A look into Network-Bound Disk Encryption
summary
Network‑Bound Disk Encryption is implemented with clevis clients and tang servers and supports three binding modes: SSS (Shamir secret sharing), TPM PCRs, and Tang host lists. Server-side key rotation is trivial; client-side used to be hard, so three new clevis subcommands (list, report, rebind) reveal bound configurations, test whether a key slot is still advertised, and regenerate bindings. Demo binds an encrypted LUKS device to two Tang servers with SSS threshold=1, rotates server keys with tangd-keyctl, and successfully unlocks the device afterward.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:35Overview
- 2:48NetworkBound
- 6:41Threshold
- 7:14Statekeep
- 7:50Key rotation
- 15:37Demonstration
- 16:11Useful links
related talks
47mClevis and Tang: securing your secrets at rest
34mRecoverable, Tamper-resistant Full-disk Encryption at the Distributed Edge
45mFull Disk Encryption for Confidential Computing Guests
51mApplications of TPM 2.0
34mAuthenticated and Encrypted Storage on Embedded Linux
30mTrust No One: Secure Storage With Confidential Containers
35mChains of trust in Confidential Computing
18mSecurely booting confidential VMs with encrypting disk