Keylime: Trust on the Edge with TPM Attestation
Shriira Press
How a small open-source project uses the TPM to answer one hard question: can I trust this machine right now?
Welcome to Keylime: Trust on the Edge with TPM Attestation.
Keylime is a CNCF project, born at MIT's Lincoln Laboratory, that brings hardware-rooted trust to the kinds of machines we normally have to take on faith: edge nodes in a field cabinet, virtual machines in someone else's cloud, IoT devices we will never physically touch again. It uses the Trusted Platform Module already present in most modern hardware to prove a machine's identity, to verify that it booted the firmware and kernel we expected, and to watch — continuously — for any file or binary that strays from policy. When something does go wrong, Keylime can revoke the offending node and even hand verified machines a secret payload they are only able to decrypt once they have proven themselves trustworthy. This book walks the whole arc. We begin with the problem of trusting a remote computer and the idea of a hardware root of trust, then meet the TPM and the four Keylime services — agent, registrar, verifier, and tenant. From there we follow an agent's enrollment, the measured-boot and IMA runtime checks the verifier performs, the elegant U/V key split that gates secure payload delivery, the revocation framework, the move to a push-based architecture, and finally how teams run Keylime in production.
This title is part of the ShriIra library and is free to read in full, right here — our small contribution to making world-class knowledge easy to reach.
A note on reading it: open the Contents menu at the top of the reader to jump between chapters, use the Aa menu to set a comfortable text size, theme (light, sepia, or night), and single- or two-page layout. Your place is saved automatically, so you can always pick up where you left off.
We hope it serves you well.
— Shriira Press