Signing TLS handshakes inside a TPM
In this technical post, the author explains how to use a TPM to sign TLS handshakes, keeping private keys off disk and out of memory. The approach leverages the crypto.Signer interface in Go, allowing a TPM-backed key to be used seamlessly with standard TLS stacks. The post covers the rationale, implementation details, and benchmarks, emphasizing that the security property is established at provisioning time.
A key in a file is not really a machine identity. It’s a bearer credential that happens to be stored on a machine, and whoever reads it becomes that machine, anywhere, until somebody notices and revokes the certificate.