Create ephemeral TPM keys on the recipient side

[Foxboron]

Currently age-plugin-tpm makes ephemeral NIST P256 key in software when the someone encrypt something with the recipient.

There is probably(?) nothing stopping us from creating an ephemeral key inside the TPM on the remote side and use this for ECDH.

We could make this toggle-able if this is not something the remote end wants.

[nbraud]

In what security model would that be an improvement?

As far as I can tell, an attacker who can subvert the (sw-only) ephemeral key's generation, can presumably access the plaintext being encrypted; since the ephemeral key is not reused for any other plaintext, there's no risk of it being leveraged against other ciphertexts.

[Foxboron]

In what security model would that be an improvement?

It's more case of "why not both" and for fun really.

[nbraud]

I see ^^