Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Ssh keys are much simpler than the PKI cert infrastructure. This has advantages for development, as well as bug resistance. But it means ssh expects every server behind the same hostname to use the same SSH key.

You can't get two (well functioning) TPMs to have the same key. They come with their own, un-extractable* and unchangeable keys built in.

*TPMs claim this, it is probably not impossible to extract keys just incredibly difficult and requiring specialist knowledge.



This is factually wrong. All major HSM vendors offer ways to backup and replicate keys, it's usually done using key-wrapping keys. Here's an example: https://www.ibm.com/docs/en/datapower-gateway/2018.4?topic=m...

All cloud vendors offer the same functionality, if you think about it, so it's not an obscure feature.


There is a diference between the "root" key and the keys you can load into a TPM or HSM. The former is sort of built in, but you can provision several TPM/HSMs with loadable keys and then use those for your crypto implementations - otherwise, every time a TPM/HSM broke, you'd risk data loss.

If anyone is using a Windows machine with TPM-based bitlocker encryption, you have followed the instructions at https://support.microsoft.com/en-us/windows/back-up-your-bit... I hope?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: