Meeting 22/03/23

[THS-on]

Attendees

• [ ] @ansasaki
• [ ] @aplanas
• [ ] @edwards-n
• [ ] @galmasi
• [ ] @gustavobbrand
• [ ] @kkaarreell
• [ ] @lkatalin
• [ ] @lukehinds
• [x] @maugustosilva
• [ ] @mdrocco
• [x] @mbestavros
• [x] @mheese
• [x] @mpeters
• [ ] @osresearch
• [ ] @ruocco
• [x] @stringlytyped
• [ ] @stefanberger
• [x] @THS-on
• [x] @tpletcher-hpe
• [ ] @ueno
• [x] Isaac
• [x] Supreshna

Time: 22/03/23 15:30 GMT, 16:30 CET (https://www.timeanddate.com/worldclock/fixedtime.html?msg=Keylime+Meeting&iso=20230322T1530&p1=769&ah=1) Link: https://uni-kiel.zoom.us/j/64038396212?pwd=cERwRFA2MFRJWmxOUFRLNExtTzQ3Zz09 Meeting ID: 640 3839 6212 Passcode: 503582

Actions

• Next monthly release will be the 7.0.0 version without the Python agent.
• The vagrant setup will be fixed (not yet clear by whom). In the long term it will be replaced by the IBM deployment setup once open sourced.
• @tpletcher-hpe and @THS-on verify that remote attestation with hardware inventory UEFI logs works with Keylime and also talk about potential ideas about agent revocation
• tpm2_eventlog is going to be replaced by our own Python implementation. See: https://github.com/keylime/enhancements/issues/96
• @THS-on starts design meeting and document for new Keylime architecture

Meeting notes

HPE introduction to Keylime

• Two primary objectives
  • Enable the Keylime agent to perform deeper attestation of physical hardware
  • Enable the Keylime agent to operate against Aurora
• Enhancements to the Keylime agent
  • Support for device certificates (IDevID, LDevID, platform certificates)
  • Collection of other attestable hardware attributes
  • Modularization of the agent. Already partly done. Best contact is @ansasaki
  • Push model is required, for many deployments
  • Goal: provide an Open Source agent for attestable collection hardware attestable information (e.g. for transparency, ease of use)
• Interest in how to support virtualized environments with Keylime

Design discussions

• Check how SPDM or rats compliant
• Check differences between different attestation standards
• Push model is required for many users and has a major role in the redesign
• Stable APIs for the server side to allow easier integration
• Cleanup of agent APIs to make it easier to use for other systems

Other

• Running the verifier on edge devices might take too many resources
  • How small is a minimal server installation?
• There is interest of integrating Keylime with Kubernetes