PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Cloud cryptography demystified: Google Cloud Platform

blog.trailofbits.com | blog | #cloud | #confidential-computing | #cryptography | #gcp | #cloud-kms | #hsm | #secret-manager | #tink
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits' cloud cryptography series surveys GCP offerings—Cloud KMS (software, HSM, EKM), Secret Manager, Confidential Computing, and Tink for client-side encryption—and when to use each.
Published
Collected

Related coverage

blog · specterops.io
Head in the Clouds: Google Compute
# Head in the Clouds: Google Compute Author Christopher Maddalena Read Time 7 mins Published Sep 12, 2018 ##### Share * Introduction * Head in the Clouds – Christopher Maddalena – Medium * In the...
blog · blog.trailofbits.com
A few notes on AWS Nitro Enclaves: KMS integration
The third post in Trail of Bits' Nitro Enclaves series catalogs passive and active attacks against the enclave-KMS channel, plus operational risks that persist even when cryptography is correct.
blog · blog.trailofbits.com
Vulnerabilities in LUKS2 disk encryption for confidential VMs
New LUKS2 flaws (CVE-2025-59054, CVE-2025-58356) affect eight confidential VM systems: malleable headers let disk-level attackers trick TEE guests into encrypting secrets with a null cipher.
blog · blog.trailofbits.com
A few notes on AWS Nitro Enclaves: Attack surface
Trail of Bits maps the attack surface of AWS Nitro Enclaves, covering vsock pitfalls, randomness, side channels, memory, time sources, and attestation, with guidance for hardening deployments.
blog · blog.trailofbits.com
Cloud cryptography demystified: Amazon Web Services
Trail of Bits explains AWS cryptography offerings—KMS, CloudHSM, the AWS Encryption SDK, Secrets Manager, and C3R—clarifying service versus client-side tooling and when to use each.
blog · blog.trailofbits.com
Enhancing trust for SGX enclaves
Trail of Bits used Nix to make SGX enclave builds reproducible, letting users audit whether an enclave runs its claimed source; they packaged the SGX SDK in Nixpkgs and released reproducible-sgx.
Back