simple-tpm-pk11

Simple PKCS11 provider for TPM chips

Explore on GitHub Read Hacker News discussions

4Distinct people

4Mentions

0Explicit recommenders

257GitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

Simple PKCS11 provider for TPM chips

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year4 dated mentions

Observed mentions: 2016-04-15 17:41:58 UTC to 2021-05-16 18:59:54 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Comments
2016	2016-01-01 00:00:00 UTC	2017-01-01 00:00:00 UTC	1	1
2017	2017-01-01 00:00:00 UTC	2018-01-01 00:00:00 UTC	1	1
2018	2018-01-01 00:00:00 UTC	2019-01-01 00:00:00 UTC	0	0
2019	2019-01-01 00:00:00 UTC	2020-01-01 00:00:00 UTC	1	1
2020	2020-01-01 00:00:00 UTC	2021-01-01 00:00:00 UTC	0	0
2021	2021-01-01 00:00:00 UTC	2022-01-01 00:00:00 UTC	1	1

What Hacker News says

4 sources

thomashabets2·May 16, 2021

A curious question. Aside from my day job, this seems like a thing I do all day. :-) I'm not sure what the motivation for your question is. Do you feel like everything's been invented and built already, and it's just a matter of (at most) plugging the things together? I find myself constantly thinking "this should exist". I don't have time to make them all exist. https://github.com/ThomasHabets/arping Nothing like it existed at the time, and I wanted to send ARP requests as easily as sending ICMP ping. https://github.com/ThomasHabets/simple-tpm-pk11 I wanted to use a TPM chip for SSH client keys, and couldn't find anything like it. https://github.com/ThomasHabets/tlssh I wanted to explore what it would be like to have SSH, but with identities not based on providing username, but an x509 cert. (and TPM chip protecting the key) Also became

Read the rest

a fun learning experience about terminals. https://github.com/ThomasHabets/cmdg I wanted to use GMail from a fast cli that used the native gmail API. https://github.com/ThomasHabets/rslurp I wanted to download concurrently and according to patterns. Ok, so honestly this one probably exists somewhere in a form that I would like, but I couldn't find it. https://github.com/ThomasHabets/sim I wanted multi-party authorization for sudo, and couldn't find one. https://github.com/ThomasHabets/monotonic_clock People kept using gettimeofday, so this is part of my compaign against it. (see https://blog.habets.se/2010/09/gettimeofday-should-never-be-...) https://github.com/ThomasHabets/gtping I worked in mobile core networks, and wanted a "ping" that used the GTP protocol since that won't be firewalled. https://github.com/ThomasHabets/ind I wanted my bash scripts to have automatic indentation, while not sacrificing buffering latency and such. https://github.com/ThomasHabets/tlscheck I wanted a simple tool to audit my TLS certificates for expiry. https://github.com/google/huproxy I was travelling to China on vacation and wanted a VPN out that would be unlikely to be blocked by the great firewall. Ok, so there are many VPN-like tools for getting through the GFW. Maybe it was just an excuse for me to write it. Honestly ssh -D would have likely worked just fine. It's being used by the keymaster project now though, so maybe it did something right: https://github.com/Cloud-Foundations/keymaster/blob/master/d... https://github.com/google/tcpauth I wanted to lock down SSH to anyone who doesn't have a secret key (and portknocking is usually ridiculous). Why not use TCP MD5 for it? https://github.com/google/tcpauth (MD5 is actually safe to use in this mode. It's not broken for all use cases) No firewall needed, and the TCP port is simply not open for anyone without the key. That's what I can think of right now, after filtering the less interesting ones.

In Ask HN: What are some tools / libraries you built yourself?

nickray·Apr 3, 2019

As I'm currently working on possible options to expose on-device keys and cryptography for our open source FIDO2 key (SoloKeys) beyond the FIDO use case, I'd be curious about opinions on just exposing and using the PKCS#11 API (Cryptoki) [0] directly. Envisioned setup would entail: download (custom) `libsolo-pk11.so`, generate RSA or ECDSA key on the USB key, get public key via `ssh-keygen -D libsolo-pk11.so`, use via `ssh -I libsolo-pk11.so user@example.com`. The equivalent thing can be done for TPMs with simple-tpm-pk11 [1] today. Technically, I'd extend the FIDO2 CTAPHID transport with "vendor commands" [2] mapping the basic Cryptoki API, and call that from the custom PKCS#11 shared library, which is then just a simple shim/wrapper. No additional drivers needed (everyone has HID). Issues I can foresee: Users too attached to GPG workflo

Read the rest

w. Installation of custom shared library. No SSH support (via PKCS#11) for Ed25519 yet. SSH support for ECDSA only in about-to-be-released OpenSSH 8.0. Vanilla PuTTY on Windows has no PKCS#11 support. Bad rap of PKCS#11 due to existing vendors adding proprietary and closed source extensions. And the fact that SSH (currently) presents all keys to the host - I'd really like to be able to specify which key to use. Personally, I'm a bit allergic to the GPG/PCSC/PIV/CCID way of doing things... My itch-to-scratch is just having a few keys off my computers (in particular, portable), and perform (infrequent) signatures on the separate device. And do this via a (comparatively) sane, open standard. [0] http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs1... [1] https://github.com/ThomasHabets/simple-tpm-pk11 [2] https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-cl...

In Using a Yubikey as smartcard for SSH public key authentication

floatboth·Dec 5, 2017

For TPMs on non-Apple computers: https://github.com/ThomasHabets/simple-tpm-pk11 But with TPM there's no external unlock mechanism like Touch ID, the TPM unlock happens from the operating system.

In Show HN: SeKey: An SSH Agent for OS X, Using Secure Enclave and TouchID, in Rust

jimmies·Apr 15, 2016

I have a Dell Chromebook 13. Basically it is a Macbook Pro that happens to run Linux really well. I have used Thinkpads X (200, 201, 220) in the past, then switched to Chromebook C720, then this. After you install John Lewis' ROM (basically a Coreboot build), it is an absolute dream, and everything worked out of the box, wifi, bt, 3d acceleration, suspend/resume, audio jack detection, you name it. Trackpad is really smooth, 1080p resolution IPS, the battery lasts 10 hours, never gets hot, fancy back-lit keyboard, has 8 philips screws in total to take it apart. Hell, it even has a TPM module so I can do those fancy ssh password-less logins (https://github.com/ThomasHabets/simple-tpm-pk11). If you really like the clit mouse, then this machine wouldn't cut it though. The speaker is kinda iffy and doesnt sound very nice, but nowhere bad. It i

Read the rest

s also only 500USD, so that's another factor. Pic: http://imgur.com/FRynGSw

In Ask HN: Best linux laptop right now?