TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Linux Kernel Key Retention Service

1 post · Nov 2022

What this trail covers

Cloudflare is exploring the use of the Linux Kernel Key Retention Service to protect cryptographic keys. This service allows keys to be stored outside of application process address spaces, providing isolation and reducing the risk of leaks due to memory access violations. It offers a kernel-level agent for cryptographic operations, with associated permissions and lifecycle management tied to processes or users. The service supports various key types, including asymmetric keys for RSA operations, and keyrings for managing key lifetimes and access control.

All Cloudflare trails
  1. The Linux Kernel Key Retention Service and why you should use it in your next applicationThis post introduces the Linux Kernel Key Retention Service as a mechanism to protect cryptographic keys from memory access violations. It explains the concept of virtual memory and stack-based memory leaks with a C code example. The post then details how the Key Retention Service, by operating as a separate kernel entity, mitigates these risks. It describes the service's key and keyring concepts, different key types (user, logon, asymmetric), and special keyrings (process, user) for managing key lifetimes and access. The post highlights the advantages of using the kernel service over a separate agent process, such as built-in isolation, system call interface, ACL enforcement, and lifecycle binding.