3 ms·
They're not the same. The TPM chip is really just another little computer your main computer talks to over a special network; it has no access to the rest of y
by geocar 4y ago
They're not the same.
The TPM chip is really just another little computer your main computer talks to over a special network; it has no access to the rest of your computer hardware, so when you type your pin or passphrase in, your computer needs to put it in memory and send it to your TPM chip over this special network cleartext.
The touchid interface is part of the secure enclave packaging, so the activation command (fingerprint, nearby hotdog, whatever you've trained the sensor with) isn't ever in memory.
This difference makes attacking keys stored in the secure enclave a lot harder than attacking keys stored in TPM, because with TPM, you have this second thing to attack (the cleartext channel) but with secure enclave you don't.
If you want to do this on Linux, you can get bluetooth fido2 apps for your phone which work pretty well, but bluetooth is very complicated and Linux doesn't have good support for pre-login bluetooth setup afaik, so (re)provisioning can be tricky. I like these little USB-attached smart-card readers with integrated PIN-pads (either on the reader or on the card itself) because USB seems a little bit more reliable, but you may need one that also supports bluetooth or NFC in order to use your token (easily) with mobile devices if you like to login from your phone sometimes.