What Is Linux Kernel Keystore and Why You Should Use It in Your Next...
summary
Linux kernel keystore stores cryptographic material as kernel objects so keys never touch user space and key lifetime binds to keyrings (process/session/user/persistent), with ACLs and LSM hooks enforcing access. It supports user, logon, asymmetric and encrypted keys, TPM-wrapped root keys, and a demo shows session keys auto-destroy on logout. A request_key helper syscall lets a privileged user-space agent fetch keys from cloud HSMs and instantiate them in-kernel (used to prototype replacing SSH agent).
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:52Linux address spaces
- 6:02Not all process data is created equal
- 9:18Arbitrary/remote code execution
- 10:02Buffer reuse
- 13:46Key agent model
- 16:41Linux Kernel key retention service
- 18:15Keys and keyrings
- 22:01Example: secret sharing
- 23:43Special keyring types
- 25:45Session keyring example
- 29:03Asymmetric keys
- 29:27Asymmetric key example (ssh-agent replacement)
- 30:53Minimizing cryptographic material exposure
- 31:23Encrypted keys
- 32:26Trusted keys
- 35:36Linux Kernel key provisioning
- 37:41request_key(2) advantages
related talks
58mWhat is Linux kernel keystore and why you should use it in your next application
43mWhat is Linux kernel keystore and why you should use it in your next app
55mWhat is Linux kernel keystore and why you should use it in your next application
53mWhat is Linux kernel keystore and why you should use it in your next application
35mOverview and Recent Developments of Keyrings Subsystem
45mTPMs & The Linux Kernel: Unlocking A Better Path To Hardware Security
43mTPMs and the Linux Kernel: unlocking a better path to hardware security
54mTPMs and the Linux Kernel: unlocking a better path to hardware security