• AmberPrince@kbin.social
    link
    fedilink
    arrow-up
    9
    ·
    1 year ago

    A pass key is the private key in a private/public key pair. The private key is stored in the TPM on your device. The website contains the public key. When you use your “one password” you’re in effect giving your device permission to access the key storage in your TPM to fetch the private key to present it to the site.

    What this means in practice is that if a website has a data breach they won’t have your hashed password, only your public key which… is public. It doesn’t and can’t do anything on its own. It needs the private key, which again only you have and the website doesn’t store, to do anything at all.

    If you want to read more about it look into cryptographic key pairs. Pretty neat how they work.

    • jet@hackertalks.com
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 year ago

      I’m not sure there’s a requirement for the TPM to be used. To me that would imply the private key is stored in the TPM so you couldn’t export it. But a lot of the passkey providers have remote sync available.

      Which to implement, would mean they’re storing the key outside of the TPM, but using the local TPM to decrypt the secret stored outside of the TPM. IE the certificate payloads are decryptable by a variety of keys that are stored in different TPMs. There’s lots of assumptions here of course.

      • Bitrot@lemmy.sdf.org
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 year ago

        I imagine password managers won’t touch the TPM, but iPhones essentially work as you say. Apple has a lot of documentation for how they synchronize.

      • Natanael@slrpnk.net
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        It would be backed up at the point of provisioning.

        A TPM can be set to allow exports or block them, so if you program the TPM to export a key once and then flip the switch to block exports then you can have this kind of backups and synchronization

    • meteokr@community.adiquaints.moe
      link
      fedilink
      arrow-up
      3
      ·
      1 year ago

      When you use your “one password” you’re in effect giving your device permission to access the key storage in your TPM to fetch the private key to present it to the site.

      Very small correction as I understand, but your private key is never presented. The web service should never interact with the private key directly. Your device is signing some bit of data, then the server uses your public key to verify that it was signed by your private key. Its a small distinction, but is one of the principal uses of asymmetric encryption is that the public key can truly be public knowledge and given to anyone, while the private key is 100% always only accessed by you the user.

      • Natanael@slrpnk.net
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        Yeah, the TPM should perform the signature inside of the security chip, the key is always off limits from everything else