Nicolai Stange Implementing a software TPM in Rust    obstacles, progress and future plans
Channel: SUSE Labs
Date: 2023-08-02

Trusted Platform Module (TPM) devices play a pivotal role to trusted/confidential computing setups and remote attestation. TPMs store
sensitive keying material internally, which is supposed to never leave the module boundaries, and rigorously police any cryptographic
operations invoked on these keys from external entities like the OS.
With the increasing support for Dynamic Root of Trust technologies on recent CPUs and their associated isolation capabilities, especially
in the context of virtualization, there's more and more demand for running TPMs implemented purely software in these shielded locations.
A prime example would be the "COCONUT Secure VM Service Module for SEV-SNP", developed and maintained by SUSE's Joerg
Roedel.
As any compromise of such a software TPM would be fatal to the secrecy and trustworthiness of the keys held therein, it is desirable to
build on generic attack mitigation techniques wherever possible. In this line of reasoning, a software TPM implementation in Rust with its
inherently "memory safe" design has been started.
This talk will present an overview on obstacles taken so far, current progress and future plans.