Keylime, Securing your Slice of the Cloud.
summary
Keylime is a working, open source system that uses TPM chips to bootstrap hardware-rooted identities and perform continuous integrity checks: an agent, verifier, registrar architecture registers TPM AIKs, issues TPM quotes, and enforces a cryptographic provisioning flow where a split boot key requires both verifier and tenant halves. Demo shows a deliberate PCR 9 mismatch during shim boot causes the node to be fenced; runtime attestation can revoke certificates and drop IPsec tunnels. Project is migrating to Python3, FIPS cryptography, virtual TPMs and partial Rust ports.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:35What is Keylime
- 8:01Cloud Node
- 11:43Key Definitions
- 13:16Keylime Setup
- 21:10Demo
- 28:41Wrapup
- 30:08Keylime Tasks
- 30:57Virtual TPM
- 35:13Questions
related talks
49mKeylime: Bootstrapping and Maintaining Trust
41mKeylime - An Open Source TPM Project for Remote Trust of IoT
43mKeylime - An Open Source TPM Project for Remote Trust.
37mKeylime: Pushing the Boundaries of Remote Attestation on the Edge
20mCloud-native security in Rust with Keylime
46mToward Usable Open-Source Remote Attestation for Cloud and Edge
28mSecuring Cloud-Native Workloads from the Metal Up
10mLightning Talk: Fort Kairos: A New Dawn for Secure Linux in Untrusted Environments