►
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon North America 2021 in Los Angeles, CA from October 12-15. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Parsec: A New Platform Abstraction for Security - Hugues de Valon, Arm
Parsec is the Platform Abstraction for Security, an open-source initiative that aims to create simple, standardised, ergonomic software interfaces for interacting with hardware-backed security features on any platform in any programming language. Parsec enables key management and cryptographic services to be consumed on rich, multi-tenant platforms to protect Cloud Native deployments in a way that is agnostic with respect to the underlying hardware. This talk will give an overview of the Parsec project as well as its involvement in the Rust community making it easier to interface with HSMs, TPMs and PSA Crypto!
A
A
Similarly
than
in
the
cloud,
gh
is
a
multi-tenant
environment
where
multiple
applications
could
be
accessing
the
same
device
and
similarly,
then
in
the
cloud
you
would
want
in
the
edge
to
have
access
to
the
various
cloud
native
development
tools,
but
very
differently
from
the
cloud.
The
threat
landscape
is
totally
different.
A
A
You
could
have
trusted
platform
modules,
hardware,
security
modules
and
secure
elements,
so
there
is
a
conflict
there
between
on
one
side
having
applications
that
are
highly
secure,
that
store
their
keys
in
real
hardware
in
those
root
of
trust
modules
and
that's
also
easily
deployed,
and
on
the
other
side,
this
this,
this
big
landscape
of
different
platforms
and
different
device
and
different
hardware,
backed
security
devices,
so
so
parsec
is
made
to
to
to
to
solve
that
problems.
Parsec
provides
a
uniform
compatibility
layer
across
the
diverse
wall
of
edge.
A
Parsec
makes
the
connection
in
between
cloud
native
applications
that
are
written
in
any
programming
language
and
between
the
the
device
that
can
be
any
platform
on
any
architecture
and
working
with
any
any
any
hardware,
so
they
could
be
trusted,
but
for
modules,
hardware,
security
modules,
a
trusted,
execution,
environment
services
and
and
and
other
hardware-based
security
modules.
So
parsec
is
making
these
connections
so
that
cloud
native
development
is
possible
at
the
edge
secure
cognitive
development.
This
possibility.
A
So,
let's
see
on
a
on
a
conceptual
view:
parsec
api
is
rooted
in
platform,
security,
architecture,
psa
and
specifically,
parsec
uses
the
psa
cryptography
api,
which
is
providing
key
storage
and
a
lot
of
different
cryptography
operations
like,
for
example,
asymmetric
signing,
symmetric
signing
and
and
many
more
persec
is
a
service,
a
service
that
is
available
to
clients
in
a
rich
choice.
So
it's
a
it's
a
it's.
A
A
user
space
demon
which
is
not
accessed
through
one
specific
language,
parsec
is
as
as
develop
its
own
wire
protocol,
which
is
language
agnostic
and
on
top
of
which
client
libraries
can
be,
can
be
developed,
so
client,
libraries
in
a
lot
of
different
programming
language
that
can
that
know
how
to
communicate
with
the
ipc
protocol
in
a
convenient
way
for
for
developers.
So
that's
accessing
in
a
you
know,
in
a
rich
workload,
the
hardware
hardware-backed
security
modules
is
easy.
A
A
Knows
the
the
y
protocol
and
the
and
pass
the
request
deeper
in
the
service
so
that
access
control
is
performed
in
between
the
different
tenants
and
the
requests
are
passed
on
the
specific
providers
that
needs
to
to
respond
to
the
request
and
the
provider
is
the
backend
of
the
service.
It
is
the
the
part
where
that
knows
that
has
the
the
hardware
specific
knowledge
on
how
to
communicate
with
the
the
root
of
trust
and
on
the
left.
A
There
are
client
libraries
ergonomics
depending
on
what
is
the
the
the
use
case.
So
there
is
different
layers:
the
first
layer,
the
client
library
core,
is
for
sophisticated
use
case
with
granular
control
and
that's
the
layer
where
all
operations
with
all
parameters
are
available.
So
that's
the
most
complicated
layer
because
one
developer
will
have
to
to
set
the
specific
parameters
for
for
each
call.
A
What's
the
the
client
library
call
looks
like
for
the
for
the
followers
clients
well,
multi-tenancy
is
an
imp
is
a
obviously
important
part
part
of
this.
So
cloud
native
workload,
delivery
at
the
edge
is
expected
to
be
multitenant.
Multiple
applications
will
share
access
to
the
secure
hardware
on
the
platform.
A
A
But
of
course
parsec
needs
to
trust
that
identity
and
needs
to
verifies
it
so
that
the
authenticity
of
of
each
of
those
identity
identities
is
respected.
So
there
needs
to
be
a
trust
relationship
in
between
parsec
and
the
identity
provider,
for
example,
when
one
identity
provider
that
we
currently
have
in
pasek
is
using
unix
user
id.
A
A
A
So
each
of
those
are
our
ways
for
for
your,
your
your
workloads
to
to
access
the
perfect
service,
and,
let's
see,
let's
see
how
an
actual
example
of
of
the
of
the
resclient
library
looks
like.
So,
as
I
told
before,
this
is
the
this
is
the
the
the
core
library
level,
so
so
the
layer
where
all
the
parameters
are
to
be
defined
by
the
column,
so
not
the
easiest
layer,
but
still,
as
you
can
see,
all
this
code,
which
is
like
around
25
lines,
is
enough
to
to
instantiate
a
pass.
A
A
So
if
you,
if
you
focus
on
the
four
last
lines
we
we
actually
do
perform
the
actual
calls
where
we
create
basic
basic
clients,
which
is
the
the
name
of
the
rest
client.
We
generate
a
key
pair
and
that
is
using
the
psc
crypto
as
as
as
an
api,
as
I
told
before.
So
when
generating
a
keypair.
You
have
to
give
key
attributes,
and
in
that
case
we
say
that
the
key
that
we
are
going
to
generate
is
a
ecc
keeper.
A
We
give
it
it's
curve,
family
and
the
specific
curve
that
it's
going
to
use
and
also
we
give
a
policy
where
we
say
that,
with
this
key
you
you
will
only
be
allowed
to
to
sign
ash
and
nothing
else.
So
you
can't
export
it,
for
example,
and
you
can
only
use
an
algorithm
that
we
that
we
specify
and
in
this
case
is
ecgsa
with
shadow56
and
then
on
on
the
on
the
other
line.
We
we
assign
a
small
text
to
it
and
this
specific
algorithm
and
then
we
export
the
the
public
key.
A
A
So
this
code,
these
few
lines
of
code
anywhere
they
are,
they
are
deployed,
they
will
work
and
they
will
work
on
the
default
provider
and
the
default
authenticator.
That
parsec
is
working
with.
So
if
parsec
is
deployed
with
a
tpm
those
this
will
work
with
a
tpm
and
if
parsec
is
working
with
hsm,
this
will
work
with
an
hsn.
But
this
code
does
not
have
to
change
and
that's
the
big
value
proposition
of
barcelona.
A
A
Of
course
it's
if,
if
parsec
is,
is
deployed
on
a
system
where
there
is
both
a
tpm,
an
hsm
and
a
trusted
service,
it's
possible
to
choose
like
in
the
in
the
code,
the
specific
one
that
you
want,
but
by
default
and
using
the
simple
commands
it
will
use
the
the
default
one,
which
is
often
the
only
one
that
that
barcode
is
deployed
with
so
yeah.
That
was
it
for
the
for
the
passive
part
of
the
presentation.
I
also
wanted
to
to
present.
A
A
So,
as
I,
as
I
told
before,
parsec
is
a
heavily
relies
on
the
different
route
of
trust
so
on
the
different
hardware
back
security
modules
and
that
we
that
we
use,
and
instead
of
developing
the
code
inside
the
inside
the
the
the
code
source,
we
decided
to
to
publish
independent
crates
for
for
each
of
them.
So,
for
example,
for
the
tpm,
we
have
a
tss,
yes,
api
crate,
which
is,
which
is
a
wrapper
around
the
enhanced
system,
api
to
communicate
with
gpms
for
hsm.
A
We
have
the
crypto
key
crate,
which
is
wrapped
around
the
pkcs11
api
and
for
the
trusted
service
provider.
We
have
the
and
that's
used
in
parsec
as
well.
We
have
the
psa
cryptocrate
a
wrap
around
the
ps4
cryptoc
api
and
all
of
those
crates
are
rebuilt
in
a
similar
way
because
they
are,
as
as
in
they're,
all
safe
abstraction
oversee
apis.
A
So
they
are
really
using
rust,
ejumps
and
rusty
geometric
codes
to
make
sure
that
that
what
is
exported
in
rust
is
always
safe,
memory,
safe
and
straight
safe,
so
that
they
are
actually
really
nice
to
use,
and
even
for
someone
that
has
no
no
interest
at
all
in
person
just
wants
to
use
a
tpm
hsn
interest.
Those
are
really
nice
to
do
so,
and
yeah
many
people
are
using
them
yeah
totally
independently
for
fanbase.
So
so
that's
that's.
A
That's
really
great
to
to
see
to
see
engagement
from
the
community
just
for
for
those
specific
parts
so
other
than
the
crate
that
we
that
we
that
we
ship
we
also
contributed
to
to
other
rust
projects.
So
for
bioengine,
for
example,
we
we
added
a
support
for
dynamic
loading
in
biogen
itself,
so
using
the
lib
loading
crate,
so
that
binding
is
capable
of
generating
a
structure
which
creates
a
lib
loading
context.
A
So
that's,
for
example,
you
can
see
here
and
that's
what
we
use
in
the
crypto
key
syscrate
is
that
it
generates
this
pkcs11
structure
in
this
specific
case,
because
it's
been
given
the
pkcs11
ca
api
header
file
and
so
that
at
runtime
we
just
have
to
give
him
the
the
path
of
the
dynamic
library
and
it
will
automatically
create
the
leap
loading
structure.
So
that's
really
useful
for
for
rest,
abstraction
of
the
other
api
and
libraries
that
are
meant
to
be
to
be
loaded
at
some
time.
A
That
is
on
the
other
side
of
the
of
the
of
the
socket,
and
that's
mainly
what
we
use
in
the
in
the
bar
second
indicator,
to
make
sure
to
to
check
that
the
uid
match
the
client,
that
is,
that
is
calling
basic
and
also
we
added
a
basic
svid
token
api
support
in
in
russ
bifi.
And
that's
what
we're
using
our
specific
authenticator.