What is TSME?

TSME or Transparent Secure Memory Encryption is an AMD CPU hardware security feature. It encrypts all data stored on your RAM using a key that the processor generates.

The transparent part of the name means this is a background process without requiring any changes to the operating system or applications. The goal is to protect sensitive information from what are known as cold boot attacks. These are where data is read directly from the RAM after the computer is switched off.

This process is called data remanence and involves physical access to a device in most instances. TSME adds an additional layer of security while remaining in silently in the background and having a very minimal impact to end users.

As mentioned, the primary goal of TSME is to prevent cold boot attacks. In this type of attack, the attacker gains physical access to the device and attempts a retrieve the data. This data is encrypted using TSME making it unreadable without the encryption key, and the key for this is only held on the CPU.

Unlike software-based encryption this is an always on automatic feature working on all the RAM on the device and needing no action from the user. While there is a very small performance impact due to the encryption process, this is outweighed by the benefits in securing data against potential external threats.

If you have an AMD Zen based AMD CPU, then it's likely that you have TSME. As this is designed to prevent cold boot attacks which happen before your operation system and other applications kick in, this is a BIOS level tool. Meaning there is no software required. However, if it's been a while since you've updated your BIOS, then it might not be active on your system.

TSME is for almost all AMD CPUs. At one point, an AGESA update from AMD did however disable this on Ryzen 9000 CPUs. eventually, though, they reversed this decision and re-enabled the feature after concerns were raised.