What is Linux kernel keystore and why you should use it in your next application
summary
Explains that Linux’s kernel key retention service stores keys as kernel objects (use keyctl and request_key) so cryptographic material never sits long in a process address space, preventing leaks like the stack-uninitialized example that exposed a private key; shows session keyring auto-destroy that erases keys on process exit and measures TPM as too slow for per-request use so proposes wrapping a boot-time root key in TPM then software-unwrapping others; demonstrates a prototype request_key plugin that derives per-executable keys from TPM and an OpenSSH patch that uses kernel RSA keys — it works in demos.
AI-written summary · about
chapters (18)
- 0:00Linux kernel keystore intro
- 2:00Memory isolation in processes
- 6:41Why cryptographic key protection matters
- 11:00Key agent model for isolation
- 13:34Kernel key retention service
- 17:10Key rings and types
- 21:28Key lifecycle and destruction
- 23:37User vs special key types
- 26:31Key management with encrypted keys
- 31:31Request key system call
- 34:41TPM integration for keys
- 38:55Generating keys from metadata
- 42:11TPM performance and security
- 45:49Q&A: Kernel callbacks security
- 47:55Q&A: Signing network packets
- 49:19Q&A: HSM vs PKCS#11
- 51:04Q&A: Persistent storage needs
- 52:32Q&A and closing
related talks
55mWhat is Linux kernel keystore and why you should use it in your next application
43mWhat is Linux kernel keystore and why you should use it in your next app
58mWhat is Linux kernel keystore and why you should use it in your next application
41mWhat Is Linux Kernel Keystore and Why You Should Use It in Your Next...
45mTPMs & The Linux Kernel: Unlocking A Better Path To Hardware Security
47mTPMs and the Linux Kernel: unlocking a better path to hardware security
54mTPMs and the Linux Kernel: unlocking a better path to hardware security
51mApplications of TPM 2.0