Trusted Platform Modules
A Trusted Platform Module is a security processor that protects cryptographic keys and records platform measurements. Software uses its standard commands to bind secrets and identity proofs to a device or to a measured system state.
itComputer architecture and hardware | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
Trusted Platform Modules
A Trusted Platform Module (TPM) is a security processor with a standardized command interface. It creates and uses cryptographic keys inside a protected boundary. It also stores small amounts of state and records measurements in Platform Configuration Registers (PCRs). Software can use those capabilities for device identity, disk-encryption key protection, measured boot, and attestation.
The word trusted describes a design role, not a guarantee that every platform is secure. A TPM is a root of trust: other controls can base decisions on keys and state protected by it. The TPM does not inspect all software, decide which operating system is safe, encrypt a whole disk itself, or prevent every physical attack.
Placement and software layers
A discrete TPM is a separate chip connected to the host by a hardware bus. A firmware TPM implements the interface inside a protected processor environment. A virtual TPM gives a virtual machine its own TPM-facing state, usually backed by a hypervisor or service. These forms expose similar commands but have different physical boundaries, update paths, and owners.
Host software reaches the TPM through several layers:
application or platform service
→ high-level TPM API
→ TPM Software Stack
→ transport interface and operating-system driver
→ TPM implementation
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://trustedcomputinggroup.org/work-groups/trusted-platform-module/
Supports
- TCG defines TPM specifications and platform-specific profiles
- TPM 2.0 supports platform, software-stack, and virtualized implementations
- https://trustedcomputinggroup.org/resource/tpm-library-specification/
Supports
- TPM 2.0 defines architecture, structures, commands, algorithms, authorization, objects, and PCR behavior
- TPM 2.0 expands algorithms and authorization mechanisms beyond TPM 1.2
- TPM protected objects, hierarchies, handles, sessions, nonvolatile indexes, and quotes follow the library model
- https://trustedcomputinggroup.org/wp-content/uploads/TCG-PC-Client-Platform-TPM-Profile-Specification-for-TPM-2.0-Version-1.06-rc-1_9Jan25.pdf
Supports
- Platform profiles narrow TPM Library choices for PC clients
- PC Client TPMs define required PCR and nonvolatile behavior
- https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/trusted-platform-module-overview
Supports
- A TPM provides hardware-based security functions and protects cryptographic keys
- Windows uses TPM capabilities for platform integrity, authentication, BitLocker, and device health attestation
- TPM 2.0 Windows health attestation expects UEFI firmware
- https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/tpm-fundamentals
Supports
- TPMs can be discrete microcontrollers or protected modes in a main processor
- Endorsement keys, storage keys, sealing, key attestation, and anti-hammering have distinct roles
- TPM-protected private key material is not exposed for ordinary external use
- https://learn.microsoft.com/en-us/azure/security/fundamentals/measured-boot-host-attestation
Supports
- Measured boot extends a hash chain into PCRs and records a boot configuration log
- Host attestation combines signed platform state, an event log, and verifier assessment
- PCR values and logs must be evaluated together
- https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/switch-pcr-banks-on-tpm-2-0-devices
Supports
- Hardware, firmware, and boot-loader changes can change PCR values
- TPM 2.0 can expose PCR banks associated with different hash algorithms
- https://support.microsoft.com/en-US/Windows/Security/Device-Security/what-s-a-trusted-platform-module-tpm
Supports
- TPMs can be separate motherboard components or integrated processor solutions
- Integrated placement changes the physical communication attack surface
- https://cdn.kernel.org/doc/html/latest/security/tpm/index.html
Supports
- Linux documents TPM measurement integrity and initial trust establishment
- Operating-system support participates in safe TPM use
- https://kernel.org/doc/html/v6.9/security/keys/trusted-encrypted.html
Supports
- Linux trusted keys can root protected key material in a TPM storage key
- Trusted keys can be sealed to selected PCR values
- TPM 2.0 objects require appropriate parent and persistent-key handling
- https://cdn.kernel.org/doc/html/latest/security/tpm/tpm-security.html
Supports
- A discrete TPM host bus can be attacked by an interposer
- Session authentication and parameter protection matter for sensitive TPM traffic
- TPM integration and provisioning affect the resulting security boundary
- https://tpm2-tools.readthedocs.io/en/stable/
Supports
- tpm2-tools provides command-line access built on the TPM2 Software Stack
- TPM software uses system APIs and transport interfaces to reach the device
- https://github.com/tpm2-software/tpm2-tss
Supports
- TPM2 Software Stack supplies multiple API layers and transport abstractions
- Applications do not ordinarily send raw device bytes without a software stack
- https://github.com/sindresorhus/awesome
Supports
- The Awesome catalog was the required starting point for ecosystem discovery
- Its security catalog links to Embedded and IoT Security
- https://github.com/fkie-cad/awesome-embedded-and-iot-security
Supports
- The fetched list covers embedded and IoT security tools and resources
- Its current curated entries do not provide a TPM-specific ecosystem set suitable for this course
- https://www.infineon.com/products/security-smart-card-solutions/optiga-embedded-security-solutions/optiga-tpm
Supports
- OPTIGA TPM is a discrete TPM family for computing and embedded platforms
- The family includes host interface and product-lifecycle choices
- https://www.st.com/stsafe-tpm
Supports
- STSAFE-TPM is a TPM family for computing, industrial, connected, and automotive designs
- ST supplies TPM variants and integration support for Linux and Windows ecosystems
- https://www.nuvoton.com/products/cloud-computing/security/trusted-platform-module-tpm/
Supports
- Nuvoton SafeKeeper supplies single-chip TPM devices implementing the TCG PC Client specification
- https://learn.microsoft.com/en-us/windows/security/hardware-security/pluton/microsoft-pluton-security-processor
Supports
- Microsoft Pluton is an integrated security processor that can provide TPM functionality on supported platforms
- Its firmware and operating-system integration are part of its security lifecycle
- https://github.com/stefanberger/swtpm
Supports
- swtpm provides libtpms-based TPM emulators with socket and virtual-device interfaces
- swtpm supports creating separate virtual TPM device instances and related provisioning data