Loading…
Linaro Connect San Diego 2019 has ended
Linaro Connect resources will be available here during and after Connect!

Booking Private Meetings
Private meetings are booked through san19.skedda.com and your personal calendar (i.e. Google Calendar). View detailed instructions here.

For Speakers
Please add your presentation to your session by attaching a pdf file to your session (under Manage Session > + Add Presentation). We will export these presentations daily and feature on the connect.linaro.org website here. Videos will be uploaded as we receive them (if the video of your session cannot be published please let us know immediately by emailing connect@linaro.org).

Dave’s Puzzle - linaro.co/san19puzzle

Sign up or log in to bookmark your favorites and sync them to your phone or calendar.

Security [clear filter]
Thursday, September 26
 

11:00am

SAN19-411 Runtime Secure Keys in OP-TEE
Till now all keys stored in OP-TEE secure storage are secured at rest by encrypting it with FEK.
But when these keys are being used for operations these keys are kept in plain format in OP-TEE internal structures.

This is because cryptographic operations in OP-TEE are currently done with software libraries(libtomcypt and mbedTLS), and cryptographic operations are nothing but mathematical operations, so software libraries need private keys in “plain format” for operations.

Keeping these keys in plain format makes them vulnerable to following attacks with respect to confidentiality and integrity which is main objective of Trusted Execution Environment.
- By exploiting any vulnerability in code such as buffer overrun or bugs like Heartbleed.
- Using side channel attacks such as cold boot attack - in which an attacker with physical access to a computer performs a memory dump of a computer's RAM by performing a hard reset of the target machine.

Since nature of hardware-based cryptography ensures that the information stored in hardware is better protected from external attacks, so above issue can be fixed when these keys are backed by some hardware component. We need some mechanism in which the keys doesn’t exist in plain format in secure memory.

Hardware component will export the private keys only in encrypted form to secure memory.
During operations takes private keys in encrypted form and convert them into plain format internally and do operations with them.
Even If attacker gets access to this key in secure memory somehow, will not be able to find out the actual key.

Speakers
avatar for Sahil Malhotra

Sahil Malhotra

Lead Software Engineer, NXP Semiconductors
Having a total experience of 7 years in Embedded Programming.Worked on various areas including PKCS#11, Arm TrustZone, OP-TEE, OpenSSL, Networking.



Thursday September 26, 2019 11:00am - 11:25am
Sunset V (Session 1)

11:30am

SAN19-413 TEE based Trusted Keys in Linux
Protecting key confidentiality is essential for many kernel security use-cases such as disk encryption, file encryption and protecting the integrity of file metadata. Trusted and encrypted keys provides a mechanism to export keys to user-space for storage as an encrypted blob and for the user-space to later reload them onto Linux keyring without the user-space knowing the encryption key. The existing Trusted Keys implementation relied on a TPM device but what if you are working on a system without one?

This session will introduce a Trusted Keys implementation which relies on a much simpler trusted application running in a Trusted Execution Environment (TEE) for sealing and unsealing of Trusted Keys using a hardware unique key provided by the TEE.

Speakers
avatar for Sumit Garg

Sumit Garg

Software Engineer, Linaro
Currently working as part of Support and Solutions team, Linaro. Responsible for activities related to platform security like OP-TEE, trusted firmware, boot-loaders etc. Also responsible for tool-chain support activities. Contributed in various open source projects like OP-TEE, TF-A... Read More →



Thursday September 26, 2019 11:30am - 11:55am
Sunset V (Session 1)