https://peertube.watch/videos/watch/7e480b73-27fe-4cc9-b7f9-266845be0a1b The idea of using the comparatively new TPM2.0 as an infinite keystore was first proposed in 2016. Since then the base enabling work has been done inside the Linux Kernel and at the engine and provider layer of openssl and separately in gnupg (from 2.3). The main stumbling block in openssl, that of engine key enabling, has finally been mitigated by the openssl 3 move to providers. The big outlier is still openssh, which won't embrace either engines or providers, but the gpg-agent can be used to provide a TPM key based ssh-agent emulation. In this session, we'll review where we are and how to use a laptop TPM as a keystore (including a demonstration of ssh, gpg openssl and kernel based TPM keys), and where we're going including using TPM sealed keys with policy in the Linux Kernel to unlock disks under particular circumstances; the addition of localities to give keys which cannot be unsealed outside the kernel and the use of signed policies to try to counter the brittleness of PCR locking for measured boot (a signed policy key is a key that has a base policy, like locality, but which can have a set of signed policies that specify things like PCR values, which may be added to after the key was created). Speaker: James Bottomley, Track: Main Track - K Building, Room: K.1.105 (La Fontaine), When: Saturday 3 February 2024, 14:00–14:50 (Brussels time), Schedule: FOSDEM 2024 event page, Slides & links TPM2 engine for openssl (with policy), Using GPG with TPM2, Licence: Creative Commons Attribution 2.0 Belgium (CC BY 2.0 BE) (as stated in the FOSDEM video archive). Attribution: “Using your Laptop TPM as a Secure Key Store: Are we there yet?” by James Bottomley, FOSDEM 2024. Original recording: 2024/k1105/fosdem-2024-2452-using-your-laptop-tpm-as-a-secure-key-store-are-we-there-yet-.av1.webm from the FOSDEM video archive. This channel is an unofficial mirror; FOSDEM is a free and non-commercial event organised by the community for the community. Tue, 20 Oct 2026 22:17:23 GMT https://validator.w3.org/feed/docs/rss2.html PeerTube - https://peertube.watch https://peertube.watch/lazy-static/avatars/3b284627-b75f-409e-ac2e-10f4c2946f43.png https://peertube.watch/videos/watch/7e480b73-27fe-4cc9-b7f9-266845be0a1b All rights reserved, unless otherwise specified in the terms specified at https://peertube.watch/about and potential licenses granted by each content's rightholder.