↓ Skip to main content
Le Site de François
  1. Index/

Keylime

Security Attestation Tpm Ima Linux Cncf

Keylime is a CNCF project, originating at MIT Lincoln Laboratory, that turns the raw cryptographic primitives of the TPM into an operable remote attestation system for fleets of Linux machines. Its mission is narrow but important: given that a TPM can produce a signed quote over PCR values, and that IMA can accumulate a runtime measurement log into PCR 10, Keylime provides the infrastructure to continuously collect those quotes from many machines, verify them against policy, react to failures, and gate secret delivery on attestation success — without requiring operators to understand TPM protocols directly.

Keylime’s architecture follows the IETF RATS model and consists of four components with distinct roles. The Agent runs on each machine to be attested: it communicates with the local TPM, generates attestation keys, collects UEFI event logs and IMA measurement logs, and serves quotes to the verifier. The Registrar is an enrollment database: agents register themselves at boot by submitting their TPM Endorsement Key (EK) and a freshly generated Attestation Key (AK); the registrar performs a credential activation challenge to cryptographically confirm the AK belongs to a genuine TPM before recording the agent’s identity. The Verifier is the continuous attestation engine: it polls registered agents, requests TPM quotes over a configurable set of PCRs, replays the UEFI event log and IMA measurement log against those PCR values to confirm their integrity, and checks every IMA entry against an operator-supplied allowlist of approved file hashes. If any check fails — an unexpected PCR value, an unrecognised file hash, a missing quote — the verifier raises a revocation event. The Tenant is a CLI and API for operators: it enrolls agents with the verifier, sets policies, and can deliver a secure payload (an encrypted ZIP containing secrets, certificates, or bootstrap scripts) to a node, with decryption gated on the node having passed its first attestation — providing a TPM-anchored secret injection mechanism analogous to what Trustee provides for confidential VMs.

Keylime is the canonical attestation solution for TPM-equipped Linux hosts and is complementary rather than competing with Trustee: Keylime operates on conventional (non-TEE) hardware using the TPM as its trust anchor, whereas Trustee is designed for confidential computing guests where the TEE hardware itself is the root of trust. In both cases the underlying attestation flow is the same — collect hardware evidence, verify it against reference values, release secrets only to those who pass — but the evidence type, the trust anchor, and the threat model differ. Keylime integrates naturally with IMA-based runtime monitoring, GRUB-measured boot (PCR 8/9), and Secure Boot state (PCR 7), making it the operational glue that turns a measured boot stack into a continuously monitored one.

Related

IMA (Integrity Measurement Architecture)

Security Linux Kernel Attestation Tpm Integrity
IMA (Integrity Measurement Architecture) is a Linux kernel subsystem, merged in kernel 2.6.30, that hooks into the kernel’s file access paths — execve(), mmap(), open() — and computes a cryptographic hash of each file’s contents before it is accessed, according to a configurable policy. It is the runtime half of the Linux integrity story: where TPM PCR measurements and Secure Boot cover what was loaded during the boot sequence, IMA covers what happens after the OS is running, hashing executables, libraries, kernel modules, firmware, and configuration files as they are opened, creating a continuously updated record of everything the system has actually used.

Measured Boot

Security Boot Tpm Attestation Linux Firmware Uefi
Measured Boot is a boot process architecture in which each component in the boot chain — firmware, bootloader, kernel, initrd, kernel command line — is cryptographically hashed and that hash is recorded into a TPM Platform Configuration Register (PCR) before the component executes. The critical distinction from Secure Boot is in what each mechanism provides: Secure Boot is an enforcement mechanism that prevents unauthorised components from running at all; Measured Boot is a recording mechanism that creates a tamper-evident log of exactly what did run, without necessarily preventing anything. The two are complementary and typically deployed together — Secure Boot enforces a policy at boot time, Measured Boot produces the evidence that the policy was enforced as claimed. A system can have Measured Boot without Secure Boot (it records everything that ran, even unsigned components), but Secure Boot without Measured Boot provides enforcement with no attestable evidence of what was enforced.

Confidential Containers (CoCo)

Security Confidential-Computing Kubernetes Attestation Containers Cncf
Confidential Containers (CoCo) is a CNCF sandbox project that lifts hardware confidential computing — TDX, SEV-SNP, Intel SGX, IBM Secure Execution — up to the Kubernetes pod level, providing a unified software layer that abstracts away the underlying TEE technology. Its defining trust model is unusually strict: the Kubernetes control plane, the kubelet, the container runtime, and the cloud operator are all treated as explicitly untrusted. Only the hardware itself and the workload owner’s own supply chain are in scope for trust.