0

Is it possible to use TPM for SSL Client Authentication (with a client certificate) and thereby ensure on the server/backend side knows, that the request comes from the specific client machine (even the key cannot be stolen) when I have an existing client application, that I can not modify?

Now, I know from here, that I can directly use openssl for those http requests, and I am sure that I can use some SDK to archive the same thing. But what if I have an existing application, that has its own implementation and of course needs access to the public and private key to do client authorization?

My current assumption: This, in general, means that a private key has to be generated and be accessible by the application and therefore can also be stolen (if someone has i.E. the same access as the application). And therefore it is not possible!

Is that true, or am I missing something?

1 Answer 1

3

This, in general, means that a private key has to be generated and be accessible by the application

An appropriately written application does not need to have access to the private key of the client certificate. It only must be able to get a digital signature for some given data, but it does not need to actually perform the signature process itself.

In order to protect the private key against compromise this signature can be generated outside of the application, for example in a different process or even on a protected hardware like a TPM, HSM, smartcard or Yubikey. PKCS#11 provides a standard API for keeping the actual signature process and thus also the private key outside the application.

. But what if I have an existing application, that has its own implementation and of course needs access to the public and private key to do client authorization?

Of course, if your application insists on performing the signature itself, then it cannot do without the private key. But this is a design limitation of your specific application. The design and implementation probably can be changed to make use of PKCS#11 and interface with the TPM.

2
  • Mmh, ok interesting. Do you know if curl and wget are capable of using tpm? I cannot find anything about that …
    – Nathan
    Commented Apr 12, 2023 at 19:12
  • 1
    @Nathan: Based on this curl seems to support TPM2 using the tpm2tss engine. Commented Apr 12, 2023 at 19:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .