3 ms·
For U2F, there are two issues. First, communication doesn't use a smart card protocol, it uses a custom protocol over USB/HID. So to implement U2F using the TPM
by scott00 9y ago
For U2F, there are two issues. First, communication doesn't use a smart card protocol, it uses a custom protocol over USB/HID. So to implement U2F using the TPM you would need to write a virtual USB device driver, which is a pain. Github wrote one for Mac, but there's nothing for Linux or Windows to my knowledge. Second, U2F calls for a physical presence check. With most existing hardware, there's no way for the TPM to verify physical presence, so it has to be done in the client software, which reduces the point somewhat. Newer hardware may address the second point, as I've seen some new laptops with TPMs hooked up to the fingerprint reader.
For other smartcard-y things: a lot of stuff gets called a "smart card", but any given application is going to involve a particular applet on a smartcard, and a particular client side implementation to use it. The Windows virtual smart card implements a PIV applet, I believe, whereas most of the Yubico stuff works using either non-standard applets or a PGP smartcard applet. So the client side would not be compatible with the Windows virtual smartcard.