Meeting 09/11/22

[THS-on]

Project Board

https://github.com/orgs/keylime/projects/1

Attendees

• [x] @ansasaki
• [ ] @aplanas
• [ ] @edwards-n
• [x] @galmasi
• [x] @gustavobbrand
• [ ] @kkaarreell
• [x] @lkatalin
• [ ] @lukehinds
• [x] @maugustosilva
• [x] @mdrocco
• [x] @mbestavros
• [x] @mpeters
• [x] @osresearch
• [x] @THS-on
• [ ] @ueno

Time: 09/11/22 16:30 GMT, 17:30 CET (https://www.timeanddate.com/worldclock/fixedtime.html?msg=Keylime+Meeting&iso=20221109T1630&p1=769&ah=1) Link: https://uni-kiel.zoom.us/j/63927820011?pwd=K2xLM2tmRitHYXBpWllWSzkxN090UT09

Topics

Durable Attestation

• Review is mostly complete, last few changes will be addressed.
• Will be merged as an experimental feature first, to let users try it more easily
• Next PR will contain documentation and commandline tools

IMA policy changes

• Conversion script is ready to merge
• The new format implementation is mostly reviewed, current blocker are the e2e tests
• The switch to the new format will be done in 6.6.0
• DSSE will be the signing format in the feature
  • Signatures are still optional
  • Only DSSE will be supported when we make the switch
  • Offical library will be used, but probably a fallback will be implemented to make packaging simpler.

CNCF annual review

• @mpeters will submit the final PR

Packaging of the Rust agent for Debian

• Most of the dependencies are not yet packaged
• Publishing on crates.io will take some time
  • Split the agent into a server and library component
  • Change the packaging for SUSE and Fedora
  • @THS-on is going to work on an initial attempt to package the rust agent for Debian and notifies @galmasi once it is in a working state.

TPM.dev talk about measured boot in Keylime

• @THS-on posts the video and slides once publicly released.

Status of IAK/IDevID proposal

• The initial code is not there yet, but it is back on the schedule to be implemented

Local Testing

• The local testing script is broken and slow
• @ansasaki will fix the script, after that we can put some effort into caching to make the setup stage faster.

IMA attestation causes high DB traffic

• For more see https://github.com/keylime/keylime/issues/1167

FOSDEM 2023

• @ansasaki is going to submit a talk about Keylime
• If you have an interesting topic security related, please submit a talk by the end of November.

safeboot

• safeboot implements boot attestation and releases secrets after to unlock an encrypted disk and then launch that operating system
  • safeboot's protocol is designed to keep the round trips minimal
  • Uses one shot attestation (no continues attestation)
  • Potential integration with Keylime
  • Allow for one shot attestation (will probably only work with a push model)
  • See on how the safeboot's protocol can be connected to the registrar and verifier model
  • @osresearch will be adding a proposal with the general ideas and requirements
  • Key ownership based attestation might be interesting in that use case: https://www.mdpi.com/1424-8220/22/13/5060

Releases

• 6.5.2 this week
• 6.6.0 once the IMA changes are in (hopefully by the end of this month)