TPMs & The Linux Kernel: Unlocking A Better Path To Hardware Security
summary
Proposes using the Linux kernel key store to let applications use TPM-held keys without reimplementing TSS stacks, implements a Python request_key plugin that derives reproducible symmetric and RSA keys from the TPM via TPM2 KDF/HMAC and demonstrates binding by filesystem path or code hash, shows crypto-socket instantiation from kernel keyring landed in Linux 6.2 and asymmetric TPM key support is upstreamed toward 6.11, proves the prototype works but notes current user-space exposure unless the submitted kernel patches perform derivation entirely inside the kernel.
AI-written summary · about
chapters (8)
- 0:00The challenge of using TPMS
- 2:46Linux kernel complexities
- 7:57Linux kernel key retention
- 14:14Integrating TPMS and crypto
- 18:32TPM derived keys
- 23:49Request key plugin demo
- 34:04Conclusions and outlook
- 36:29Q&A session
related talks
43mTPMs and the Linux Kernel: unlocking a better path to hardware security
54mTPMs and the Linux Kernel: unlocking a better path to hardware security
47mTPMs and the Linux Kernel: unlocking a better path to hardware security
42mTPMs and the Linux Kernel: unlocking a better path to hardware security
51mApplications of TPM 2.0
42mRecent TPM Security Enhancements to the Linux Kernel
53mWhat is Linux kernel keystore and why you should use it in your next application
37mtpm2-software.github.io - Enabling the TPM2.0 Ecosystem in Linux