Are our systems using up to date cryptography
summary
A system implements runtime instrumentation of crypto libraries using USDT probes and collects events with eBPF/bpftrace, recording hierarchical context+event trees (handshake, key exchange, signatures, negotiated TLS ciphersuites) to disk via an agent and event broker. Logs are grouped, rotated and context IDs are obfuscated for privacy; payloads import into Grafana or Insights Core for long‑term trends and real‑time diagnostics. Prototype shows feasibility but measurable overhead (roughly a remembered ~20% when fully active).
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:35Motivation
- 3:50Challenges
- 4:58Architecture
- 6:10Login Format
- 7:25Contexter
- 8:20Events
- 9:37Example
- 10:34Optimization
- 11:35Crypto Library
- 11:59Agent
- 16:50Implementation
- 18:00Future work
- 19:16Conclusion
- 19:56Questions
related talks
29mAre Our Systems Using up-to-Date Cryptography?
26mChecking your cryptography usage with eBPF
33mTracing SSL/TLS Encrypted Microservices with eBPF
29mRuntime Security at Scale With EBPF: Hybrid Detection and Root Cause…
30mApplication network security and observability in an encrypted future
49mRelational Observability for Cloud-Native Security and Data Science
27mVerifiable eBPF Traces for Supply Chain Artifacts with Witness and Tetragon
07mLightning Talk: Falco, Tracee and Tetragon: eBPF Runtime Observability and Security...