Library · Devices
Device identity that is hard to fake: TPM, Secure Enclave and fingerprints
Component fingerprints change easily and are easy to spoof. A key created inside a security chip cannot be copied off the machine. Together they recognise real machines without punishing honest users.
Component fingerprints
CPU, board, disk and network identifiers are hashed and combined. Pro: no special hardware. Con: emulators can report anything, and a new disk changes the fingerprint.
Match with tolerance
Do not demand an exact match. Treat it as the same machine when enough components agree, so a reinstall or one new part does not burn a seat.
Keys in hardware
TPM (Windows) and the Secure Enclave (macOS) create keys that cannot be exported. Every request signed with such a key proves it came from that chip, not just from a matching set of values.
A way back
Virtual machines and older PCs may lack a TPM. Offer "prefer hardware" rather than "require hardware", and flag devices without a hardware key so you can watch them.
With ClavisAUH
Device keys and tolerant matching are built in: Device Binding (Node Locking) is part of Standard Protection, so there is nothing to turn on.