# Secure TLS Authentication with TPM Authentication with keys never leaving the TPM. - **Source:** [Hacker News: Show HN](https://news.ycombinator.com) - **Published:** 2026-07-26 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/27756517-6d21-44bc-bd56-72c0a70043b5 ## Secure Authentication with TPM This project provides a crypto.Signer backed by a key in a TPM, allowing TLS authentication without the keys ever leaving the TPM. This is particularly important for environments requiring high security. ## Key Management The project uses keys that are pre-generated within the TPM, typically created and certified by an attestation agent. This ensures maximum security for the keys. ## Process Memory Security During the TLS handshake, the signature process is performed using the key within the TPM. The key never leaves the TPM, eliminating the risk of key leakage. ## Ease of Use The project is developed as a small layer over go-tpm and go-tpm-tools, allowing developers to easily integrate TPM and quickly implement secure authentication processes. ## Performance and Scalability While TPM signature operations are slower than software keys, techniques like session resumption and connection reuse minimize this impact, ensuring systems continue to perform efficiently. ## Security and Efficiency Secure authentication with TPM is crucial for critical infrastructures. This project enhances security while ensuring systems operate efficiently, marking an important step in modern software development. ## Sources covering this story - https://github.com/bschaatsbergen/go-tpm-tls — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._