Securing Embedded Linux Systems with TPM 2.0
Talkat Embedded Linux Conference + OpenIoT Summit North America 2017 · on Wednesday, 2017-02-22· at 17:20· Grand Ballroom I/II·
summary
Deep dive into using TPM 2.0 to get measurable security: shows Intel’s TSS 2 (system API) implementation on GitHub, a resource manager that mediates a single TPM, and the new TCPI transport abstraction; demonstrates PCR-based measured boot and sealing keys (BitLocker-style) to make disk keys unusable after tamper, and using the TPM RNG to feed the kernel entropy pool for better session keys. Builds a meta layer called meta-measured Open Embedded, has grub patches heading upstream, a Raspberry Pi SPI module demo, and notes current limits like missing big-endian support and physical attack out-of-scope.
AI-written summary · about
chapters (16)
- 0:00Intro
- 1:18LEVEL SET
- 3:40THE BASICS
- 6:43THREAT MODELING
- 9:11IF YOUR TEAM DOESN'T MODEL THREATS. Please do
- 10:40TERMS
- 13:59WHAT IS A TPM?
- 16:03TPM2 IMPLEMENTATION: DOMAIN SEPARATION
- 17:21TPM PROTECTIONS
- 21:27INTEGRITY: MEASURED BOOT
- 25:36TCG TPM2 SOFTWARE STACK: DESIGN GOALS
- 31:08TPM2 SOFTWARE STACK System API & TCT specification
- 33:31IMPLEMENTATION & CODE
- 37:50USE CASE: RNG
- 40:29USE CASE: CRYPTO OPERATIONS
- 42:28USE CASE: SEALED STORAGE AKA LOCAL ATTESTATION
related talks
51mApplications of TPM 2.0
39mTPM Is No Silver Bullet: Pitfalls in Embedded Device Security
37mtpm2-software.github.io - Enabling the TPM2.0 Ecosystem in Linux
28mThe TPM as an everyday security tool
25mOverview and Recent Developments: TPM
43mTPMs and the Linux Kernel: unlocking a better path to hardware security
45mTPMs & The Linux Kernel: Unlocking A Better Path To Hardware Security
42mRecent TPM Security Enhancements to the Linux Kernel