BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.all-systems-go.io//all-systems-go-2026//YHBEPY
BEGIN:VTIMEZONE
TZID:CET
BEGIN:STANDARD
DTSTART:20001029T040000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-all-systems-go-2026-TKKLMZ@cfp.all-systems-go.io
DTSTART;TZID=CET:20261001T121000
DTEND;TZID=CET:20261001T123500
DESCRIPTION:When a VM is confidential (CVM)\, the host cannot access its me
 mory\, enabling data-in-use protection. Hardware vendors like Intel (TDX) 
 and AMD (SEV-SNP) provide the underlying technology to achieve this. The u
 se case becomes more complex when a persistent disk is added to a CVM: the
  disk must also be encrypted\, but how can we safely manage its encryption
  keys without trusting the host? We propose a mechanism to encrypt and dec
 rypt a disk using remote attestation: the passphrase is stored in a Key Br
 oker Service (KBS) that only releases it when the identity of the VM is ve
 rified. During the first boot\, systemd-repart encrypts the root disk usin
 g a random key that is generated and stored in KBS. On subsequent boots\, 
 systemd-cryptsetup requests the same key to decrypt the disk. We present t
 he changes we are working on to support this use case in components like K
 ubeVirt\, Trustee\, and systemd-repart. We present PRs for Trustee\, syste
 md-repart\, and KubeVirt\, along with a new LUKS token plugin that integra
 tes systemd-repart and systemd-cryptsetup with KBS for key retrieval. This
  use case extends beyond KubeVirt and applies to any environment where con
 fidential workloads require encrypted persistent storage\, including bare 
 metal deployments.
DTSTAMP:20260710T220006Z
LOCATION:Galerie
SUMMARY:Disk encryption using attestation for Confidential VMs - Matias Var
 a Larsen
URL:https://cfp.all-systems-go.io/all-systems-go-2026/talk/TKKLMZ/
END:VEVENT
END:VCALENDAR