Re: SVSM initiated early attestation / guest secrets injection

["Jörg Rödel" <jroedel@suse.de>]

On Sat, Jan 14, 2023 at 01:22:41PM -0500, James Bottomley wrote:
> On Sat, 2023-01-14 at 18:08 +0100, Jörg Rödel wrote:
> 
> [...]
> > As James also said, the measurement to unlock secrets need to include
> > all software/data components up to the point where the encrypted disk
> > gets mounted.
> 
> Well, we have a prototype in IBM Research using keylime to do this
> based on the vTPM measurements.  We currently bring up a network
> interface inside the initrd to run the keylime agent, but if you're
> already inventing a non-network method for attestation, there's no
> reason we couldn't transport TPM quotes over it as well.

So you are unlocking the disk via keylime remote attestation. This means
you need a measured initrd, right?

We were thinking about doing disk-unlocking via TPM in Grub, but that
has the problem that we need to securely deploy the TPM state at SVSM
init-time.

Regards,

-- 
Jörg Rödel
jroedel@suse.de

SUSE Software Solutions Germany GmbH
Frankenstraße 146
90461 Nürnberg
Germany

(HRB 36809, AG Nürnberg)
Geschäftsführer: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman