TPMs and the Linux Kernel: unlocking a better path to hardware security
summary
Claims that the kernel exposes TPMs to apps via the keystore and crypto API, avoiding Intel/IBM TSS and root-owned device files, and that a request_key plugin prototype (Python) derives reproducible keys from the TPM seed so keys need not be stored. Linux 6.2 already adds kernel crypto socket integration for symmetric TPM-derived keys; asymmetric support is experimental. The prototype works in demos but needs upstream kernel changes for full in-kernel, rootless workflow.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 4:02TPMs underused in open source
- 7:33TPM software integration challenges
- 12:33Linux key retention service
- 20:00TPMs with Linux key store
- 27:47Deriving keys from TPM seeds
- 31:02Request key system call and helpers
- 39:57Future of TPM derived keys
- 40:41Conclusion and Q&A
related talks
45mTPMs & The Linux Kernel: Unlocking A Better Path To Hardware Security
54mTPMs and the Linux Kernel: unlocking a better path to hardware security
47mTPMs and the Linux Kernel: unlocking a better path to hardware security
42mTPMs and the Linux Kernel: unlocking a better path to hardware security
42mRecent TPM Security Enhancements to the Linux Kernel
51mApplications of TPM 2.0
37mtpm2-software.github.io - Enabling the TPM2.0 Ecosystem in Linux
23mTPM