Comments (7)
Hi @jarkkojs ,
The NIST Prime curves like SECP256R1 are the most popular. The Koblitz curves are less common and the TPM manufactures are not required to support that curve. What is prompting your interest in using the Koblitz ECC curves?
@kgoldman any feedback on the status of TCG and the Koblitz curves like SECP256K1?
Thanks,
David Garske, wolfSSL
from wolftpm.
The TCG process is to include an algorithm when there is demand. The demand can come from any TCG member company, but often comes through one of the work groups.
from wolftpm.
As a workaround I'm going to do this next after tpm2_key_*: https://social.kernel.org/notice/AiNuw35YY9uOSrhiK0
from wolftpm.
@kgoldman, @dgarske: So, first of all thank you for these insights. This verified what I assumed how it was.
Secondly, I put together TPM2 backed ECDSA keys for NIST-{P256,P384,P521} for Linux kernel keyring, of which I'm co-maintainer of together with David Howells from Red Hat. They use TPM2 for signing and software ECDSA for verification using pre-existing implementation from Stefan Berger (IBM). Apparently this was also first signing implementation across the board in Linux, as Stefan's implementation does only verification.
It is working pretty well, I've tested it with keys created by both IBM and Intel TPM2 stacks, and I'm also working on a tool called "tpm2ctl", which is really not yet another TPM2 stack. It will just a few sub-commands to interact with both keyring and TPM2 device to quickly get x.509 compatible key pair ready and set. It also takes away some openssl commands with the help of libsodium.
All of this work is just implementing TPM2 parts of this spec authored by David Woodhouse, who is principal engineer from AWS: https://datatracker.ietf.org/doc/draft-woodhouse-cert-best-practice/
I'm the only person in this equation who has no corporate affiliation or any other org affiliation, except perhaps kernel.org ;-) Had a good and also legit time to implement the feature given zero affiliations. I've been a contract researcher since Mar 2023 in https://www.sochub.fi/, which is ending at the end of Sep, and I'm returning to the corporate world, so time was running up to do this as an actor with no interest group, except my own interest towards tech :-)
So. This brings me to my point. The feature right now with NIST stuff helps companies like Amazon to ease working with x.509 certificates e.g. in data centers. However, p256k1 is vastly popular in open source communities such as Bitcoin and Ethereum and some other blockchain technologies. I would feel that it would be balanced if also blockchains would get the benefits of securing the private keys of crypto wallets and smart contracts (Eth).
From kernel side, given the work I already did, this would not a big stretch to enable also that ECDSA. From TCG's side it would require putting that curve also to the registry. It's not like either that P256K1 would be non-existent in proprietary world. E.g. Intel CSE natively supports it.
Right now there is a market of USB cryptowallets that only exist IMHO because TPM2 chip is not delivering here. IMHO, everyone would be better off, if TPM2 had also this feature. Then it would pretty well encapsulate full coverage of crypto ecosystem of 2024.
from wolftpm.
I always keep my integrity in any possible situation, no matter which corporate I'm hired or not but just thought that this is the most legit position for me to propose anything in curve space. I'm only doing charity work and enabling tech... for free of charge ;-) On my leisure time...
from wolftpm.
You might already know this, but TCG has a provision for someone to be an 'invited expert'. You can join calls, contribute to documents, everything except vote. I'm sure you would qualify.
from wolftpm.
@kgoldman I'll definitely consider that! Thank you.
from wolftpm.
Related Issues (20)
- Can't clear TPM chip HOT 2
- git commit fails even though no change was made HOT 3
- Build errors
- wolftpm C# wrapper needs to implement IDisposable instead of using Finalizer. HOT 2
- Error handling in C# wrapper HOT 2
- Fix the maximum clock speed for SLB9672
- wolfTPM is not thread-safe (`gActiveTPM` ought to be a thread-local) HOT 5
- Add more examples: TPM2_ActivateCredential() HOT 1
- Software-only implementations of TPM2_Duplicate() and TPM2_MakeCredential() HOT 1
- Response to TCG TPM2.0 Errata ID: TCGVRT0007 and CVE-2023-1017 and CVE-2023-1018 HOT 1
- How to go through wolfTPM2_Init with gdb HOT 7
- Building in MSYS2: undefined reference to `__imp_wolfSSL.._ HOT 10
- keygen -rsa -eh failed with TPM_RC_BAD_AUTH HOT 7
- Stuck in TPM2_Startup(&startupIn) function HOT 11
- Windows/WSL Problem with .git/hooks/pre-commit zero-length file
- Is 1,000,000 a reasonable value for TPM_TIMEOUT_TRIES? HOT 2
- Support of tpmrmX interface HOT 6
- tpm2_linux open() file descriptor 0 should be allowed HOT 2
- Need help - can't decrypt data using wolfTPM2_RsaDecrypt HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from wolftpm.