Toward Usable Open-Source Remote Attestation for Cloud and Edge
summary
Demonstrates an integration between Keylime and flightctl that replaces Keylime’s pull model with a Keylime verifier push API so flightctl’s agent sends TPM quotes; verifier still validates PCR quotes and IMA logs. Shows scale tests at thousands to tens of thousands of nodes, marks TPM features in flightctl as experimental, and lists three concrete reference-value sources: build-system exports, golden measurements, and TOFU initial boot measurements. Maps work to IETF RATS and calls for automated policy generation from build pipelines.
AI-written summary · about
chapters (12)
- 0:00Remote attestation introduction
- 2:49What is remote attestation
- 6:23Hardware roots of trust
- 9:12Remote attestation in edge
- 12:39Defining policy and measurements
- 16:56Challenges in measurements
- 19:06Key Lime architecture
- 23:22Flight Control integration
- 26:49Automating policy generation
- 29:59RATS standard
- 33:51Standardization in attestation
- 36:17Q&A
related talks
43mKeylime - An Open Source TPM Project for Remote Trust.
41mKeylime - An Open Source TPM Project for Remote Trust of IoT
37mKeylime: Pushing the Boundaries of Remote Attestation on the Edge
49mKeylime: Bootstrapping and Maintaining Trust
38mKeylime, Securing your Slice of the Cloud.
20mCloud-native security in Rust with Keylime
42mTPM based attestation - how can we use it for good?
29mA Simple Protocol for Remote Attestation of System Integrity