veyepar: TPM based attestation - how can we use it for good?

Author(s):	Matthew Garrett
Location	Arena
Date	jan Fri 17	Days Raw Files
Start	10:45	First Raw Start	error-in-template
Duration	0:45:0	Offset	None
End	11:30	Last Raw End
Chapters
Total cuts_time	None min.

https://lca2020.linux.org.au/schedule/presentation/64/
raw-playlist raw-mp4-playlist encoded-files-playlist mp4 svg png

assets release.pdf TPM_based_attestation_how_can_we_use_it_for_good.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:

Locked:

clear this to unlock

Locked by:

user/process that locked.

Start:

initially scheduled time from master, adjusted to match reality

Duration:

length in hh:mm:ss

Name:

Video Title (shows in video search results)

Emails:

email(s) of the presenter(s)

Released:

has someone authorised pubication

Normalise:

Channelcopy:

m=mono, 01=copy left to right, 10=right to left, 00=ignore.

Thumbnail:

filename.png

Description:

markdown

Systems with a Trusted Platform Module generate a cryptographically verifiable event log of every component of the boot process. They can then provide a signed quote of this log in order to prove to a remote site that they booted the expected software. In the early 2000s we were concerned about that resulting in websites that would refuse to grant you access unless you were running an unmodified proprietary operating system, but for various reasons that turned out to not be a problem in the real world. Some years later, how can we use this attestation data for the power of good?

This presentation will describe the functionality of TPMs and how the event log is generated, and describe techniques for making use of TPMs to protect access to network resources, solve the problem of trusting SSH host keys in enterprise environments and make it easier for people to recover their systems while on the road. It will include demonstrations of using newly released open source software to build novel attestation solutions for protecting end users without giving up privacy or control.

Comment:

production notes