tpm-fido

https://news.ycombinator.com/item?id=33311523 : > [WebAuthn, TPM, U2F/FIDO2, Seahorse,] > tpm-fido: https://github.com/psanford/tpm-fido : >> tpm-fido is FIDO token implementation for Linux that protects the token keys by using your system's TPM. tpm-fido uses Linux's uhid facility to emulate a USB HID device so that it is properly detected by browsers. TPM > TPM software libraries: https://en.wikipedia.org/wiki/Trusted_Platform_Module#TPM_so... TPM > Virtualization; virtual TPM devices: https://en.wikipedia.org/wiki/Trusted_Platform_Module#Virtua... WebAuthn: https://en.wikipedia.org/wiki/WebAuthn

For those of us wanting non-big-tech implementations of WebAuthn/passkeys, there are options for storing passkeys in software, and for storing passkeys in TPMs. https://github.com/bulwarkid/virtual-fido/ https://github.com/keepassxreboot/keepassxc/pull/8825 https://github.com/psanford/tpm-fido https://git.kernel.org/pub/scm/linux/kernel/git/jejb/fido2-c...

There was a kinda-free option (as in you had to have an iPhone, but the app itself was free). Krypt.co had this based on the iphone's secure enclave. It was bought by Akamai, and it's not clear what state it's in. https://krypt.co/ I think there was also an implementation for mac os based on the t1/t2 chip, but since I've never had such a mac, I've never looked properly into that. But that probably means that you could roll your own. A quick google search yields this for Linux with a TPM: https://github.com/psanford/tpm-fido

Regarding the statements that you need a Yubikey (for the FIDO part of passkey, given application support?) on GNU/Linux, at least Solo 2, Nitrokey 3, and Onlykey hardware keys have free firmware. I can't vouch for them, but maybe also see https://github.com/psanford/tpm-fido and https://github.com/bulwarkid/virtual-fido

Another one for completeness: https://github.com/psanford/tpm-fido

Fido keys work just fine on linux. There's already a fido authenticator that protects your keys using the system's TPM[0]. [0]: https://github.com/psanford/tpm-fido

No you do not need to use anything proprietary to use WebAuthn. There are open source software[0] and hardware keys[1]. [0]: https://github.com/psanford/tpm-fido [1]: https://solokeys.com/

I also found this: https://github.com/psanford/tpm-fido FIDO2 should be used more, hopefully more sites end up supporting it sooner rather than later.

WebAuthN: https://en.wikipedia.org/wiki/WebAuthn FIDO2: https://en.wikipedia.org/wiki/FIDO2_Project Arch/WebAuthN: https://wiki.archlinux.org/title/WebAuthn U2F/FIDO2: https://wiki.archlinux.org/title/Universal_2nd_Factor TPM: https://wiki.archlinux.org/title/Trusted_Platform_Module#Oth... Seahorse: https://en.wikipedia.org/wiki/Seahorse_(software) GNOME Keyring: https://en.wikipedia.org/wiki/GNOME_Keyring tpmfido: https://github.com/psanford/tpm-fido "PEP 543 – A Unified TLS API for Python" (withdrawn*) https://peps.python.org/pep-0543/#interfaces > Specifying which trust database should be used to validate certificates presented by a remote peer. certifi-system-store https://github.com/tiran/certifi-system-store/blob/main/src/... truststore/_openssl.py: https://github.com/sethmlarson/truststore/blob/main/src/trus... "Help us test sys

Nice! I'm the author of tpm-fido[1] which is similar to this but with some different goals. It looks like you've implemented ctap2, which has been on my todo list for tpm-fido (we currently use the ctap1 which works fine but doesn't support newer features used for passkeys/passwordless logins). Great to see other independent implementations! The question is often asked: isn't this less secure than a physical key or touch-id? The answer is yes, but only marginally. If you have no other access to a FIDO authenticator, using a soft authenticator will still be much better than using SMS,TOTP, or Push. Phishing is the most likely way 2fa will fail you, and this is still phishing resistant. But passkeys are real and you can essentially use them today! The Android/Chrome integration is already quite good. The Chrome/iOS interaction works but is

It does, but there's actually a way to do this (ie. u2f without having to buy another device) in a safe way, by using the TPM available on most computers: https://github.com/psanford/tpm-fido

If you have a Linux PC with a TPM, you can use https://github.com/psanford/tpm-fido to create and "plug in" a virtual USB WebAuthn key whose secret is irretrievably stored in the machine's TPM. This effectively asserts that your specific machine is being used to enter a given site. However, it's important to remember it doesn't necessarily verify that *you're* present, or even if *anyone* is present at all, since the presence check is done via a software dialog and can be pwned along with the rest of the system.

> the power to make unphishable systems is being arbitrarily tied to hardware keys and secure enclaves Its not though. First of all, windows, android, macos and ios all support being used as platform authenticators. No need to use an external hardware key to get the benefit. This is what most people should use (really most people should use passkeys tied to your phone once those become widely available). I don't really understand your complaint that those implementations are tied to secure enclaves and TPMs. Every laptop issued by your company already has one of these in them. Why not use them? I get that there's a fear that TPMs somehow enable DRM. Given that TPMs have been around for 20 years and haven't been used for DRM applications I think thats a bit overblown. But even if you do believe that, I don't see how you can conclude that

FIDO usb devices just use the HID protocol so they work fine on linux. Chrome and Firefox both support them. I wrote a FIDO implementation that protects the signing key using the system's TPM specifically for linux: https://github.com/psanford/tpm-fido There is no reason why you couldn't implement a similar syncing strategy in a tool like this if you wanted to.

There is a huge number of other vendors supporting Webauthn apart from Yubikey. (From the top of my head Nitrokey, Solo, Tomu, Mooltipass, Ledger, Trezor, Google Titan, OnlyKey, Token2). You could also use the system TPM (https://github.com/psanford/tpm-fido). A brief search didn't yield any FIDO2 software-only solutions for Linux, but I see no reason why in principle you couldn't implement it (perhaps interfacing https://github.com/google/OpenSK through hidg - similar projects do exist for U2F).