Accessing TPM from inside a Docker Container

Question

I want to implement Vault as part of the DevOps build pipeline to store all the secrets like passwords and certificates. I understand that Vault keeps the data encrypted but I have been asked to look for a way to store the Vault's data in TPM as "it would be more secure and temper-protected". First off, is this argument valid? Vault already stores the encrypted data so is this additional layer of encryption really needed?

I read the Hashicorp's Vault Storage Documentation and it does not directly support any storage over TPM but if I could mount TPM on the container then I could probably use filesystem storage to store data inside it.

So, is it possible to mount the host system's Trusted Platform Module (TPM) onto a docker container?

Answer 1

I think that the statment "to store the Vault's data in TPM" is not valid. The TPM is generally not for storage. There are some slots for storing some values and likely some persitent keys, but it is only a handful. I think TPM 2.0 maybe has more storage than 1.2, which I'm more familiar with, but it is not a storage device. It really depends on what and how much of it you need to store.

So while there might be a solution using "on-chip" TPM memory, it is scarce and really slow. The more common pattern is the use the TPM to wrap the keys or data, such that it can be stored in an encrypted blob on actual storage, like disk or network, and only safely unwrapped on THAT MACHINE.

The TPM is not really a "crypto co-processor" nor is it a storage device. It's slow and has minimal resources, for cost.

Having clarified that, it probably is valid to use the TPM, in the proper way, to help securely store the application data, it just depends on how much work it is for you.

Also, if the data doesn't need to be specifically tied to that specific machine, or that specific container, or the installation is on a VM, and the VM might spin up on different hardware, then using the TPM doesn't really make sense because it is a root-of-trust for a specific platform, a specific board or machine.

So to be semantically picky:

1. Storing the Vault data in the TPM: not valid
2. Storing the Vault data with the TPM: valid (potentially)

Disclaimer: I don't know anything about Vault or the data you want to store.