SSH agent for Chrome OS

[Evan Broder]

Hey folks -

We've been working at Stripe on implementing an SSH agent for the
Secure Shell app that uses the new chrome.platformKeys API (just
released in Chrome 45 for Chrome OS). It's still very rough around the
edges, but we're pretty excited about being able to do SSH
authentication using keys stored on the TPM soon.

Code is on Github here: https://github.com/stripe/macgyver

We wrote up a bunch of notes on our experiences dealing with both the
SSH agent relay protocol and the permissioning scheme for
platformKeys. The latter definitely feels like it could use some work
before being broadly useful (and is part of the reason, e.g., we're
not publishing the agent to the web store yet)

Hopefully this is interesting to folks thinking about SSH on Chrome
generally. Definitely let us know if anything in the docs is unclear,
or if there are any other questions we could answer!

- Evan

[Mark Stosberg]

Now that it is three years later, is it possible to start storing SSH private keys in the TPM on unmanaged Chromebooks?

[Mike Frysinger]

what doesn't work with macgyver ?

managed status doesn't matter to how the TPM is exposed via the chrome.platformKeys API.

-mike

--
You received this message because you are subscribed to the Google Groups "chromium-hterm" group.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/chromium-hterm/a49301e2-53f6-40a9-915c-478502bb2f74%40chromium.org.

[Mark Stosberg]

On Tue, Oct 16, 2018 at 9:59 PM Mike Frysinger <vap...@chromium.org> wrote:

what doesn't work with macgyver ?

According to the Macgyver docs on Permissions:

It's only possible to access certificates that were generated using the chrome.enterprise.platformKeys API. In order to use MacGyver, this means that you must have an enterprise-enrolled Chromebook that uses an administrator-provisioned extension to generate and load certificates.

https://github.com/stripe/macgyver#permissions

     Mark

--

Mark Stosberg

Director of Systems and Security | RideAmigos | 765-277-1916 | ma...@rideamigos.com