ssh-tpm-keygen
Passphrase
In general, DO set a passphrase, and do NOT leave it empty - EVEN though the private key is in the TPM.
This is especially important since ssh-tpm-agent does not yet support using PCRs (systemd-analyze pcrs).
This passphrase is per "session", so you won't have to keep typing it every time.
For more security, opt for a "requires presence confirmation with touch" model. This does not appear to be supported by ssh-tpm-agent; consider using a physical YubiKey (or similar), e.g. with yubikey-agent.
NOTA BENE: On non-graphical Console-only NixOS, the PIN prompt won't "just work", so keys with passphrase shouldn't be used there.
Setup
Make sure your Nix user has tss in their extraGroups.
Remember to hard reboot for such group changes to take effect.
Doing a simple logout and login again will have groups show
you as being in tss - but your systemd user-level unit still
will not access to the TPM, which means this won't work.
Then generate your SSH key inside your TPM:
ssh-tpm-keygen
Testing
cat ~/.ssh/id_ecdsa.pub >>~/.ssh/authorized_keys
ssh localhost
Transfer your ~/.ssh/id_ecdsa.pub to https://github.com/settings/keys, and test it:
ssh git@github.com
Nota bene: ssh-add -L will show "The agent has no identities" until it's first used.
Change Passphrase
ssh-tpm-keygen -p
If you get "Failed changing passphrase on the key.", see #116 for better logging.
Delete Key
You can't really delete the key in the TPM with ssh-tpm-keygen.
You can delete the files of the public key and the *.tpm _ "handle"_ in ~/.ssh/.
You can override it with a new ssh-tpm-keygen.