I understand that Intel TXT provides a Dynamic Root of Trust Measurement (DRTM). Does the Linux integrity measurement architecture do logically similar things? If not, what are the differences?


No, they are complementary.

DRTM provides a Root of Trust on which you can build applications/use-cases such as Integrity measurement of your entire linux system (IMA). However, it is not part of it.

I think the simplest way to explain this is with the following:

  • IMA needs the kernel to evaluate the integrity of the system (e.g. userland);
  • DRTM (or SRTM for this matter) can validate the integrity of the kernel itself. See tboot.

I suggest reading this to have a feel for it - the "Value Proposition for Linux" more precisely.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.