Conversation

Notices

1. Embed this notice
   Matthew Garrett (mjg59@nondeterministic.computer)'s status on Wednesday, 14-Aug-2024 14:03:47 JST Matthew Garrett

   I know it's a running joke that all my problems are solved with a TPM but today I spent a bunch of time working with coworkers trying to figure out a secure way to solve a problem and realised that TPM2_GetTime() solves it perfectly

   • GreenSkyOverMe (Monika) repeated this.
   • Embed this notice
     Matthew Garrett (mjg59@nondeterministic.computer)'s status on Wednesday, 14-Aug-2024 14:04:41 JST Matthew Garrett

     in reply to

     (you have an SSH server with a wall time that is not correlated with anything, you have a client, you have a CA that issues SSH certs. You want the server to be able to verify that the cert is fresh, but can't use validity dates because you have a different idea of time. So, server does TPm2_GetTime(), sticks the attestation in the SSH banner, client retrieves that, passes it to the CA, CA puts it in the cert, client gives the cert to the server, server knows cert was issued after that time)