WinTPM

A simple Go program that demonstrates generating and managing keys with the Windows TPM (Trusted Platform Module).

---

Build Instructions (Windows Only)

# Build the executable
go build -o wintpm_demo.exe .

---

Usage

Run the program with the desired parameters:

.\wintpm_demo.exe -alias MyRootCA -bits 3072

or

.\wintpm_demo.exe -alias MyRootCA -bits 2048

⚠️ The key size (-bits) depends on your TPM hardware model. Some TPMs may only support 2048-bit keys, while others support 3072-bit.

---

Verifying Key Storage (Hardware vs Software)

To check whether the generated key is hardware-backed (inside the TPM) or software-emulated, run the following command on Windows Server:

certutil -csp "Microsoft Platform Crypto Provider" -key "RazaCA" | findstr "Key Storage"

If the output contains "Hardware", the key is protected by the TPM hardware. Otherwise, it may be software-emulated.

---

Notes

• Requires Windows with TPM support.
• Run PowerShell or Command Prompt with Administrator privileges when testing.