Linux Security Summit Europe 2026

The kernel uses a novel null seed scheme to protect the security of TPM
communications against interposers as well as detect TPM reset attacks.
Since the kernel can't verify the null seed on its own, the name of the
derived key is projected up to userspace to be verified there. However,
this verification can be done once on boot and lasts until the next
reboot meaning any userspace application can simply inherit the check
instead of going to all the bother of trying to verify trust in the TPM
itself (which no current user space applications actually do because of
the complexity involved).

This talk will briefly describe how interposers work, how TPM
verification works, what the null seed scheme is how trust can be
established at OS install by using the TPM certificate to certify a
signing EK and permanently store its name in the filesystem. This
signing EK can be used on each boot to simply verify the null seed.
Finally we'll give examples of user space tools using the null seed in
real life to inherit the existing TPM trust.