HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
Foxboron
ssh-tpm-agent
Go2023–2026
Foxboron / ssh-tpm-agent

ssh-tpm-agent

:computer: :key: ssh-agent for TPMs

Security & PrivacyNetworking
Explore on GitHubRead Hacker News discussions
5Distinct people
12Mentions
1Explicit recommenders
794GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

:computer: :key: ssh-agent for TPMs

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

https://github.com/Foxboron/ssh-tpm-agent works well for me

agartner used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:03:16 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year12 dated mentions

Observed mentions: 2023-07-29 13:28:50 UTC to 2026-08-01 14:19:55 UTC.

012342023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments20232024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments20242025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 4 mentions; 2 submissions, 2 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC211
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC303
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC303
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC422

What Hacker News says

12 sources
Foxboron·Jun 10, 2024
> Hi Fox, i'm not aware of any other usages on the platform i'm familiar with sorry, maybe a gap in my understanding. The TPM as a device is completely democratized and accessible by the normal user. You can use it for platform attestation (which is this post is trying to point out might be broken in some cases), but it also works as a "discount" smartcard where you can seal data and shield keys. Two examples here which I have written: A file encryption utility for `age` that shields the keys in the TPM. https://github.com/Foxboron/age-plugin-tpm `ssh-tpm-agent` is an `ssh-agent` implementation that enables you to create TPM shielded keys and does signing operation on the TPM. https://github.com/Foxboron/ssh-tpm-agent Conceptually both of these tools can also use PCR policy sealing as a form of platform attestation, but I have not impleme
Read the rest
nted that yet as it's a bit hard to do this in a user friendly way UX wise. As noted by others, you can also do disk encryption. `systemd-cryptsetup` does this on Linux. https://www.freedesktop.org/software/systemd/man/latest/syst... > Afaik, if you want access to a chip like TPM, the OS will need to cooperate as such I/O access or MMIO or however it's accessed, will be privileged instructions likely. Not really? `/dev/tpmrm0` is a TPM resource manager for Linux that is accessible by being part of the `tss` group. > I'd find it somewhat logical an OS or loader component starts verification, and then components upwards in the chain are well, chained together via verification, taking away the need to access the TPM after the initial modules are verified. This is only one of several use-cases of a TPM :) This is also orthogonal of whether or not Secure Boot is part of the chain, depending on the operating system.
In TPM GPIO fail: How bad OEM firmware ruins Intel TPM security
Foxboron·Jun 6, 2024
> For us, the benefits of TPMs and measured boot for personal use are a lot more obscure. You'll sometimes hear people claim it protects against 'evil maid attacks' where an attacker repeatedly gets physical access to your laptop. The truth is it provides no such protection. TPMs give you fine and adequate protections in many scenarios, even physical ones. They also provide you with better protection for private key material. I'll even give you an example: https://github.com/Foxboron.keys The last key is a TPM key from my `ssh-tpm-agent` project: https://github.com/Foxboron/ssh-tpm-agent Here is the private key: https://paste.xinu.at/9fc2YJQuUCbg1Sa/ I don't remember if the key has a PIN (it was for a presentation/demonstration), but if it has it's like 4 digits long.
In TPM GPIO fail: How bad OEM firmware ruins Intel TPM security

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.