Fully Ephemeral DispVM's revisions

Go back to topic: Fully Ephemeral DispVM's

v3 anchor; v3 full version
v2 anchor; v2 full version

Revision #3

Edited on: 2023-09-07
Edited by user: deeplow

Revision #2

Edited on: 2022-06-16
Edited by user: anywaydense

Currently Qubes DispVM's are not fully ephemeral; data written to xvda and xvdb is ~~always~~ written to disk in plaintext. When the user sets ephemeral=True data written to xvdc is encrypted with an ephemeral encryption key placed in RAM.

Currently Qubes DispVM's are not fully ephemeral; by default data written to xvda and xvdb is written to the disk in plaintext. When the user sets ephemeral=True data written to xvdc is encrypted with an ephemeral encryption key placed in RAM. If in addition the user sets rw:root rw 0 then writes to xvda are routed to xvdc and thus encrypted. However xvdb is at present always written to the disk in plaintext.