Uploaded July 2026 | Updated September 2026, 1 week ago
Talk by James Bottomley
socallinuxexpo.org/scale/23x/presentations/enhancing-tpm-security-linux-kernel
Note: Unfortunately the first few minutes of the talk are missing due to a technical issue.
Recent security updates to Linux, such as the new Systemd Unified Kernel Image rely on the discrete or firmware integrated TPM (Trusted Platform Module) to verify boot and release secrets securely. However, there are many known attacks against the TPM chip itself. We will discuss the newly upstreamed Linux Kernel TPM security patches, which not only provide a basis for securely communicating with the TPM but also provide a novel defences against a wide variety of TPM based attacks by using a unique (to Linux) null key scheme. This talk will cover what TPM based attacks are (including interposer attacks), how the Trusted Computing Group expects you to tell you're talking to a real TPM and how you can communicate with it securely and use its policy statements to govern key use and release. We will then move on to how the new Linux Kernel patches extend this and can be leveraged to validate the TPM on every boot and continually monitoring it for any TPM interposer substitutions in real time. The new TPM trust verification tools are available under LGPL as ancillary tools in the upser space openssl tpm engine project.
Talk by James Bottomley
socallinuxexpo.org/scale/23x/presentations/enhancing-tpm-security-linux-kernel
Note: Unfortunately the first few minutes of the talk are missing due to a technical issue.
Recent security updates to Linux, such as the new Systemd Unified Kernel Image rely on the discrete or firmware integrated TPM (Trusted Platform Module) to verify boot and release secrets securely. However, there are many known attacks against the TPM chip itself. We will discuss the newly upstreamed Linux Kernel TPM security patches, which not only provide a basis for securely communicating with the TPM but also provide a novel defences against a wide variety of TPM based attacks by using a unique (to Linux) null key scheme. This talk will cover what TPM based attacks are (including interposer attacks), how the Trusted Computing Group expects you to tell you're talking to a real TPM and how you can communicate with it securely and use its policy statements to govern key use and release. We will then move on to how the new Linux Kernel patches extend this and can be leveraged to validate the TPM on every boot and continually monitoring it for any TPM interposer substitutions in real time. The new TPM trust verification tools are available under LGPL as ancillary tools in the upser space openssl tpm engine project.
