Windows SSH client with TPM
I managed to get an SSH client working using an SSH pubkey protected by a TPM.
This is another post in my series in playing with TPM chips:
Optional: Take ownership of the TPM chip
This is not needed, since TPM operations only need well known SRK PIN, not owner PIN, to do useful stuff. I only document it here in case you want to do it. Microsoft recommends against it.
Set
OSManagedAuthLevelto 4HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\TPM\OSManagedAuthLevel2 -> 4Reboot.
Clear TPM
Run
tpm.mscand choose “Clear TPM”. The machine will reboot and ask you to press F12 or something for physical proof of presence to clear it.Set owner password from within
tpm.msc
Set up TPM for SSH
Create key
PIN must be at least 8 characters.C:\> tpmvscmgr.exe create /name “myhostnamehere VSC” /pin prompt /adminkey random /generate
Create CSR
Create a new text file
req.inf:[NewRequest] Subject = “CN=myhostnamehere” Keylength = 2048 Exportable = FALSE UserProtected = TRUE MachineKeySet = FALSE ProviderName = “Microsoft Base Smart Card Crypto Provider” ProviderType = 1 RequestType = PKCS10 KeyUsage = 0x80
C:\> certreq -new -f req.inf Continue reading
It's revenues have to keep doubling though to make the numbers work.
