As most servers, physical and virtual are now equipped with a TPM, are there any plans to leverage this to store keys for FreeIPA?
We have a use-case where freeipa is a sub-ca and the root-ca will sign our cert. Ideally we would like to store the private keys in TPM - specifically AWS NitroTPM
I know that HSM has recently been supported - is it feasible to leverage a similar process to support TPMs?
On Срд, 15 ліс 2023, John Phillips via FreeIPA-users wrote:
As most servers, physical and virtual are now equipped with a TPM, are there any plans to leverage this to store keys for FreeIPA?
We have a use-case where freeipa is a sub-ca and the root-ca will sign our cert. Ideally we would like to store the private keys in TPM - specifically AWS NitroTPM
I know that HSM has recently been supported - is it feasible to leverage a similar process to support TPMs?
HSM support in FreeIPA is not yet complete, work on it is ongoing in https://github.com/freeipa/freeipa/pull/6714
Dogtag PKI relies on NSS library to store private keys for CA and HSM integration is based on the fact that you can access those devices via PKCS#11 token. So if you have TPM2/PKCS#11 bridge, that might be an option eventually.
I see there is https://github.com/tpm2-software/tpm2-pkcs11 that represents TPM 2.0 devices as PKCS#11 tokens.
From FreeIPA prespective a key requirement in HSM use in production is that replication of the key material is then delegated to HSM implementation. Many commercial HSM products are actually 'network-based HSMs' and allow seamless access to the cryptographic token transparently over network to their clients. As a result, IPA replicas will be able to access the same content. I see that tpm2-pkcs11 has support for link/import in ptool but as I said, nobody ever tried it all as a pkcs#11 token for IPA use.
Thanks for the response Alexander, it sounds like it will be a while before FreeIPA or IdM gets full support for HSM or TPM.
I may try using https://github.com/tpm2-software/tpm2-pkcs11 and if I make any progress I will feedback here
On Срд, 15 ліс 2023, John Phillips via FreeIPA-users wrote:
Thanks for the response Alexander, it sounds like it will be a while before FreeIPA or IdM gets full support for HSM or TPM.
I may try using https://github.com/tpm2-software/tpm2-pkcs11 and if I make any progress I will feedback here
Note also that hardware TPM devices typically don't have enough storage space for covering typical CA and especially KRA needs that IPA deployments have.
May be binding a separate storage to a TPM and encrypting it would work.
Alexander Bokovoy via FreeIPA-users wrote:
On Срд, 15 ліс 2023, John Phillips via FreeIPA-users wrote:
Thanks for the response Alexander, it sounds like it will be a while before FreeIPA or IdM gets full support for HSM or TPM.
I may try using https://github.com/tpm2-software/tpm2-pkcs11 and if I make any progress I will feedback here
Note also that hardware TPM devices typically don't have enough storage space for covering typical CA and especially KRA needs that IPA deployments have.
May be binding a separate storage to a TPM and encrypting it would work.
I poked around at the tpm2-pkcs11 repo and couldn't find any mention of number or size of keys supported, etc. It mentions using a sqlite3 database for some storage but it wasn't obvious what and I didn't bother digging into the code.
rob
freeipa-users@lists.fedorahosted.org