last day (16 days later) » 

20:17
2
A: how to securely give access to the container to use private key stored in TPM

VonC the container that needs to establish the cert needs to access the private key securely. Does it, though? The all idea of a TPM (Trusted Platform Module) is to provide hardware-level security for cryptographic keys. That means, by design, TPM makes sure private keys are never exposed outside th...

Right, i meant only to securely access for TLS connections, not direct access to private key. So with the above setup can the container perform TLS connections using a private key in the TPM, do you have an example for reference?
@appcoder I have edited the answer to include a more detailed example.
Thank you for the detailed answer. The proxy approach would work for most, the one which would be challenging is when using a thirdparty sdk(.net core) that does the TLS connection(with AMQP) and not sure if it supports with the TPM configuration. will try this out. And the proxy container, does it need elevated privileges with TPM ?
@appcoder Sorry for the delay. I have updated the answer to address your last comment.
so I created the CSR request using github.com/tpm2-software/tpm2-openssl/tree/master tpm2-openssl as there was a readily available package to install instead of building from source. I used the below command to generate csr openssl req -new -newkey rsa:2048 -out testcert.csr -subj "/C=US/ST=NJ/L=Test/O=c/OU=etes/CN=testcert" -provider tpm2 and was able to sign the CSR. but not sure how to reference the private key name with this.
20:17
@appcoder OK. I have edited the answer to address your comment.
Thanks @VonC again for your detailed info. I think I will have to change the way i generate cert to use the tpm2-tools way with the handle. if I create with the handle, is it possible to configure in nginx similar to what you have shown ?http { server { listen 443 ssl; server_name mysite.com; ssl_certificate /etc/ssl/certs/mycert.pem; # Your SSL Certificate ssl_certificate_key "engine:tpm2tss:mykey.tpm"; # Key reference in TPM # Additional configuration } }
@appcoder Yes, it should be possible: I have edited the answer to include the configuration process.
so it looks like to reference the handle, we have to use tpm2tss engine ? even though we use the tpm2-tools to create the key handle, we cannot specify without tpm2tss engine ?
@appcoder Yes, that is correct. While tpm2-tools are used for creating and managing keys within the TPM (including creating key handles and making them persistent), you need to use the tpm2-tss-engine to interface with these TPM-stored keys via OpenSSL, especially in applications like Nginx that use OpenSSL for cryptographic operations. Is that an issue?
Its not a problem as such, was building the OS image as a container and having the tpm2-tss wasnt a straight forward package. so was making sure that im not doing an easier option. Really appreciate your vast knowledge on this as there is very little information out there - if you really want to not have the private key leave the TPM and use it with a container securely.
so finally got to having the setup to build this and got the private key created in tpm with handle. But when using the command openssl req -new -key "engine:tpm2tss:0x81010002" -keyform engine -out mycsr.csr -subj "/CN=mysite.com" - getting an error saying No engine specified for loading private key. No filename or uri specified for loading private key
Update: actually i modified to pass the tpm2tss engine and it worked but asks for a prompt to enter password and it worked with empty - openssl req -new -engine tpm2tss -key "0x81010002" -keyform engine -out testcsr.csr -subj "/CN=testcsr" Engine "tpm2tss" set. Enter password for user key:
20:17
@appcoder OK, I have edited the answer to include some troubleshooting steps. (before seeing your last comment)
@appcoder OK, I have completed the answer to address the password issue.
Thanks @VonC, this helps and since im doing the scripting way we will address the pwd. Currently im deleting the key.priv post loading and evictcontrol, but is there a way to have the private key outside of tpm at all ?
@appcoder I have edited the answer to address your last comment/question, about private key outside of tpm.
i didnt realize chat was an option :) stackoverflow recommended
I think i can exclude the -r option when creating the key so that it doesnt leave.. I used the example and it had -r -r, --private=FILE:

The output file which contains the sensitive portion of the object, optional. protection details
21:15
@appcoder That is correct: when using `tpm2-tools` to create a key, the `-r` option is used to output the private portion of the key to a file. However, if your goal is to make sure the private key remains within the TPM and is never exposed outside of its secure environment, you should indeed omit this option. That approach aligns with best practices for maintaining the security integrity of keys managed by the TPM.

When you run the `tpm2_create` command and you do not specify the `-r` option, the TPM will handle the private key internally, and it will not be saved to any external file. T
thank you, exactly thats what i modified the commands to. since i already created the persistent handle the evict fails for the new context. i tried to clear the tpm but its in DA lockout and doesnt allow me
22:07
@appcoder You are dealing with a couple of common issues related to TPM management: handle collisions where a persistent handle is already in use, and the TPM being in a Dictionary Attack (DA) lockout state. Let's address both issues:

When a persistent handle is already in use, attempting to assign another key to the same handle will indeed fail. The best practice is to manage your handles carefully, making sure that you either:
- use unique handles for different keys, or
- clear the existing handle before reassigning it to a new key, provided that the original key is no longer needed.
@appcoder
The DA lockout occurs when too many incorrect authorization attempts have been made. The TPM enters a lockout state to prevent a dictionary attack, where an attacker attempts to guess the authorization values.

To resolve a DA lockout, you have a few options:

1. **Wait it Out**: If the TPM has a lockout recovery period set, you might simply need to wait until this period expires. The duration depends on the TPM's configuration.

2. **Reset the Lockout**: If you have administrative or physical presence access, you can reset the lockout. That often requires using the TPM owner pass

  last day (16 days later) »