How to Know Your Client Is Real: Hardware-Backed Authentication Patterns
summary
Hardware-backed keys are non-exportable so signatures prove use not copy; enrollment generates a device-bound key inside TPM or Secure Enclave, produces a TPM quote or Apple attestation, and the backend verifies certificate chains and PCR/boot-state claims. Android varies by device so policy must require StrongBox or tiered fallbacks. Operational flow uses hardware anchors plus rotating certificates, periodic re-attestation, and targeted revocation to shrink blast radius from many tokens to one compromised machine.
AI-written summary · about
chapters (10)
- 0:00The client identity gap
- 2:06Why credentials aren't enough
- 3:58Hardware-backed foundations
- 7:12Core security concepts
- 10:43Implementing TPM systems
- 20:18Apple's secure enclave
- 27:38Android's security model
- 34:49Remote attestation
- 39:32Production lifecycle management
- 43:48Architecture and conclusion
related talks
09mProtecting APIs with DeviceCheck, App Attest & WebAuthn
40mUsing TPMs to Cryptographically Verify Devices at Scale
22mGuarding the Gate: Strategies for High Security with Passkeys
24mRelying Party Security
37mTo Protect And Confirm
56mPasskeys 101: Technical Principles of FIDO
42mTPM based attestation - how can we use it for good?
22mComplementing Passkeys with Strong Identity Assurance for High-Risk Actions and Account Recovery