Authenticated and Encrypted Storage on Embedded Linux
Talkat Open Source Summit Europe + Embedded Linux Conference Europe 2019 · on Wednesday, 2019-10-30· at 16:15· Forum 1·
summary
Catalog of kernel primitives and concrete combinations for embedded use cases names dm-crypt full-disk, dm-verity read-only rootfs, fs-verity for APKs and shows how to wire them with TPM-backed keys and userspace keyrings. Explains which stacks protect against sector tampering versus file modification, which add runtime attestation (IMA), and which impose heavy IO or boot-time cost. Recommends specific pairings for updateable devices, discusses debugging and recovery tradeoffs, and reports real deployment lessons.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:39Linux Storage Stack
- 1:50Transparent Authentication and Encryption
- 3:02Quick Crypto Refresher
- 6:12Overview
- 7:00dm-verity (since 2012, v3.4)
- 9:56dm-integrity (since 2017, v4.12)
- 13:55dm-crypt with authentication
- 15:47fsverity (since 2019, v5.4)
- 19:17UBIFS Authentication (since 2018, v4.20)
- 25:19Master Key Storage
- 27:15Recovery: Split RO and RW?
- 29:13Field Return Mode
- 30:25Recommendations
related talks
45mNavigating Security Tradeoffs in Embedded Linux Systems
53mSecure Embedded Linux Product - A Success Story
45mFull Disk Encryption for Confidential Computing Guests
41mProtecting Your System from the Scum of the Universe
32mELC 2013 Security: Best Practices for Embedded Systems
51mSecuring Embedded Linux Systems with TPM 2.0
57mFaux Disk Encryption: Realities of Secure Storage On Mobile Devices
52mSurviving in the Wilderness: Integrity Protection and System Update