eBPF CipherTrace (Boilerplate)

eBPF-CipherTrace is an eBPF-based cryptographic observability agent. It intercepts cryptographic handshakes at the uprobe level (OpenSSL, Go, Java) to generate a high-fidelity Cryptographic Bill of Materials (CBOM).

For a detailed deep dive, read the blog post: eBPF CipherTrace: Cryptographic Visibility for the Quantum Era

Architecture

Structure

• cmd/agent/: Main agent entry point.
• bpf/: eBPF C source code.
• pkg/ebpf/: BPF loader and management.
• pkg/uprobes/: Logic for attaching uprobes to cryptographic libraries.
• pkg/cbom/: CBOM data models and generation.
• pkg/metadata/: Metadata enrichment (Kubernetes/Docker context).

Prerequisites

• Linux Kernel 5.4+ (with BTF support)
• Go 1.22+
• Clang/LLVM (for BPF compilation)
• libbpf headers

Building

1. Generate BPF artifacts (Requires bpf2go):

   # This is a placeholder command
   # go generate ./...

2. Build Agent:

   go build -o ebpf-ciphertrace ./cmd/agent

Running

1. Start the Agent

sudo ./ebpf-ciphertrace

2. Run Test Clients

You can test the tracing against different clients included in this repository.

Go Client (Crypto/TLS)

This client uses the Go standard library (not OpenSSL) and prioritizes Kyber (Quantum-Safe) key exchange.

cd go-crypto-tls-client
go run main.go

Java Client

This client uses the JVM's SSL stack.

cd java-https-client
javac HttpsPing.java
java HttpsPing

Curl

curl https://google.com

Results Output

The agent successfully traces the TLS Handshake and identifies the negotiated Cipher Suite. It also uses heuristics to detect Post-Quantum (PQC) Key Exchanges based on the handshake size.

Disclaimer

This is a boilerplate implementation. The BPF C code is a skeleton, and the Go loader requires generated artifacts from bpf2go.