zlacker

[parent] [thread] 1 comments
1. briHas+(OP)[view] [source] 2024-12-27 00:36:43
I'm also waiting for a password manager that tightly integrates with a hardware device to protect passwords individually and in-memory.

I wrote a quick PoC using certificates to encrypt a password, with the cert private key 'stored' in the TPM, with a PIN. This is pretty easy on Windows, which exposes the TPM as a special crypto provider.

replies(1): >>g_p+hb
2. g_p+hb[view] [source] 2024-12-27 03:27:58
>>briHas+(OP)
That's a pretty neat solution. I like that idea.

If you wanted to go a step further, you could use a smartcard with hardware PIN reader as a PKCS11 crypto device, and use that to decrypt the long lived keys in the store, then pass it back to the host encrypted by a platform-protected key to be decrypted and used.

If you could get the right implementation specifics together, you could likely then have the smart card simultaneously re-encrypt the credential with a key bound to PCR state of the TPM via a policy. You'd then decrypt that ciphertext on TPM without a PIN, but conditional on PCR state of a couple of PCRs that represent your system like the secure boot toggle state and allowed CAs.

That lets you be a bit more "cross device" than a fully TPM solution does, though your certificate technique works fine as long as you keep an offline backup for enrollment if anything changes on your system.

[go to top]