systemd and TPM2 - Lennart Poettering, Microsoft

systemd and TPM2 - Lennart Poettering, Microsoft
systemd is the system and service manager of most contemporary Linux distributions. Recently it gained support for various TPM2-related features. In this talk we'll cover the existing ones, and those which will come next. Specifically: * TPM2 based disk unlocking * PCR hash and signed PCR policies * System and service credentials that encrypted/authenticated to TPM2 keys * systemd TPM2 logic for Confidential Computing * Measurement of system + file system identity and volume encryption keys * Pre-boot TPM2 hook-up in systemd-stub UEFI stub * Automatic enrollment to encrypted volumes to TPM2 at boot * Boot phases and PCR measurements * Reproducible and deterministic PCR measurements