The Linux Kernel TPM subsystem has been somewhat static for a while. For TPM2 (the standard TPM nowadays) it is used for IMA (PCR extensions), Periodic random number seeding and Trusted Keys (effectively TPM sealed data which may be piped securely to userspace because it can only be unwrapped by the kernel). The big upcoming change is adding encryption and HMAC security to all TPM transactions because of the threats from Interposers (hardware corrupted to snoop the TPM bus). This will be completely transparent to users, but infrastructure can be added to detect interposer compromises. This talk will outline how this works and the null seed scheme for detecting interposers.

TPM keys (really TPM sealed data) have been around for a long time and can be used for things like storing the symmetric key for LUKS based dm-crypt. A recent innovation for the kernel was to adopt the standardised form for ASN.1 keys (so other tools can seal and unseal them) and the latest innovation will be to add TPM policy (including signed policies) to kernel keys. This talk will detail what TPM policy is, how it works and how it can be used by the kernel.