• meteokr@community.adiquaints.moe
    link
    fedilink
    arrow-up
    3
    ·
    1 year ago

    When you use your “one password” you’re in effect giving your device permission to access the key storage in your TPM to fetch the private key to present it to the site.

    Very small correction as I understand, but your private key is never presented. The web service should never interact with the private key directly. Your device is signing some bit of data, then the server uses your public key to verify that it was signed by your private key. Its a small distinction, but is one of the principal uses of asymmetric encryption is that the public key can truly be public knowledge and given to anyone, while the private key is 100% always only accessed by you the user.

    • Natanael@slrpnk.net
      link
      fedilink
      arrow-up
      2
      ·
      1 year ago

      Yeah, the TPM should perform the signature inside of the security chip, the key is always off limits from everything else