Private Key support from TPM Hardware for Aws Iot and Mqtt connection

[lingas25]

We need an information from
Question:

1. Is Aws Iot login uses private key from TPM hardware, instead of providing explicitly.
2. Previously they had this development in this branch https://github.com/aws/aws-iot-device-sdk-cpp-v2/tree/tpm2 but which is not available now.
3. When this change will be available from Aws side.
4. Other then certificate and private key merging for Aws Iot and Mqtt communication is there any other way to use from TPM Hardware.

[lingas25]

Any update

[bretambrose]

On Linux, tpm support is via pkcs11: https://github.com/awslabs/aws-crt-cpp/blob/v0.26.1/include/aws/crt/io/TlsOptions.h#L95-L106
On Windows, tpm support is via Windows cert store API: https://github.com/awslabs/aws-crt-cpp/blob/v0.26.1/include/aws/crt/io/TlsOptions.h#L95-L106

Both of these features have been available for the last two years or so.

[lingas25]

@bretambrose

I gone through the URL and we do not need like below.

• This all are specifying the private key externally.
• Clubbing private key into the same certificate as pcks11.

We need that AWS sdk should directly read the private key from TPM instead of providing externally.

[bretambrose]

I am having a hard time following.

There is (or should be) no way to read a private key from a TPM. That would fatally undermine the security advantage.

All you should be able to do with a TPM is request (via API calls) that it perform well-defined cryptographic operations on pieces of data.

The device SDKs support one specific way to use TPMs: perform the necessary private key operations on the parts of the TLS handshake required to do the "m"(mutual) part of m(utual)TLS. This means you'll end up using a different initialization API for TlsContext rather than the cert-and-key one.

On Linux this is done by using a PKCS11-compliant library specific to the TPM. It's the developers job to deploy that library to the device and configure the SDK to use it properly via the PKCS11-specific API in the TLS Context type.

On Windows, the OS handles the device driver interface details and you'll need to configure an entry in the Windows cert store appropriately and use the cert store specific API to initialize the TLS Context.

The tpm2 branch that supposedly contains what you want only contained an update to samples to use the pkcs11/cert store APIs on TlsContext.

[bretambrose]

Following up,

Looked into this further and I wasn't fully accurate with the "one specific way to use TPMs." Internally, the C implementation also supports Parsec via this commit.

This support is only bound out in Java: awslabs/aws-crt-java@35813b7

If this functionality would be of interest to your C++ SDK usage, engage your AWS product/account contact with the details of your specific needs.