Hardware-backed Per-process Secrets
summary
Proposes sealing TPM secrets to processes or namespaces so a TPM blob can only be loaded while a specific process or container is running, implemented as kernel patches that make TPM state per-process and use a measured, resettable NV index (fallback to PCR 23 where available) as a per-process cookie. Demonstrates a working prototype that unblocks authenticated hibernation, documents failures with TPM localities and why upstream integration stalled, and shows remote attestation via NV certify plus PCR quotes.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 1:00Hardwarebacked identity
- 3:05What can TPM do
- 6:16Platform configuration registers
- 7:22The magic formula
- 10:05Use cases
- 12:44Individual events
- 14:43What can we do
- 16:16Access to extremely sensitive resources
- 18:07Resource Manager
- 20:34System Permissions
- 21:34Why we dont support hibernation
- 23:43Making use of PCR23
- 25:42Order of events
- 26:52Capping
- 28:17Exit boot services
- 31:04Alternative
- 32:28locality support
- 33:14NVRAM
- 34:30extendable indices
- 35:49NV certify
- 39:31Current implementation
- 40:52Summary
related talks
27mSecuring TPM Secrets with TXT and Kernel Signatures
39mTPM Is No Silver Bullet: Pitfalls in Embedded Device Security
42mTPMs and the Linux Kernel: unlocking a better path to hardware security
41mUnifying Confidential Attestation
51mApplications of TPM 2.0
33mSecuring TPM Secrets with TXT and Kernel Signatures
42mRecent TPM Security Enhancements to the Linux Kernel
15mRemote Attestation in AMD SEV-SNP Confidential VMs