Securing TPM Secrets with TXT and Kernel Signatures
summary
Goal: restrict TPM2 NVRAM secrets so only kernels signed by an authorized key can unseal them, across UEFI and legacy BIOS hardware. Prototype implements a tboot extension that verifies PE/COFF kernel signatures (now supporting certificate chains), updates TXT measured-launch policies to accept certificates, and plans a new PCR reflecting the kernel signing authority for stable sealing. Kernel verification already works but is not yet enforced; policy/PCR updates remain in progress.
AI-written summary · about
chapters (6)
- 0:00Start
- 1:26Problem Statement
- 5:10UEFI Secure Boxat
- 7:10Trusted Execution Technology (TXT)
- 19:16Current Status
- 22:23Questions?
related talks
33mSecuring TPM Secrets with TXT and Kernel Signatures
42mTPMs and the Linux Kernel: unlocking a better path to hardware security
43mHardware-backed Per-process Secrets
36mSecuring Kubernetes with Trusted Platform Module (TPM)
43mTPMs and the Linux Kernel: unlocking a better path to hardware security
51mApplications of TPM 2.0
39mTPM Is No Silver Bullet: Pitfalls in Embedded Device Security
51mSecuring Embedded Linux Systems with TPM 2.0