1Password8/Windows and Windows Hello on first signin?

I found another person having this issue on reddit so I'm linking here their post if support want's to reach out to them for more diagnostic data. https://www.reddit.com/r/1Password/comments/tfu103/use_the_trusted_platform_module_with_windows/

hey @krtickak thanks for sharing this here, I was able to get it resolved and I updated my reddit post with the solution. The tl;dr is that I had initially set up Windows Hello without my TPM enabled, and that meant the private key was stored in software key storage within Windows.

After enabling the TPM, I then had to delete this private key using certutil , log-off and re-enable Windows Hello. After doing this, I confirmed this the private key was now stored in the TPM as indicated by NgcKeyImplType: 1 (0x1). I was then able to enable this option in 1Password and confirm it worked correctly.

Hope this helps anyone else experiencing this behaviour!

@baldersz awesome this worked like a charm. Now it would be awesome if 1Password directly said that those private keys are not stored in TPM and that Windows Hello needs to be reset so it can store private keys in TPM. @1P_PeterG @ag_ana @MikeT @Nhat_Nguyen

@baldersz very well done, cleaning up the Windows Hello setup resolved the issue for me too. Thanks!

@krtickak and @BSi glad it helped!

Edit: Can confirm that 1Password is using the TPM by running:

certutil -csp "Microsoft Passport Key Storage Provider" -key -v | Select-String -Pattern "Name:", "NgcKeyImplType"

Output will show an RSA signed key 1Password-Enclave-Key stored in the TPM (via NgcKeyImplType: 1 (0x1))

I think I know what caused this issue and that is that I enabled Windows Hello after I bought fingerprint reader for my desktop computer and TPM was disabled at time of registering windows hello. So windows stored windows hello private keys in software. Than I enabled fTPM in preparation for Windows 11 which I later changed to dTPM because of https://www.amd.com/en/support/kb/faq/pa-410 in AMDs implementation of fTPM.

Hey @krtickak / @baldersz / @BSi:

Glad to hear we were able to get you up and running, and thanks for sharing the steps!

Jack

@krtickak you're exactly right. Windows Hello can operate without a TPM, and will store it's private key in Software Key Storage within Windows if it cannot detect a TPM. Enabling fTPM or installing a hardware TPM (like I did too) doesn't automatically transfer this private key to the TPM. Glad we got it sorted!

Hi folks,

As we continue to work with you awesome folks here and collecting more data, we were able to find a solution that works better with more TPM chipsets.

The next nightly (80700018, now available) and beta updates is going to have a major improvement with Windows Hello support where we can now work with AMD fTPM as well as vTPM in VMware Workstation on Windows and Parallels on Mac solutions (other virtual machine software may also work but we've tested these two).

@baldersz, that's a great find and thanks for sharing it with us, we will probably include it as a troubleshooting method. We are trying to investigate everything we can find (we don't have a lot of docs and APIs to work with here) and that's a part of the conversation we're trying to have with Microsoft to find a solution where we can get the best of everything. We're getting there for sure, the current nightly builds have a lot of Windows Hello improvements already.

Hi, In my case, I upgraded to Windows 11, and enabled TPM, after I'd setup a PIN for Windows Hello in my previous Windows 10 installation. So, I was also experiencing the private key issue that @baldersz first discovered.

Thanks to them, I was able to run:
certutil -DeleteHelloContainer
logoff

In Windows Terminal. This deleted my current Windows Hello configuration, and meant I had to re-enter my Window's password on next login. From here, I was able to setup my PIN again, and this time my 1Password-Enclave-Key (stored in the TPM), returned a code of NgcKeyImplType: 1 (0x1). I could then enable the TPM security option in 1Password.

I would suggest though, that anyone else who has this issue waits for official documentation from 1Password, before proceeding with troubleshooting.