OpenSSH Client

Setup

1. Create configuration file and change it for your setup

cp config.sample ~/.tpm2/config

2. Extract public key

ssh-keygen -D libtpm2-pk11.so

3. Use your TPM key

ssh -I libtpm2-pk11.so ssh.example.com

or add the PKCS#11 module to your ssh config in ~/.ssh/config:

Host *
    PKCS11Provider libtpm2-pk11.so

Known Issues

Not all TPM's support SHA512 and therefore can't sign messages hashed with SHA512. To circumvent this TPM limitation you need to set sign-using-encrypt to true in ~/.tpm2/config