TPMs and the Linux Kernel: unlocking a better path to hardware security
summary
TPM adoption is low because apps must juggle resource managers, competing TSS stacks and privileged device access; this work shows a concrete path: use the Linux kernel key retention service plus the crypto API so applications reference keys by serial numbers instead of handling TPM protocols. A Python request_key plugin PoC derives reproducible application-specific keys from the TPM seed (KDF) so kctl and crypto sockets get hardware-backed keys; patches aim to move derivation into kernel (avoid userland plaintext) and add asymmetric TPM-backed keys.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 0:25Ignats background
- 1:03What is a TPM
- 2:24Remote attestation
- 4:11Why use TPMs
- 9:25TPMs on Linux
- 11:00Linux Key Retention Service
- 12:35Key Rings
- 13:52Example
- 15:36Key types
- 17:58Trusted keys
- 19:57Linux crypto API
- 25:00Key Management
- 29:53AtKey and RequestKey
- 32:44RequestKey plugin
- 40:30Conclusions
- 41:58Links
- 42:41Questions
related talks
54mTPMs and the Linux Kernel: unlocking a better path to hardware security
45mTPMs & The Linux Kernel: Unlocking A Better Path To Hardware Security
43mTPMs and the Linux Kernel: unlocking a better path to hardware security
42mTPMs and the Linux Kernel: unlocking a better path to hardware security
51mApplications of TPM 2.0
53mWhat is Linux kernel keystore and why you should use it in your next application
42mRecent TPM Security Enhancements to the Linux Kernel
37mtpm2-software.github.io - Enabling the TPM2.0 Ecosystem in Linux