Meeting 26/07/23

[THS-on]

Attendees

• [x] @ansasaki
• [ ] @aplanas
• [ ] @edwards-n
• [x] @galmasi
• [ ] @kkaarreell
• [ ] @lkatalin
• [ ] @lukehinds
• [x] @edwards-n
• [x] @maugustosilva
• [x] Margie
• [ ] @mdrocco
• [ ] @mbestavros
• [x] @mheese
• [x] @mpeters
• [ ] @osresearch
• [x] @ruocco
• [x] @stringlytyped
• [ ] @stefanberger
• [x] @THS-on
• [ ] @tpletcher-hpe
• [ ] @ueno
• [x] Isaac
• [x] @gnurugs

Time: 26/07/23 15:30 BST (https://www.timeanddate.com/worldclock/fixedtime.html?msg=Keylime+Meeting&iso=20230726T1530&p1=136&ah=1) Link: https://uni-kiel.zoom.us/j/67189504412?pwd=VEQ0VlJLSGpKQkx3SnVpQWVUVjVCdz09

Topics and Notes

• Presentation of the current state of the Kubernetes operator by @mheese
  • @mheese showed the current state of the implementation by example and how the tenant functionality is mapped
  • mapping the agent uuid to the node is an potential issue
• Push Model
  • @stringlytyped started to writeup a document for the push model
  • The payload mechanism does not need to be part of the push model. User other tools like SPIFFE/SPIRE for hat
  • Quote Nonce ideas:
  • Request new nonce every time from verifier
  • On submission get a nonce for the next quote
  • Use an TOTP seed to generate the nonces locally (this requires the initial TPM clock information to protect against attacks of pre generating quotes)
  • Ideally the agent state is fully in the DB, so that it can be easily scaled, but for the initial implementation local agent state is ok
• SPIFFE/SPIRE proposal https://github.com/keylime/enhancements/pull/100
  • Mainly changes to the Keylime agent
  • Keep it generic for integration with other tools
• https://github.com/keylime/keylime/pull/1433
  • It was decided that it is either always enabled or only once

[mheese]

@THS-on regarding topics, I want to do a quick demo of the Kubernetes controller / attestation-operator that I have so far, so that I can get some feedback, and discuss the next steps

I'd also be interested in a discussion around the SPIFFE/SPIRE proposal from @mpeters

[stringlytyped]

It would also be good if we could spend a bit of time talking about push model support and what our requirements are for that. This might loosely tie into the SPIFFE/SPIRE discussion

[THS-on]

@stringlytyped @mheese added the topics