Build a Full Measurement Chain Using the CC-FDE Solution i...
summary
Builds a passwordless disk‑encryption chain that ties LUKS rootfs decryption to remote attestation on TDX (demo shows rootfs labeled crypto LUKS). An initrd FD agent in initrd collects attestation evidence via the CC Trust API, sends it to a key‑block service which calls Intel CH Authority, and only releases the encryption key if measurements match the key‑transparency policy. Implementation injects keyblock URL/cert/ID into OVMF, encrypts only rootfs, and supports vendor‑agnostic attestation (Intel and AMD).
AI-written summary · about
chapters (14)
- 0:00Session introduction
- 0:41Confidential Computing basics
- 2:06TEE vs disk encryption
- 3:12Security gaps in TEEs
- 4:57CC-FDE solution overview
- 6:25Preparing encrypted VM images
- 7:09CC-FDE agent workflow
- 9:43Comparison with traditional full disk encryption
- 10:53Remote attestation process
- 13:26CC-FDE with KubeVirt
- 15:21CC-FDE encryption process
- 16:55Live demo decryption
- 19:14Encryption process overview
- 20:41Key transparency in CC-FDE
related talks
30mTrust No One: Secure Storage With Confidential Containers
27mTrust No One: Bringing Confidential Computing to Containers
38mHardware-based KMS Plug-in to Protect Secrets in Kubernetes
17mSealing Kubernetes with Confidential Clusters
29mConfidential Containers: The Next Era of Cloud Data Security
23mAlways-encrypted, confidential Kubernetes with Constellation
27mIntel Trusted Domain Extensions (TDX) Host Kernel Support
36mSecuring Kubernetes with Trusted Platform Module (TPM)