Making Remote Attestation Useful on Linux
Talkat Linux Security Summit North America 2019 · on Wednesday, 2019-08-21· at 11:25· Sapphire D, Hilton San Diego Bayfront·
summary
Goal is cryptographic identity and state attestation for Google’s ~200,000 Linux and Windows machines, supporting TPM 1.2 and 2.0 and implemented in Go. Work includes a scale-tested client/server (over 25,000 systems generating attestations), code for verifying quotes and replaying event logs, and three GitHub projects including go-attestation and go-tpm libraries. Kernel changes land in kernel 5.3 to provide the crypto-agile event log; remaining gaps are mapping logs to actionable platform attributes and Windows-equivalent metadata.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:35Goals
- 2:42Requirements
- 4:19What weve done so far
- 12:38Code release
- 14:04Discussion
- 17:30Questions Comments
- 19:27Initial Provisioning
- 20:04Additional Measurements
- 21:44Questions
related talks
40mUsing TPMs to Cryptographically Verify Devices at Scale
42mTPM based attestation - how can we use it for good?
29mA Simple Protocol for Remote Attestation of System Integrity
29mRemote Attestation of IoT devices using a discrete TPM 2.0
25mDemystifying remote attestation
59mLayered Attestation of a Cross-Domain System
43mKeylime - An Open Source TPM Project for Remote Trust.
41mKeylime - An Open Source TPM Project for Remote Trust of IoT