On Mon, 2022-12-12 at 17:02 -0500, Stefan Berger wrote: > > > On 12/12/22 16:36, James Bottomley wrote: > > On Mon, 2022-12-12 at 14:32 -0500, Stefan Berger wrote: [...] > > > Either way, what is the latency that this introduces because I > > > would expect that this slows down IMA since the PCR extensions & > > > TPM 2 response now go back and forth across the network? > > > > Most data centre protocols are now encrypted and networked (NVMeoF > > would probably be the poster child) with no real ill effects. In > > terms of a TPM, the competition is an underpowered discrete chip > > over a slow serial bus, so I think we'll actually improve the > > latency not diminish it. > > Compared to QEMU and swtpm talking over a local socket you probably > have a decent amount of slow-down if this is over the network.
I can only repeat that doesn't happen with other much more volume and latency bound networked protocols. > I still fail to see the advantage over what we have at the moment. > Also I don't see what advantage the mssim protocol brings over what > swtpm provides. I think I've said a couple of times now: The primary advantage is that it talks to the reference implementation over its native protocol. > If you are willing to do a 'dnf -y install swtpm_setup' and start > the VM via libvirt it really doesn't matter what protocol the TPM is > running underneath since it's all transparent. Swtpm currently isn't building for Leap: https://build.opensuse.org/package/show/security/swtpm And, as I said, this is primarily for testing, so I need the reference implementation ... swtpm has started deviating from it. James
