4 ms·
If people are going to leave the USB device in all the time, why not just use the onboard TPM the machine probably already has? At least on Windows, the TPM can
by MichaelGG 9y ago
If people are going to leave the USB device in all the time, why not just use the onboard TPM the machine probably already has? At least on Windows, the TPM can create a virtual smart card so existing infrastructure can just use that as normal.
Then you get keys protected by hardware. Though the TPMs might commonly be easier to physically hack than good USB devices.
- scott00 9y agoFor U2F, there are two issues. First, communication doesn't use a smart card protocol, it uses a custom protocol over USB/HID. So to implement U2F using the TPM you would need to write a virtual USB device driver, which is a pain. Github wrote one for Mac, but there's nothing for Linux or Windows to my knowledge. Second, U2F calls for a physical presence check. With most existing hardware, there's no way for the TPM to verify physical presence, so it has to be done in the client software, which reduces the point somewhat. Newer hardware may address the second point, as I've seen some new laptops with TPMs hooked up to the fingerprint reader. For other smartcard-y things: a lot of stuff gets called a "smart card", but any given application is going to involve a particular applet on a smartcard, and a particular client side implementation to use it. The Windows virtual smart card implements a PIV applet, I believe, whereas most of the Yubico stuff works using either non-standard applets or a PGP smartcard applet. So the client side would not be compatible with the Windows virtual smartcard.