Applications of TPM 2.0
summary
Linux now ships a usable TPM 2.0 stack (Fedora since rel 7.6, forthcoming RHEL) and teams build real apps: disk keys sealed to PCR measurements so a secret decrypts only when firmware and boot measurements match; clevis NBDE unlocks LUKS using TPM PCR policies and can auto-unlock backups on the same machine; TPM does in-chip signing and key protection via TPM-backed OpenSSL and PKCS#11 protect TLS/SSH keys; demos show sealing, PCR-extend blocking, and working OpenSSL/PKCS#11 integrations.
AI-written summary · about
chapters (20)
- 0:00Intro
- 2:51HW ROT Strategy Update . All Red Hat TPM activities built on TPM2
- 6:54TPM2 Cheat Sheet: Clovis is a crypto framework with many capabilities
- 9:19TPM2 building blocks
- 12:55Secrets and TPM2
- 16:20Clevis Pluggable framework for automated
- 17:30Clevis and TPM2
- 19:26Clevis and LUKS
- 19:56TPM Measurement
- 23:36Platform Configuration Registers
- 25:08TPM: grub & shim
- 26:28TPM Sealing and Secrets
- 29:10Attestation
- 32:08Signing with TPM2
- 35:56Example use cases & demos • Automatically unlock LUKS using Udisk
- 38:18Protect a LUKS master key
- 38:52Protect a cert private key
- 40:32Protect a ssh private key
- 41:58Potential uses of TPM
- 43:51Resources
related talks
28mThe TPM as an everyday security tool
37mtpm2-software.github.io - Enabling the TPM2.0 Ecosystem in Linux
51mSecuring Embedded Linux Systems with TPM 2.0
36mTPM Software Stack - Enabling the TPM2.0 Ecosystem in Linux
45mTPMs & The Linux Kernel: Unlocking A Better Path To Hardware Security
39mTPM Is No Silver Bullet: Pitfalls in Embedded Device Security
43mTPMs and the Linux Kernel: unlocking a better path to hardware security
54mTPMs and the Linux Kernel: unlocking a better path to hardware security