search

trailofbits / tlslib.py

MVP for updated PEP 543 proposal
https://trailofbits.github.io/tlslib.py/
Apache License 2.0
9 stars 0 forks source link

Add support for OpenSSL TPM / SSM-based providers #51

Closed jvdprng closed 4 months ago

jvdprng commented 5 months ago

As per https://discuss.python.org/t/pre-pep-discussion-revival-of-pep-543/51263/47

Looking at tpm2-openssl/docs/keys.md at master · tpm2-software/tpm2-openssl · GitHub and tpm2-openssl/docs/certificates.md at master · tpm2-software/tpm2-openssl · GitHub, wrapping a TPM or SSM based provider in OpenSSL 3+ imposes a similar requirement at least for private keys (so they can be loaded by handle or hardware NV index, rather than from a file).

While it’s less clear to me if tpm2-openssl itself supports the use of opaque certificates (all the examples given in the docs use regular PEM files for the public certificates), TPM hardware and software security modules certainly offer that feature.

woodruffw commented 4 months ago

Done I believe; this is supported via ID-based ctors.