Securing Meta's Production PKI Credentials
summary
Meta protects billions of PKI credentials (some valid up to 3 months) against root-level exfiltration by combining IP binding checks, short-lived tokens, and hardware-backed keys. Certificates now carry IP assertions and 94% of connections enforce matching addresses; delegated credentials (RFC 9345) handle TLS handshakes with 2‑day lifetimes and reach 51% of new connections, aiming for 1 day. Private keys are sealed in TPMs, whose reliability rose from ~84% to 93% after fixes but dropped to ~88–89% when TPM‑signed delegated credentials scaled, prompting a 50‑day remediation.
AI-written summary · about
chapters (9)
- 0:00Securing Meta's PKI credentials
- 2:16PKI credential security at Meta
- 3:39Revocation as security measure
- 5:04IP binding in certificates
- 10:56Short-lived tokens for credentials
- 13:25Delegated credentials to reduce risk
- 17:39TPMs for credential storage
- 20:49Rollout challenges and reliability
- 24:24PKI security best practices
related talks
24mFrom Trust Assumptions To Trust Evidence: Why PKI and Confidential Computing
38mMeta-security: Past, Present, and Future
27mAddressing the growing threat of non-human identities with PKI
36mSig Auth Deep Dive
29mKeys, Certs and Vault: From DevSecOps to Post-Quantum
30mTrust Engineering: Building Security Leadership at Early-Stage...
56mIoT: Taking PKI Where No PKI Has Gone Before
07mEstablishing Digital Trust