3 ms·

Store SSH keys inside the TPM: SSH-tpm-agent

• pipo234 3y ago
  Nice! Finally, a legit use case for TPMs. That is: a use case where the "genuine advantage" presented to the end user isn't simply * (remotely controlled) access restrictions on content (DRM), or * marginal OS integrity when the device were to fall into the wrong hands (secure boot).
  • Foxboron 3y ago
    There are multiple legit use cases for TPMs, ssh-tpm-agent is neither the first nor the last. Simple key storage and signing is the base useage for these things, people just focus on the "wrong" aspects of this.
• ggm 3y ago
  I'm going to show my security ignorance by asking two questions 1) is there a simple key destroy function? 2) if somebody gains remote login access to the host with root, noting they can't exfiltrate the keys, can they subvert process chains to claim linkage to the ssh-agent process? I do like this. I am very tempted. I would like a keypair which tied strongly to me, on this specific laptop.
  • Foxboron 3y ago
    > 1) is there a simple key destroy function? Just rm the key file. TPM sealed secrets are never actually stored inside the TPM, they are just files with strong encrypted that only the TPM can decrypt. So deleting the key file removes your ability to recreate the key. > 2) if somebody gains remote login access to the host with root, noting they can't exfiltrate the keys, can they subvert process chains to claim linkage to the ssh-agent process? Possibly, yes.