TPM2 Support #1321

stv0g · 2023-10-09T12:18:08Z

stv0g
Oct 9, 2023

I am surprised to see that nobody seems to use SOPS with hardware-backed keys in a TPM2 module.

Is this supported? Or what would be the required steps to do so?

Here are some of my initial ideas:

Support it via age-plugin-tpm
- Probably not possible for the same reason as the support of age-plugin-yubikey (se Age malformed recipient - invalid type "age1yubikey" #1103)
Support it via GnuPG (>= v2.3)
- GnuPG seems to have decent support TPMs as covered in this blog article
- Use the fallback to gnupg CLI instead of use the Go implementation

Foxboron · 2024-07-25T11:57:26Z

Can just implement something using the TPM2 TSS key files directly.

Judging by the existing keysource implementations it should be fairly trivial to implement?

0 replies

Foxboron · 2025-03-11T09:17:10Z

With #1641 merged you can now probably use https://github.com/Foxboron/age-plugin-tpm in the future.

0 replies