3 ms·
I made a FIDO token (a platform authenticator) implementation that uses the TPM to protect your private keys on Linux: https://github.com/psanford/tpm-fido http
by psanford 5y ago
I made a FIDO token (a platform authenticator) implementation that uses the TPM to protect your private keys on Linux: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido
- apostacy 5y agoThat's really cool. Is it possible to use it without a hardware TPM, for testing? I have used rust-u2f in the past for that purpose.
- psanford 5y agoYup, there's a flag `-backend memory` that generates ephemeral keys in memory.
- lrvick 5y agoAs I understand this, if malware is on the machine it can do unlimited WebAuthn validations in the background without user interaction. Anchoring to physical human interaction with a button or biometric sensor is a huge security property I don't think current gen TPMs can solve for. In a typical implementation someone must be present at the machine expecting a tap, and tapping. That said, overall this is a clever best effort for when a TPM is all a user has and you at least want to prove a given machine is involved in with.
- UncleMeat 5y agoIf malware is on the machine you are basically screwed anyway. A threat model where you happen to never authenticate with a service while you have the malware installed is not especially compelling.