Using DevIDs and TPMs for Node Attestation
Talkat Production Identity Day: SPIFFE + SPIRE 2020 · on Tuesday, 2020-11-17· at 16:10· Virtual, Virtual·
summary
Proposal implements a TPM Node Attestor plugin for SPIRE that follows the TCG draft and 802.1AR, using TPM 2.0-protected DevID certificates whose private keys are stored as an encrypted private key blob that can only be used inside the creating TPM. Agent loads the cert and blob, TPM signs a server challenge, server verifies signature against CA bundle. Plugin plus a provisioning tool are built and demoed on a physical server — attestation succeeds; OpenSSL currently lacks some TCG OID support.
AI-written summary · about
chapters (6)
related talks
18mSecuring Edge Systems with TPM 2.0 and SPIRE
29mRemote Attestation of IoT devices using a discrete TPM 2.0
42mTPM based attestation - how can we use it for good?
28mSecuring Cloud-Native Workloads from the Metal Up
24mFrom Trust Assumptions To Trust Evidence: Why PKI and Confidential Computing
29mA Simple Protocol for Remote Attestation of System Integrity
41mUnifying Confidential Attestation
20mSecuring the Software Supply Chain with the in-toto & SPIRE projects