TLDR Tech / InfoSec
Put Your SSH Keys in Your TPM Chip! (5 minute read)
This post walks through storing SSH private keys inside a TPM chip via the tpm2-pkcs11 stack on Linux, covering token creation, importing RSA/ECC256 keys generated offline, and wiring the PKCS#11 provider into ~/.ssh/config so keys never sit as plaintext files. Some tradeoffs of TPMs vs portable HSMs like Yubikeys: TPMs are device-bound with no physical-presence requirement, consumer motherboards often wipe the TPM on BIOS updates, and historical flaws like ROCA (CVE-2017-15361) weakened RSA keys generated by Infineon TPM chips. Defenders should prefer offline-generated, password-protected keys imported into the TPM with secure backups, add users to the tss group rather than running tooling as root, and validate token contents with tpm2_ptool verify and pkcs11-tool --list-objects before decommissioning filesystem-based keys.
Read the full story