TPM - Revision history

Xinyangli at 00:28, 6 January 2026

2026-01-06T00:28:47Z

← Older revision		Revision as of 00:28, 6 January 2026
Line 30:		Line 30:
	<syntaxhighlight>PKCS11Provider /run/current-system/sw/lib/libtpm2_pkcs11.so</syntaxhighlight>To load your ssh key into the running <code>ssh-agent</code>, use <code>ssh-add -s</code>:<syntaxhighlight lang="bash">		<syntaxhighlight>PKCS11Provider /run/current-system/sw/lib/libtpm2_pkcs11.so</syntaxhighlight>To load your ssh key into the running <code>ssh-agent</code>, use <code>ssh-add -s</code>:<syntaxhighlight lang="bash">
	ssh-add -s /run/current-system/sw/lib/libtpm2_pkcs11.so		ssh-add -s /run/current-system/sw/lib/libtpm2_pkcs11.so
	</syntaxhighlight>Note that ~~since OpenSSH 8.9~~, <code>ssh-agent</code> ~~enforces a~~ PKCS#11 ~~provider~~ whitelist. You may need to start the agent with the <code>-P</code> flag to allow the ~~NixOS~~ library paths:<syntaxhighlight lang="bash">		</syntaxhighlight>Note that by default, <code>ssh-agent</code> refuses to load PKCS#11 modules outside a whitelist of trusted paths, and <code>/nix/store</code> paths are not included in this default list. You may need to start the agent with the <code>-P</code> flag to allow the library paths:<syntaxhighlight lang="bash">
	ssh-agent -P "/run/current-system/sw/lib/,/nix/store//lib/*"		ssh-agent -P "/run/current-system/sw/lib/,/nix/store//lib/*"
	</syntaxhighlight>For a persistent setup, you can configure the system-wide agent in your <code>configuration.nix</code>: <syntaxhighlight lang="nixos">		</syntaxhighlight>For a persistent setup, you can configure the system-wide agent in your <code>configuration.nix</code>: <syntaxhighlight lang="nixos">programs.ssh = {
	programs.ssh = {
	startAgent = true;		startAgent = true;
	agentPKCS11Whitelist = "${config.security.tpm2.pkcs11.package}/lib/,/run/current-system/sw/lib/";		agentPKCS11Whitelist = "${config.security.tpm2.pkcs11.package}/lib/,/run/current-system/sw/lib/";
	};		};</syntaxhighlight>
	</syntaxhighlight>

	== Frequently Asked Questions ==		== Frequently Asked Questions ==

Xinyangli: Added instructions for loading TPM2 keys into ssh-agent

2026-01-06T00:23:43Z

Added instructions for loading TPM2 keys into ssh-agent

← Older revision		Revision as of 00:23, 6 January 2026
Line 28:		Line 28:

	To tell OpenSSH to use the TPM2 during login, you may add the following line to your <code>~/.ssh/config</code>:		To tell OpenSSH to use the TPM2 during login, you may add the following line to your <code>~/.ssh/config</code>:
	<syntaxhighlight>		<syntaxhighlight>PKCS11Provider /run/current-system/sw/lib/libtpm2_pkcs11.so</syntaxhighlight>To load your ssh key into the running <code>ssh-agent</code>, use <code>ssh-add -s</code>:<syntaxhighlight lang="bash">
	~~PKCS11Provider~~ /run/current-system/sw/lib/libtpm2_pkcs11.so		ssh-add -s /run/current-system/sw/lib/libtpm2_pkcs11.so
			</syntaxhighlight>Note that since OpenSSH 8.9, <code>ssh-agent</code> enforces a PKCS#11 provider whitelist. You may need to start the agent with the <code>-P</code> flag to allow the NixOS library paths:<syntaxhighlight lang="bash">
			ssh-agent -P "/run/current-system/sw/lib/,/nix/store//lib/*"
			</syntaxhighlight>For a persistent setup, you can configure the system-wide agent in your <code>configuration.nix</code>: <syntaxhighlight lang="nixos">
			programs.ssh = {
			startAgent = true;
			agentPKCS11Whitelist = "${config.security.tpm2.pkcs11.package}/lib/,/run/current-system/sw/lib/";
			};
	</syntaxhighlight>		</syntaxhighlight>

imported>Erdnaxe: Add other vendor

2022-09-24T15:06:23Z

Add other vendor

← Older revision		Revision as of 15:06, 24 September 2022
Line 51:		Line 51:
	nix-shell -p tpm2-tools --run "tpm2_getekcertificate" \| strings		nix-shell -p tpm2-tools --run "tpm2_getekcertificate" \| strings
	</syntaxhighlight>		</syntaxhighlight>
	Usually, you may find a vendor such as <code>STMicroelectronics</code> and a model such as <code>ST33HTPxAHB61</code>.		Usually, you may find a vendor such as <code>STMicroelectronics</code> or <code>Infineon Technologies</code> and a model such as <code>ST33HTPxAHB61</code>.

	To get firmware version information, you might want to look at:		To get firmware version information, you might want to look at:

imported>Erdnaxe: How to get model info

2022-09-24T14:21:20Z

How to get model info

@@ Line 44: / Line 44: @@
 * <code>TPM2_PT_MAX_AUTH_FAIL</code> is the maximum number of failed attempts before lockdown,
 * <code>TPM2_PT_LOCKOUT_INTERVAL</code> and <code>TPM2_PT_LOCKOUT_RECOVERY</code> are durations in seconds for recovery.
 == References ==

imported>Erdnaxe: Initial version

2022-09-24T13:17:55Z

Initial version

New page

TPM (Trusted Platform Module) is a secure microprocessor commonly embedded in modern computers. It can be used for boot chain audit, key storage and random number generation.

== NixOS configuration ==

A minimal NixOS configuration to be able to use the TPM from userspace can be:
<syntaxhighlight lang="nix">
security.tpm2.enable = true;
security.tpm2.pkcs11.enable = true; # expose /run/current-system/sw/lib/libtpm2_pkcs11.so
security.tpm2.tctiEnvironment.enable = true; # TPM2TOOLS_TCTI and TPM2_PKCS11_TCTI env variables
users.users.YOUR_USER.extraGroups = [ "tss" ]; # tss group has access to TPM devices
</syntaxhighlight>

After rebooting with this configuration, <code>TPM2TOOLS_TCTI</code> and <code>TPM2_PKCS11_TCTI</code> should point to <code>device:/dev/tpmrm0</code> and your user should be able to read and write to <code>/dev/tpmrm0</code>.

== Using a TPM2 with OpenSSH ==

For example, the following commands create a new token associated with PIN-code <code>YOUR_PIN</code> (Personal Identification Number) and a recovery SOPIN-code <code>YOUR_SOPIN</code> (Security Officer Personal Identification Number) and then a new secp256r1 key:
<syntaxhighlight lang="bash">
tpm2_ptool init
tpm2_ptool addtoken --pid=1 --label=ssh --userpin=YOUR_PIN --sopin=YOUR_SOPIN
tpm2_ptool addkey --label=ssh --userpin=YOUR_PIN --algorithm=ecc256
</syntaxhighlight>

Now you may show your public key:
<syntaxhighlight lang="bash">
ssh-keygen -D /run/current-system/sw/lib/libtpm2_pkcs11.so
</syntaxhighlight>

To tell OpenSSH to use the TPM2 during login, you may add the following line to your <code>~/.ssh/config</code>:
<syntaxhighlight>
PKCS11Provider /run/current-system/sw/lib/libtpm2_pkcs11.so
</syntaxhighlight>

== Frequently Asked Questions ==

=== How does the PIN-code bruteforce protection work? ===

You may run the following command to query the variable properties of your TPM:
<syntaxhighlight lang="bash">
nix-shell -p tpm2-tools --run "tpm2_getcap properties-variable"
</syntaxhighlight>

* <code>TPM2_PT_LOCKOUT_COUNTER</code> is the current number of failed attempts,
* <code>TPM2_PT_MAX_AUTH_FAIL</code> is the maximum number of failed attempts before lockdown,
* <code>TPM2_PT_LOCKOUT_INTERVAL</code> and <code>TPM2_PT_LOCKOUT_RECOVERY</code> are durations in seconds for recovery.

== References ==

* https://wiki.archlinux.org/title/Trusted_Platform_Module
* https://learn.microsoft.com/en-us/windows/security/information-protection/tpm/change-the-tpm-owner-password
* https://blog.ledger.com/ssh-with-tpm/