5 ms·
> We're just now starting to see consumer hardware come with HSM's built in. I'm not very familiar with how TPMs work but don't they already give you this? TPM
by iancarroll 9y ago
> We're just now starting to see consumer hardware come with HSM's built in.
I'm not very familiar with how TPMs work but don't they already give you this? TPMs are on most computers already, except for Apple-branded ones.
- hdhzy 9y agoTPMs are more complex. They can be used as a virtual smart card. TPM can be used to store client certificate used in HTTPS. U2F on the other hand is super simple by design. For example Yubikey uses one symmetric secret to generate P-256 keys deterministically. That means they don't need to store actual asymmetric keys, they can derive them from secret on demand.
- jimktrains2 9y agoWhat does it use to generate the key? The secret and the URL/realm? I guess it's implicit that you won't ever need to regenerate one key without regenerating others?
- hdhzy 9y agoOrigin is used to create "key handle" that is given to the service and need to be used during login. See Yubico documentation for details: https://developers.yubico.com/U2F/Protocol_details/Key_generation.html https://developers.yubico.com/U2F/Protocol_details/Key_gener...