TPM (Trusted Platform Module)

Contents

TPM (Trusted Platform Module) TPM (Trusted Platform Module) is a specialized Trusted Computing Group-driven hardware security module designed to provide platform integrity, cryptographic key storage, and attestation services for computing devices. It integrates with platform firmware such as Unified Extensible Firmware Interface and BIOS environments and supports cryptographic algorithms standardized by bodies including National Institute of Standards and Technology, International Organization for Standardization, and Institute of Electrical and Electronics Engineers. Major vendors like Intel Corporation, AMD, Microsoft Corporation, and Apple Inc. have incorporated TPM or TPM-like capabilities into systems alongside software ecosystems like Windows 10, Linux kernel, and Android (operating system).

Overview

The module provides hardware-backed primitives for secure boot, measured boot, and remote attestation useful to stakeholders such as Microsoft Corporation, Google LLC, Red Hat, Canonical (company), and VMware, Inc.. TPM devices implement cryptographic primitives defined by standards bodies such as International Organization for Standardization and Internet Engineering Task Force and are used by platform vendors like Dell Technologies, HP Inc., Lenovo, ASUS, and Acer Inc.. Enterprises including Amazon Web Services, IBM, Oracle Corporation, Salesforce, and Cisco Systems leverage TPM-backed keys for cloud attestation, identity, and encryption. TPM’s roles intersect with regulations and directives from European Union, United States Department of Defense, National Institute of Standards and Technology, and trade organizations like PCI Security Standards Council.

Development began as an industry initiative involving Microsoft Corporation, Intel Corporation, AMD, and the Trusted Computing Group with early specifications released in 2003 and 2005, followed by revisions aligning with work from National Institute of Standards and Technology and cryptographic input from researchers at University of Cambridge, Massachusetts Institute of Technology, and Carnegie Mellon University. The Trusted Computing Group collaborated with standards bodies such as International Organization for Standardization and the Internet Engineering Task Force to harmonize TPM 1.2 and TPM 2.0 specifications, with vendor implementations from Infineon Technologies, Nuvoton Technology, STMicroelectronics, and Winbond. Political and policy debates around trusted computing involved stakeholders like Electronic Frontier Foundation, Center for Democracy & Technology, and legislators in the European Parliament and United States Congress.

A TPM device contains components such as a hardware random number generator, non-volatile storage, PCRs (Platform Configuration Registers), asymmetric key engines, and an internal trusted authority, implemented by silicon suppliers like Infineon Technologies and STMicroelectronics. It interfaces with platform controllers and firmware standards such as Unified Extensible Firmware Interface, Advanced Configuration and Power Interface, and buses like Serial Peripheral Interface and Low Pin Count bus. The software stack includes drivers and middleware provided by Microsoft Corporation for Windows 10, Linux Foundation for the Linux kernel, and distributions such as Ubuntu (operating system), Fedora (Linux), and Debian.

TPM enables secure boot, measured boot, key generation, key storage, attestation, and sealed storage used by services like BitLocker, LUKS, Google Titan, and enterprise identity frameworks from Okta, Ping Identity, and Microsoft Azure Active Directory. Cryptographic operations use algorithms standardized by National Institute of Standards and Technology, Institute of Electrical and Electronics Engineers, and accepted by vendors such as OpenSSL Project and GnuPG. TPM supports features used in virtualization stacks by VMware, Inc., Kubernetes, Red Hat, and Canonical (company). It also integrates with hardware roots of trust like Intel Boot Guard and management suites from Dell Technologies and Hewlett Packard Enterprise.

Major specification versions include TPM 1.1, TPM 1.2, and TPM 2.0 overseen by the Trusted Computing Group and referenced by National Institute of Standards and Technology publications. Implementations appear in discrete chips by Infineon Technologies, integrated firmware TPMs from Intel Corporation (fTPM) and AMD (PSP-based), and virtual TPMs provided by Microsoft Corporation (vTPM), QEMU, and VMware, Inc.. Interoperability work involves International Organization for Standardization and guidance from Internet Engineering Task Force working groups, and certification or compliance programs run by Trusted Computing Group and testing labs like Underwriters Laboratories.

While TPM provides hardware-backed protections adopted by National Institute of Standards and Technology and enterprise vendors such as Microsoft Corporation and Amazon Web Services, implementations have faced attacks reported by researchers at University of Cambridge, Cork Institute of Technology, and teams from Google Project Zero and Kaspersky Lab. Attack vectors include physical fault injection analyzed by Fraunhofer Society researchers, side-channel attacks studied by École Polytechnique Fédérale de Lausanne, and supply-chain concerns raised in hearings before the United States Congress and assessments by European Union Agency for Cybersecurity. Mitigations reference guidance from National Institute of Standards and Technology, firmware patches from Intel Corporation and AMD, and secure manufacturing practices endorsed by Trusted Computing Group.

TPM is used for full disk encryption with Microsoft BitLocker, Linux Unified Key Setup, and enterprise device management in ecosystems such as Microsoft Intune, VMware Workspace ONE, Jamf, and MobileIron. Cloud providers like Amazon Web Services, Microsoft Azure, and Google Cloud Platform use TPM-like attestation for confidential computing and hardware-backed keys, integrating with identity providers like Okta and Ping Identity. Use cases span corporate laptops from Dell Technologies, Lenovo, and HP Inc. to embedded devices from Siemens, Bosch, and ARM Holdings-based platforms, while regulatory frameworks from European Union and guidance from National Institute of Standards and Technology influence deployment strategies.

Category:Computer security hardware