Meeting 13/07/22

[THS-on]

Project Board

https://github.com/orgs/keylime/projects/1

Attendees

• @THS-on (Thore Sommer)
• @lkatalin
• @ueno
• @lukehinds (Luke Hinds)
• @maugustosilva
• @galmasi

Meeting Time and Link

Time: 13/07/22 16:30 BST, 17:30 CEST (https://www.timeanddate.com/worldclock/fixedtime.html?msg=Keylime+Meeting&iso=20220713T1630&p1=769&ah=1)
Link: https://uni-kiel.zoom.us/j/62054657022?pwd=VmdITDRNaE9oRDd2cXhScU8xOVlIUT09

Topics

• Durable Attestation: First write-up for the new "offline attestation" functionality enhancements#76
• Progress of the rust agent
• Documentation update
• General discussions

Actions

• @lukehinds looks into readthedocs changes required after the move
• @THS-on adds good first enhancement tag
• IBM will test the rust agent before end of Q3 at scale
• Durable attestation proposal moves forward (only needs final checks before merging)
• Next video meeting is again in two months

Meeting notes

Durable attestation

The proposal is mostly finished. For now the registrar needs to be trusted for the verification that the AK belongs to the EK.
Features will be added to Keylime over a series of PRs.

Rust Agent

The Rust agent has reached main feature parity. Timeline for switching at the end of Q3 is probably going to happen.
If the configuration format is changed to either toml or yaml, then this should happen before the official release.

@galmasi is going to look into Debian packaging for the agent. See also: keylime/rust-keylime#371

General Questions

• fsverity supports IMA signatures
  • How does it exactly work?
  • Should we support it in Keylime?
• Using DevID in Keylime
  • How should we use it (@lukehinds)?
• Attesting nftables
• Might require more information about the entire network for online attestation and might not be possible on a agent by agent basis.