Re: SVSM initiated early attestation / guest secrets injection

[James Bottomley <jejb@linux.ibm.com>]

On Mon, 2023-01-16 at 17:55 +0100, Jörg Rödel wrote:
> On Sat, Jan 14, 2023 at 01:22:41PM -0500, James Bottomley wrote:
> > On Sat, 2023-01-14 at 18:08 +0100, Jörg Rödel wrote:
> > 
> > [...]
> > > As James also said, the measurement to unlock secrets need to
> > > include all software/data components up to the point where the
> > > encrypted disk gets mounted.
> > 
> > Well, we have a prototype in IBM Research using keylime to do this
> > based on the vTPM measurements.  We currently bring up a network
> > interface inside the initrd to run the keylime agent, but if you're
> > already inventing a non-network method for attestation, there's no
> > reason we couldn't transport TPM quotes over it as well.
> 
> So you are unlocking the disk via keylime remote attestation. This
> means you need a measured initrd, right?

Right, the current measured boot for a standard machine includes a
measurement of the initrd.

> We were thinking about doing disk-unlocking via TPM in Grub, but that
> has the problem that we need to securely deploy the TPM state at SVSM
> init-time.

Not necessarily.  We're prototyping it with an intermediate parent key
which can be injected after measurement using the keylime facility.

James