What is Linux kernel keystore and why you should use it in your next application
summary
Linux provides a kernel key retention service that stores keys outside process memory and exposes them via syscalls: ADD_KEY to add blobs and request_key to ask a kernel helper to fetch keys from a KMS/HSM or TPM. Key types include user, logon, asymmetric RSA (can sign inside kernel), and encrypted/trusted keys; demos use keyctl and show a session keyring auto-destroying on logout. Integrations with TPM/HSM and a helper daemon let applications never see plaintext keys while still performing crypto; be careful with container namespace and syscall-tracing caveats.
AI-written summary · about
chapters (20)
- 0:00Linux kernel keystore intro
- 1:33Memory safety and key risks
- 5:55Key compromise consequences
- 8:23How keys get leaked
- 13:25Secure key management model
- 16:42Kernel key retention service
- 18:31Key rings and types
- 20:16Basic operations demo
- 21:43Secure secret sharing
- 23:27Key ring lifecycle
- 26:18Session key destruction demo
- 28:24Key types overview
- 30:30Signing data with RSA
- 31:35Replace SSH agent
- 33:02Encrypted and trusted keys
- 36:17Secure key provisioning
- 39:08Request key system call
- 41:17Benefits of request key
- 43:29Resources and closing
- 44:12Q&A
related talks
58mWhat is Linux kernel keystore and why you should use it in your next application
53mWhat is Linux kernel keystore and why you should use it in your next application
41mWhat Is Linux Kernel Keystore and Why You Should Use It in Your Next...
43mWhat is Linux kernel keystore and why you should use it in your next app
54mTPMs and the Linux Kernel: unlocking a better path to hardware security
43mTPMs and the Linux Kernel: unlocking a better path to hardware security
47mTPMs and the Linux Kernel: unlocking a better path to hardware security
45mTPMs & The Linux Kernel: Unlocking A Better Path To Hardware Security