth and the control plane is just special type
of node so it also runs inside VMS and then our act application in kubernetes is um yeah usually packaged inside containers and then kubernetes schedules these containers in an entity called a pot so pot is the smallest entity uh kubernetes knows as one uh part of the application and a pot can consist of of multiple containers but nevertheless think of yeah pots is where our application sits
this is our containers and these are scheduled on the on the notes and the all the scheduling part and all of this oration part is taken care of by the control plan so the question is where do we apply confidential Computing remember what conf Computing gives us is that it's yeah based on the virtualization um it allows us to isolate a um an individual VM um and
encrypt that VM and attest that VM and forth and I see yeah two sides of the spectrum here one is more than the the more yeah let's say native application where we say okay where actually are we using VMS we're using VMS on the Node level so why not applying confidential Computing on the Node level where we already are using VMS so let's say all of our
compute nodes they run in uh confidential VMS or control plane runs in confidential VMS then we need to take all um make yeah um take care of all of these in between so I'll show in a second what this means but essentially then we Shield the entire kubernetes CL CL as a whole from the infrastructure and the other side of the picture is that instead of focusing
on where uh from a technology and abstraction point of view the best fit is what do we actually want to isolate in the end what we want to isolate is our code and our data specifically our data so let's focus on isolating only our containers themselves so yeah in kubernetes speak only the pots right only isolate the pots and keep everything else outside of the trust boundary
everything else is untrusted now then we need to solve this uh abstraction uh mismatch where we want to isolate containers but the isolation property we have is is VMS and we'll see also in a second we will see how we can that right so this was the Spectrum right these are more or less there could be things in between but more or less these are the two
approaches that we see right now of how we can apply this in a kubernetes deck first part of the this now is focusing on the left hand side right isolating one cluster as a whole so there's uh our project called constellation which is an open source yeah kubernetes distribution which basically implements this form of of isolation it implements isolating a kubernetes cluster as a whole as I
said the idea is applying confidential VMS to all of all our kubernetes notes including the control plane this is the the basic uh idea here and then uh what we need to do additionally to make this useful and make this meaningful in terms of isolation and the security properties is anything inside is trusted right it's part of this what we in confidential Computing speak we call the
trusted Computing base right all of the components that are trusted because they are inside the green boxes they're inside in the trust boundary because we isolate the control plane and the worker nodes and everything together meaning that the kubernetes components themselves like the API server the cuet if you're not familiar with the terms doesn't matter right all of the kubernetes components that take care of the orchestration
and the scheduling of your containers they are all inside this trust boundary so they are trusted which means from inside the cluster I can use kubernetes as usual I can um there's this is lift and shift there's there's no real there's no changes you need to do on the application and the deployment layer where you get in contact with confidential Computing is on the on the platform
layer when you need to deploy uh this kubernetes cluster this constellation cluster the operation teams need St needs to understand how they um yeah create this cluster can be done for example with terraform or CLI tool and then they need need to do the attestation verifying this remote attestation part not for all of the individual VMS now but for the entire cluster and this is where consolation
is designed to make this easy and meaningful by basically implementing an image based uh Linux approach so all of the kubernetes noes they have a immutable Linux image uh that's built for being attestable so it follows a a a measured boot so every chain in the in the boot chain is is measured giving you a clear um um report about the the boot which is part of
this attestation procedure and by being immutable you ensure that this what has been booted is um stays that way during the lifetime of of that note um and then constellation basically change change chains all of these notes together as one cluster by verifying uh the individual noes providing them with credentials joining them together in a cluster um and then yeah once this cluster is established um yeah
it takes care that also the already solve parts of encrypting encryption are also enabled for this cluster we've already solved I mean the encryption and Transit so that all traffic between this nodes is actually encrypted by establishing encrypted channels between all of the nodes that encryption add rest is enabled so when you consume storage in a kubernetes cluster that this storage is transparently encrypted and all of
this is basically solved on the kubernetes layer right why are all of the uh interfaces that kubernetes provides like the networking interface the storage interface and so forth by solving this all on a kubernetes layer the application on top is not uh does not really it's not really affected by this uh by this um yeah by this encryption uh layer essentially so this was the one approach
ising an entire cluster cool thing here is we have lift and shift everything works as before the U downside maybe is that everything is isolated as a whole so there's no isolation between the kuet API server and my container and that I need to yeah approach this on the on the platform layer right I need to um at least uh create this cluster and maintain this cluster
in the cloud so the other approach on the other side where we want to isol just our containers uh have slightly different properties or like slightly different trade-offs here we want to isolate just an individual layer on top of the kuus so again speaking about the trusted Computing base now all of the kubernetes part is outside of this TCB which means we don't trust the API server
we don't trust the CET we don't trust any part of kubernetes this has two effects one is we can deploy this on any kubernetes essentially if it has the right Hardware available right you can deploy this on a managed kubernetes from the cloud provider the downside is that we need to yeah now need to we get closer to the application and this also affects our application a
little bit more than when we isolate the cluster as a whole first problem we need to solve is how can we isolate a container based on a VM isolation and the answer here is called um or one of the answers here is that there's a cncf project called confidential containers that solves this by using the concept of cutter containers I don't have the time to go into
all the detail but uh in yeah long story short essentially it allows you to isolate a container inside an individual VM so inside your kubernetes now all of our your containers are isolated by confidential VMS this could either be done in a nested way so all of your containers are running inside a nested virtual machine or they're running in a remote virtual machine which is somehow uh
connected to this actual compute node this actual kubernetes node yeah doesn't really matter about the details here just understand that by using cutter containers we can solve this abstraction problem and then right we apply um we apply confidential we apply this to all of our containers that we want to isolate as part of this uh deployment and then we need to solve uh the the problems about
that we don't trust the kubernetes layer so now I think of you have your web front end you have your application logic you have maybe a database deployed inside the cluster they're all isolated individually as a single container using This Confidential containers project and now we have this level two and we need to go to level three we need to connect them together so they can communicate
securely we need to attest all of these individual containers we somehow need to establish and I don't like to use this word but we establish a service mesh right where service mesh means um they they they they have a form of identity to communicate securely um they have um all of the connections uh en encrypted and we need to somehow provide them securely with their configuration right
if you think of kubernetes we don't trust the API server we don't trust any parts of the kubernetes state so we cannot pass any information through that either because this information contains sensitive information or because this information has uh effects on your application itself think of uh environment variable that you pass to your database that somehow affects the database right you cannot pass us through the API
server you cannot pass us as part of your usual kubernetes configuration yaml files um or if you do so you need to verify that they have been applied correctly and this is what we solve with another project of ours called contrast which basically is somewhat of like the um a tool for yeah running confidential containers and solving all of these in between problems yeah ATT Tes in
them individually providing uh with a policy mechanism that verifies that what if you configured as part of the API server configuration for your workload is actually ending up in that workload and basically giving you a tool for deploying or isolating a an entire deployment on the kubernetes uh using Computing so this is in summary this is the the the other side of of the the world where
we um isolate individual containers it gets a bit closer to our application we now have this more exposed to the um to the operations team of the application itself not of the infrastructure not on the cluster side but now we need to solve this or on the operation sche of the application itself and this has some effects uh in terms of yeah using a tool like contrast
to make manageable but we isolated a much smaller part of of uh our deployment now and we don't and we keep a lot of parts out of this trusted Computing base and only need to trust the application and this is a great fit uh for the first use case would like to to briefly show you uh at the end of this talk which is um um a
use case in Germany for the electronic health records so Germany we now get electronic health records uh we don't have all this paper uh pen and paperwork anymore and because of Health Data being very sensitive information if you lose uh if they get lost it's not like you can change them such as a credit card number or something right are very much um need to be very
much uh protected and confidential Computing to even get to the point where we have a provider exclusion right where whoever hosts this electronic health EOS system does not have access to the electronic H records themselves and this requires very fine grain control and very fine R isolation of the the application that processes uh these heal records and right now um this is predominantly done with um the
first uh iteration of confidential Computing which was Intel ASX but um something like confidential containers offers a a a great um um or a similar um level of of of isolation where uh we we have this more fine gr and and smaller TCP a different use case is where we just want to have lift and shift right we don't want to deal with um yeah isolating individual
containers and applications maybe we just want to uh reduce cap acts I don't know make use of of gpus and move workloads to the cloud and here there's uh an example of a a hospital clinic as an example of a very regulated yeah entity in Germany right in this case in the health Healthcare sector which wants to consume cloud Computing to not build another data center maybe
or for not buying a lot of gpus that might be outdated next year where yeah this allows them to consume the cloud with very sensitive information but being completely isolated from the infrastructure and from the cloud provider using confidential Computing and in this case using confidential clusters with with constellation and last use case very uh recent very fresh is uh now that we have the gpus as
well so we can make use of confidential gpus of accelerators um for very specific AI cases uh and one case is of course that I want to maybe use cat GPT without exposing uh my prompts all of the input I gave give to this model to the provider let's say in this case open Ai and their confidential Computing allows you to um yeah isolate the the actual
processing party back end uh from the provider let's say open eye right um by basically having end to end encrypted prompts where you pass in uh your prompt it's being processed inside a confidential Computing environment and you get the the um the response back without provider ever being able to accessing the prompts or the E response or anything and yeah one of our recent uh open source
uh projects called is called Continuum uh Continuum AI which basically provides a uh a framework for for hosting something like a chat GPT in um in a environment all right summary um we're pretty much at the end of this talk uh what did we see what did you learn hopefully first of all get an understanding of what confiden Computing is how it works um and then how
does it apply to our Cloud stack when we want to protect our Cloud workloads when we are send uh regulated Industries and we want to move to the cloud and want to use confidential Computing as a solution here as a technical solution to this problem where would it where would where would it where could we apply this in our stack um we saw confidential containers we saw
confidential clusters and um yeah all all of the projects I've shown you right constellation contrast Continuum they all open source you can go ahead you can try them out you can play with them um and see how they work and look and feel and in the end I gave you some some practical uh use cases to get a bit of understanding of where is this used today
how make people how how you people benefiting for for confidential Computing uh today yeah that's that's it um that will be the end do we have some questions sorry I cannot hear you yet uh it my so maybe no maybe now it we were no no it's me it's me that was the confidential mod sorry uh maybe before any questions appear and I got on one because
you you talk about the encryption right and how can I manage the encryption keys in those solution yeah um so the encryption the encryption the runtime encryption itself is completely handled by the processor um so that means it it deres uh Keys um session keys for for every um machine you you you start the it encrypts the pages with a fresh uh symmetric key and the algorithm
it it it that implemented is decided by the hardware vendor so far uh I think all of them use a AES for the encryption of the Pages um and yeah that's there's no you know don't have any control about that uh you have control about anything you do on top right any anything encryption like I've showed in these projects right where you also implement the encryption in
transit and add rest this is something that you do yourself uh or these projects do and there you have options of what algorithms are used and key lengths and so forth I understand understand sometimes sometime it's strange if if if nothing happens by my hand but uh I understand this solution then uh it is is always need to need to be more modern sometimes right not the
old old guide okay uh then we are waiting maybe few maybe one minute for any question appear and guys if you have any place on our chat and mor will response you are even after I think that you have no any clue to uh or any problem to contact with you directly right if somebody want if you yeah they can feel free to to reach out uh
through any any means uh email uh whatever uh you can also uh open issues on the on the GitHub project any any anything that pleases and those those all open source project are open for contribution or not yeah for sure of course for sure as open source right sorry yeah all right then and there is if there's no any questions then we may to May to finish
uh if if you don't mind morit or want to say something more no thank you very much for for listening and yeah please reach out if you followup questions um anytime yeah then thank you very much guys and thank you very much morit and see you later byebye for
