Keylime: Pushing the Boundaries of Remote Attestation on the Edge

on YouTube ↗37m

" summary

Keylime moves from a pull-based verifier-driven model to a push-based agent-driven model, replacing per-node HTTP servers and 2s polling with agents that authenticate via proof-of-possession via TPM certify and negotiate evidence capabilities (TPM quotes, IMA and UEFI logs). Implementation uses TPM PCR quotes, AK challenges, and capability negotiation; work is split across upstream contributors and vendors. Result: smaller agent footprint, easier firewall-friendly deployment, better tolerance for intermittent connections; secure payload delivery remains off by default.

AI-written summary · about

" chapters (8)

1. 0:00Keylime intro and remote attestation
2. 4:57What Keylime is and how it works
3. 11:55Keylime’s architecture problems
4. 17:23Agent-driven attestation changes
5. 23:50Push model for edge deployments
6. 25:19Open source improvements
7. 28:37Keylime future
8. 29:24Q&A on attestation

" related talks

• 41mKeylime - An Open Source TPM Project for Remote Trust of IoTLuke Hinds · Open Source Summit Europe + Embedded Linux Conference Europe 2019
• 43mKeylime - An Open Source TPM Project for Remote Trust.Luke Hinds · Linux Security Summit Europe 2019
• 49mKeylime: Bootstrapping and Maintaining TrustLuke Hinds · DevConf.CZ 2020
• 46mToward Usable Open-Source Remote Attestation for Cloud and EdgeLily Sturmann, Michael Peters · Open Source Summit North America 2025
• 38mKeylime, Securing your Slice of the Cloud.Andrew Toth · Open Source Summit + Embedded Linux Conference North America 2019
• 29mA Simple Protocol for Remote Attestation of System IntegrityRoberto Sassu · Linux Security Summit Europe 2018
• 20mCloud-native security in Rust with KeylimeLily Sturmann · Cloud Native Rust Day EU 2021
• 24mFrom Trust Assumptions To Trust Evidence: Why PKI and Confidential ComputingBrian Trzupek · Confidential Computing Summit 2026