ssh-tpm-agent UX issues about ssh-tpm-agent HOT 3 OPEN

Generally, when doing UX we can't do worse then whateverthefuck PKCS11 is currently doing; https://jade.fyi/blog/tpm-ssh/

from ssh-tpm-agent.

Current idea is to probably just mirror the existing ssh client tooling and rely on the same assumptions.

It turns out that all of the tools query the agent when getting a public key, so we don't actually have to care that much about what we do with our private TPM token.

General idea is as follows:

• ssh-add -> ssh-tpm-add
• ssh-agent -> ssh-tpm-agent
• ssh-keygen -> ssh-tpm-keygen

Keys should have a .tpm_ssh extension.

ssh-tpm-agent

Starts the agent. It accepts a socket location, and a location to search for keys with the .tpm_ssh extension.

tpm-ssh-agent --install-user-units can optionally install systemd services for the given user (maybe).

ssh-tpm-keygen

Creates keys with the same flow as found in ssh-keygen. These files are installed into .ssh/ with id_edsa.pub and id_edsa.tpm_ssh.

ssh-tpm-add

Little bit unsure about the feature list we want, but generally things that are usually not supported by ssh-add. Generally we want the ability to import existing private keys, seal them towards the TPM.

This would allow people to move existing keys from their .ssh dir and sealed towards the TPM.

It should probably also be capable of adding new keys into the existing agent.

from ssh-tpm-agent.

Everything should be included with this change:

#21

from ssh-tpm-agent.