Posts
4983
Following
329
Followers
494
Linux kernel hacker and maintainer etc.

OpenPGP: 3AB05486C7752FE1
jarkko

Jarkko Sakkinen

"I’m not glad he’s dead, but I’m glad he’s gone.”

https://www.reuters.com/world/us/former-us-vp-dick-cheney-dead-84-punchbowl-news-says-2025-11-04/
0
0
1
jarkko

Jarkko Sakkinen

still fresh :-) https://www.youtube.com/watch?v=MLcxve603-4
0
0
1
jarkko

Jarkko Sakkinen

split zmodem2 into two separate projects:

1. https://crates.io/crates/zmodem2
2. https://crates.io/crates/lrzsz2

this will still need a lot of love before being a production tool but working batch transfers (against lrzsz) is good start.
0
0
0
jarkko

Jarkko Sakkinen

batch file transfers finally working reliably
0
0
1
jarkko

Jarkko Sakkinen

I created a cheat sheet of my accumulated custom shortcuts in vim using typst. i'm going to maintain this and capping custom shortcuts to fit into single A4 helps to make sure that things don't get too complicated :-)
0
1
2
jarkko

Jarkko Sakkinen

going to submit a talk next year to the first linux security summit cfp :-)
0
0
1
jarkko

Jarkko Sakkinen

  1. https://crates.io/crates/tpm2sh
  2. https://crates.io/crates/tpm2-protocol
  3. https://crates.io/crates/tpm2-crypto
  4. https://crates.io/crates/tpm2-policy-language
  5. https://crates.io/crates/tpm2-tpmkey

i guess you can call this a “developer ecosystem” :-)

#linux #rustlang #tpm

0
0
0
jarkko

Jarkko Sakkinen

I sometimes wish that I'd see more "Skilled Skateboarders" than "Skilled Board Members" at LinkedIn. World would probably be a better place if that would ever happen.
2
4
12
jarkko

Jarkko Sakkinen

tpm2sh 0.15.0 compiles the policy commands to the DER payload.

Crypto has been migrated to OpenSSL for sake of allowing to be (or delegating the policy of being) FIPS compatible, and making crypto patchable.

#linux #kernel #tpm #openssl #rustlang
0
2
1
jarkko

Jarkko Sakkinen

0
2
3
jarkko

Jarkko Sakkinen

hooray 10K downloads: https://crates.io/crates/tpm2sh
1
0
0
jarkko

Jarkko Sakkinen

Edited 28 days ago
Decomposition time now that tpm2sh has matured to a usable peace of software.

First off, here's basic set of cryptographic routines defined in the TCG TPM 2.0 architecture specification:

https://crates.io/crates/tpm2-crypto

They've been tested equally in client and emulator implementation.

More to come as I dislike the size of current tpm2sh code base (7 KSLOC).

#linux #tpm #rustlang
1
0
0
jarkko

Jarkko Sakkinen

oh dear: https://blogs.windows.com/windowsexperience/2025/10/16/making-every-windows-11-pc-an-ai-pc/
3
1
1
jarkko

Jarkko Sakkinen

Yet another reason for improving DSO support in Rust would be to give people freedom of choice to license with LGPL.
0
0
0
jarkko

Jarkko Sakkinen

https://crates.io/crates/tpm2sh/0.13.0

With the tpm2sh 0.13.0 the goals that I set when I started working on this in August are fulfilled:

1. First class handling of TPMKey ASN.1 format, and import capabilities from the most common formats for ECC and RSA keys (PKCS#1, PCKS#8 and SEC1).
2. Meaningful and "human" way to describe key policies (e.g., "(pcr(sha256:16) or pcr(sha256:7)) and secret(tpm:81000001)").
3. Intutive interface to browse the TPM memory and download EK certificates.
4. Virtual TPM address space with transparent context handling and clean up of stale contexts (from earlier power cycles).

In other words, tpm2sh addresses now the immediate kernel hacking needs for TPM driver itself, Linux keyring, IMA etc. One additional feature I'm going to finish off at some point is parameter encryption, which won't take long tas tpm2sh already creates unsalted and unbound HMAC sessions for different tasks.

Patches are always welcome, and can be sent to tpmprotocol@lists.linux.dev ;-)

#linux #kernel #tpm #rustlang
0
1
2
jarkko

Jarkko Sakkinen

tpm2sh 0.12.4 uses hmac sessions but they are not very useful tho as they are both unsalted and unbound sessions. This is of course on purpose because the infrastructure needs to be polished first. Right now it is a mess (but works) :-)

Just like you never do "start-session" for policies but instead describe them in expressions HMAC functionality is transparent to the user and does not require any configuration.
0
0
0
jarkko

Jarkko Sakkinen

Edited 1 month ago
tpm2sh 0.12.3 loads and processes multi-level ancestor chains correctly, policy expressions have now a more stable manually implemented custom-built parser.

https://crates.io/crates/tpm2sh/0.12.3

#linux #tpm #rustlang
1
0
3
jarkko

Jarkko Sakkinen

Edited 1 month ago
I discarded mocktpm from tpm2sh but I'm planning to implement a *non-generic* TPM emulator.

I.e. I look at Infineon 96xx capabilities and behavior and limit the features match that chipset, and like have non-optionated CA (either generated or provided) for endorsement keys, and not wholealot configuration.

And yeah, I'll implement ability to bind QEMU.

This is to have something super easy (vs swtpm) to get a fake TPM chip for kernel tests and developing and test stuff like Himmelblau IDM.

#linux #kernel #tpm #himmelblau
0
0
1
jarkko

Jarkko Sakkinen

cool someone asked me about my unfinished / backlogged patch set [1].

I stopped working on that since I thought nobody cares about the feature. I also stopped working on it because TPM2 user space sucked and it is really hard to experiment whether uapi makes sense for that reason.

Now I have my own user space that exactly has strong external capaiblities, compiles fluently to BuildRoot image, and there's one company/person that wants the feature.

I guess updating this patch set is next in my queue after tpm2sh :-)

[1] https://lore.kernel.org/linux-integrity/20240528210823.28798-1-jarkko@kernel.org/
0
0
0
jarkko

Jarkko Sakkinen

Noteworthy in this is the implict parent discovery without having to specify parent when loading keys :-) It recursively loads always the whole hierarchy where parent key is discovered either among persistent keys or cache.

#linux #kernel #tpm
0
0
0
Show older
About social.kernel.org

Terms of service

  1. Please do not use this service in violation of the Linux Kernel Code of Conduct. Doing so will result in your account suspension with the referral of the matter to the CoC committee.

  2. "Repeating"/"boosting" someone else's status on this platform will be treated as endorsement and will fall under rule #1.

  3. You are encouraged to use this platform to promote your work on the Linux Kernel, but there is no restriction on permitted topics (with the exception of anything covered by #1 above).

  4. There is no requirement to post in English, but it should be considered the primary language of communication on this platform.

Privacy notice

The admins of this service have access to all posted statuses. They aren't looking, but if it's something they shouldn't know about, then you should not post it on this platform.

Please see the Linux Foundation Privacy Policy, which applies to this platform as well.

Getting your own account

If you would like an account on this instance, please check that the following applies to you:

  • You are listed in MAINTAINERS or CREDITS

  • OR: You have a kernel.org account or email address

  • OR: You have a long and established history of involvement with the Linux Kernel

If the above is true and you agree with the Terms of Service and Privacy Notice listed above, please use these instructions to request an account: