I want to implement Vault as part of the DevOps build pipeline to store all the secrets like passwords and certificates. I understand that Vault keeps the data encrypted but I have been asked me to look for a way to store the Vault's data in TPM as "it would be more secure and temper-protected". First off, is this argument valid? Vault already stores the encrypted data so is this additional layer of encryption really needed?

I read the Hashicorp's Vault Storage Documentation and it does not directly support any storage over TPM but if I could mount TPM on the container then I could probably use filesystem storage to store data inside it.

So, is it possible to mount the host system's Trusted Platform Module (TPM) onto a docker container?

  • I think you have two questions: 1) is this usage of the TPM valid and 2) how to access it from Docker. I posted an answer for the first. I landed here looking for the answer to #2. – Wilbur Whateley Nov 25 at 18:32
  • Found some comments here lwn.net/Articles/768419. Not an answer, but relevant to TPM on Linux: "One of the many issues (James) Bottomley has with this is that the daemon is a natural point of attack for anyone looking to run off with TPM secrets. For his day job, which is running containers in the cloud, the design is completely unacceptable: cloud tenants will not tolerate "anything daft in security terms", and a single daemon through which the secrets of all the system's tenants pass is certainly that." This is mostly a TPM 1.2 comment. – Wilbur Whateley Nov 25 at 18:57

I think that the statment "to store the Vault's data in TPM" is not valid. The TPM is generally not for storage. There are some slots for storing some values and likely some persitent keys, but it is only a handful. I think TPM 2.0 maybe has more storage than 1.2, which I'm more familiar with, but it is not a storage device. It really depends on what and how much of it you need to store.

So while there might be a solution using "on-chip" TPM memory, it is scarce and really slow. The more common pattern is the use the TPM to wrap the keys or data, such that it can be stored in an encrypted blob on actual storage, like disk or network, and only safely unwrapped on THAT MACHINE.

The TPM is not really a "crypto co-processor" nor is it a storage device. It's slow and has minimal resources, for cost.

Having clarified that, it probably is valid to use the TPM, in the proper way, to help securely store the application data, it just depends on how much work it is for you.

Also, if the data doesn't need to be specifically tied to that specific machine, or that specific container, or the installation is on a VM, and the VM might spin up on different hardware, then using the TPM doesn't really make sense because it is a root-of-trust for a specific platform, a specific board or machine.

So to be semantically picky:

  1. Storing the Vault data in the TPM: not valid
  2. Storing the Vault data with the TPM: valid (potentially)

Disclaimer: I don't know anything about Vault or the data you want to store.

Your Answer

