Keylime - An Open Source TPM Project for Remote Trust.
summary
Keylime is an open source remote-attestation framework that measures TPM 2.0 roots of trust, uses IMA and measured boot to build attestation quotes, and delivers encrypted payloads only when the node matches a whitelist of golden hashes. It runs a lightweight agent (being ported from Python to Rust), a verifier, and a register; it cryptographically splits a bootstrap key split into U and V and recombines it only after TPM quotes validate identity. Integrations include a CA (Cloudflare tested), a revocation system that revokes certificates via CA, CI with a TPM emulator, and scale tests showing thousands of VM quotes to one verifier.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:19What is the problem
- 2:52Trusted Platform Modules
- 5:49What is Keylime
- 7:58Keylime measurements
- 13:04Keylime architecture
- 15:37Keylime model
- 16:33Keylime operations
- 18:32QKey Deviation
- 22:57Continuous remote attestation
- 25:51Revocation framework
- 27:08Actions
- 28:03Projects
- 30:43Open Community
- 31:42Python Agent
- 32:19VTPM Support
- 34:24Ability Feedback
- 35:51Measurement
related talks
41mKeylime - An Open Source TPM Project for Remote Trust of IoT
49mKeylime: Bootstrapping and Maintaining Trust
38mKeylime, Securing your Slice of the Cloud.
37mKeylime: Pushing the Boundaries of Remote Attestation on the Edge
46mToward Usable Open-Source Remote Attestation for Cloud and Edge
20mCloud-native security in Rust with Keylime
42mTPM based attestation - how can we use it for good?
29mA Simple Protocol for Remote Attestation of System Integrity