mirror of
https://github.com/pineapplehunter/linux-tpm-fido2.git
synced 2026-07-29 12:04:24 +09:00
WIP implementaion using TPM2 for fido on Linux
- Rust 93.6%
- Nix 5.5%
- Python 0.9%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
| .github/workflows | ||
| .sqlx | ||
| agents | ||
| assets | ||
| docs | ||
| migrations | ||
| nix | ||
| src | ||
| .envrc | ||
| .gitignore | ||
| AGENTS.md | ||
| Cargo.lock | ||
| Cargo.toml | ||
| flake.lock | ||
| flake.nix | ||
| LICENSE | ||
| README.md | ||
Linux TPM Fido2
Linux TPM Fido2 is an experimental Linux TPM-backed FIDO2/WebAuthn authenticator.
It exposes a browser-usable virtual HID authenticator, which uses the TPM for signing.
What It Does
- Presents a virtual FIDO2 HID authenticator to browsers.
- Creates TPM-backed P-256 credentials for registration and assertion.
- Supports secure-boot PCR-bound credentials.
- Supports recovery material unlocked by a passphrase and kept TPM-bound.
- Checks user acknowledgement through polkit.
System assumptions
- Linux
- Systemd enabled
- TPM2 on system
- Secureboot Enabled (Recommended)
Usage
Daemon:
linux-tpm-fido2 --store-dir .linux-tpm-fido2-store --tpm-path /dev/tpmrm0 --uhid-path /dev/uhid
Useful flags:
--dry-runon the daemon prints the resolved configuration without opening devices.--store-dirselects the SQLite store and UI settings directory.
Features
- TPM-backed signing keys and PCR policy bindings.
- Recovery slots stored separately from the primary credential metadata.
- Sign counter persistence.
Future Work
- Expand CTAP2 compatibility for additional browser request shapes.
- Compatibility with polkit
- Further security review
Current Limits
- Experimental only.
- No FIDO certification claims.
- No production security claims for the development store.