Trusted Platform Module: Difference between revisions

Revision as of 06:16, 13 May 2025

Revision as of 01:59, 28 May 2025

Line 29:

Trusted Platform Module (TPM) was conceived by a [[computer industry]] consortium called [[Trusted Computing Group]] (TCG). It evolved into ''TPM Main Specification Version 1.2'' which was standardized by [[International Organization for Standardization]] (ISO) and [[International Electrotechnical Commission]] (IEC) in 2009 as ISO/IEC 11889:2009.<ref>{{cite web |url=http://www.iso.org/iso/catalogue_detail.htm?csnumber=50970 |title=ISO/IEC 11889-1:2009 – Information technology – Trusted Platform Module – Part 1: Overview |website=ISO.org |publisher=[[International Organization for Standardization]] |date=May 2009 |access-date=November 30, 2013 |archive-date=January 28, 2017 |archive-url=https://web.archive.org/web/20170128033043/http://www.iso.org/iso/catalogue_detail.htm?csnumber=50970 |url-status=live }}</ref> ''TPM Main Specification Version 1.2'' was finalized on 3 March 2011 completing its revision.<ref>{{Cite web|title=TPM 1.2 Main Specification|url=https://trustedcomputinggroup.org/resource/tpm-main-specification/|access-date=2021-11-08|website=Trusted Computing Group|language=en-US}}</ref><ref name="TPM_Main_Specs">{{Cite web | url = https://www.trustedcomputinggroup.org/tpm-main-specification/ | title = Trusted Platform Module (TPM) Specifications | publisher = [[Trusted Computing Group]] | date = March 1, 2011 | access-date = October 30, 2016 | archive-date = October 22, 2017 | archive-url = https://web.archive.org/web/20171022063836/https://trustedcomputinggroup.org/tpm-main-specification/ | url-status = live }}</ref>

On April 9ᵗʰ9, 2014, the [[Trusted Computing Group]] announced a major upgrade to their specification entitled ''TPM Library Specification 2.0''.<ref>{{Cite web|date=2014-04-01|title=Trusted Computing Group Releases TPM 2.0 Specification for Improved Platform and Device Security |url=https://trustedcomputinggroup.org/trusted-computing-group-releases-tpm-2-0-specification-improved-platform-device-security/ |access-date=2021-11-08 |publisher=Trusted Computing Group |language=en-US}}</ref> The group continues work on the standard incorporating errata, algorithmic additions and new commands, with its most recent edition published as 2.0 in November 2019.<ref name="TPM_Library_Specs">{{cite web |url=https://www.trustedcomputinggroup.org/tpm-library-specification/ |title=TPM Library Specification 2.0 |publisher=Trusted Computing Group |access-date=October 30, 2016 |archive-date=29 October 2016 |archive-url=https://web.archive.org/web/20161029235918/https://www.trustedcomputinggroup.org/tpm-library-specification/ |url-status=live }}</ref> This version became ISO/IEC 11889:2015.

When a new revision is released it is divided into multiple parts by the Trusted Computing Group. Each part consists of a document that makes up the whole of the new TPM specification.

Line 39:

=== Version differences ===

While TPM 2.0 addresses many of the same use cases and has similar features, the details are different. TPM 2.0 is not backward compatible with TPM 1.2.<ref>{{Citation |title=Trusted Platform Module Library |date=October 30, 2014 |access-date=October 27, 2016 |archive-url=https://web.archive.org/web/20161028083957/https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.16.pdf |archive-date=October 28, 2016 |url-status=live |chapter=Part 1: Architecture |chapter-url=https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.16.pdf |publisher=Trusted Computing Group}}</ref><ref>{{Cite web |title=TPM 1.2 vs. 2.0 Features &#124;{{pipe}} Dell US |url=https://www.dell.com/support/article/en-us/sln312590/tpm-1-2-vs-2-0-features?lang=en}}</ref><ref>{{Cite web |title=TPM 1.2, 2.0 and FTPM (Firmware-based TPM) Information |url=http://aps2.toshiba-tro.de/kb0/TSB8B03XO0000R01.htm |url-status=live |archive-url=https://web.archive.org/web/20200206234241/http://aps2.toshiba-tro.de/kb0/TSB8B03XO0000R01.htm |archive-date=February 6, 2020 |access-date=August 31, 2020}}</ref>

{| class="wikitable"

Line 157:

In 2015 [[Richard Stallman]] suggested to replace the term "Trusted computing" with the term "Treacherous computing" due to the danger that the computer can be made to systematically disobey its owner if the cryptographical keys are kept secret from them. He also considers that TPMs available for PCs in 2015 are not currently{{clarify timeframe|date=December 2022}} dangerous and that there is no reason '''not''' to include one in a computer or support it in software due to failed attempts from the industry to use that technology for [[Digital rights management|DRM]], but that the TPM2 released in 2022 is precisely the "[[Trusted Computing|treacherous computing]]" threat he had warned of.<ref>{{Cite web|title=Can You Trust Your Computer? - GNU Project - Free Software Foundation|url=https://www.gnu.org/philosophy/can-you-trust.en.html|access-date=2023-09-06|website=www.gnu.org}}</ref>

In August 2023, [[Linus Torvalds]], who was frustrated with AMD fTPM's stuttering bugs opined, "Let's just disable the stupid fTPM <code>hwrnd</code> thing." He said the CPU-based random number generation, <code>[[RDRAND|rdrand]]</code> was equally suitable, despite having its share of bugs. Writing for ''[[Neowin]]'', Sayan Sen quoted Torvalds' bitter comments and called him "a man with a strong opinion.".<ref>{{Cite news |last=Sen |first=Sayan |date=2024-10-23 |title=Linus Torvalds seems frustrated with AMD Ryzen fTPM bugs and issues, suggests disabling |url=https://www.neowin.net/news/linus-torvalds-seems-frustrated-with-amd-ryzen-ftpm-bugs-and-issues-suggests-disabling/ |access-date=2024-10-23 |work=Neowin}}</ref>

== Security issues ==

Line 191:

* [[Infineon]] provides both TPM chips and TPM software, which are delivered as [[Original equipment manufacturer|OEM]] versions with new computers as well as separately by Infineon for products with TPM technology which comply with TCG standards. For example, Infineon licensed TPM management software to Broadcom Corp. in 2004.<ref>{{cite web|url=https://www.heise.de/newsticker/meldung/Trusted-Platform-Module-TPM-im-LAN-Adapter-143777.html|title=Trusted Platform Module (TPM) im LAN-Adapter|date=March 12, 2005 |publisher=Heise Online|access-date=January 7, 2019|archive-date=January 7, 2019|archive-url=https://web.archive.org/web/20190107232935/https://www.heise.de/newsticker/meldung/Trusted-Platform-Module-TPM-im-LAN-Adapter-143777.html|url-status=live}}</ref>

* [[Microchip Technology|Microchip]] (formerly Atmel) manufactured TPM devices that it claims to be compliant to the Trusted Platform Module specification version 1.2 revision 116 and offered with several interfaces (LPC, SPI, and I2CI²C), modes (FIPS 140-2 certified and standard mode), temperature grades (commercial and industrial), and packages (TSSOP and QFN).<ref name="AtmelTPMFrontPage">{{cite web|url=http://www.atmel.com/products/security-ics/embedded/|title=Home – Microchip Technology|website=www.atmel.com|access-date=October 4, 2016|archive-date=October 5, 2016|archive-url=https://web.archive.org/web/20161005162507/http://www.atmel.com/products/security-ics/embedded/|url-status=dead}}</ref><ref>{{cite web|url=http://www.atmel.com/Images/Atmel-8965-TPM-Part-No-Selection-Guide-ApplicationNote.pdf|title=AN_8965 TPM Part Number Selection Guide – Application Notes – Microchip Technology Inc.|website=www.atmel.com|access-date=October 4, 2016|archive-date=October 5, 2016|archive-url=https://web.archive.org/web/20161005171009/http://www.atmel.com/Images/Atmel-8965-TPM-Part-No-Selection-Guide-ApplicationNote.pdf|url-status=dead}}</ref><ref>{{cite web |url=https://www.microchip.com/en-us/products/security/security-ics/tpm |title="Trusted Platform Module" |author=<!--Not stated--> |date= |website= |publisher=Microchip Technology |access-date=2024-02-14 |quote=}}</ref> Its TPMs support PCs and embedded devices.<ref name="AtmelTPMFrontPage"/> It also provides TPM development kits to support integration of its TPM devices into various embedded designs.<ref>{{cite web|url=http://www.atmel.com/products/security-ics/embedded/?tab=tools|title=Home – Microchip Technology|website=www.atmel.com|access-date=October 4, 2016|archive-date=October 5, 2016|archive-url=https://web.archive.org/web/20161005165740/http://www.atmel.com/products/security-ics/embedded/?tab=tools|url-status=dead}}</ref>

* [[Nuvoton]] Technology Corporation provides TPM devices for PC applications. Nuvoton also provides TPM devices for embedded systems and Internet of Things (IoT) applications via I2CI²C and SPI host interfaces. Nuvoton's TPM complies with [[Common Criteria]] (CC) with assurance level EAL 4 augmented with ALC_FLR.1, AVA_VAN.4 and ALC_DVS.2, [[FIPS 140-2]] level 2 with Physical Security and EMI/EMC level 3 and [[Trusted Computing Group]] Compliance requirements, all supported within a single device. TPMs produced by [[Winbond]] are now part of Nuvoton.<ref>{{cite web | url = https://www.nuvoton.com/products/cloud-computing/security/trusted-platform-module-tpm | title = Nuvoton TPM}}</ref>

* [[STMicroelectronics]] has provided TPMs for PC platforms and embedded systems since 2005. The product offering <ref>{{cite web | url = https://www.st.com/content/ccc/resource/sales_and_marketing/promotional_material/flyer/group0/62/f7/89/67/99/9a/40/45/STSAFE_TPM_Flyer/files/STSAFE-TPM-Flyer.pdf/jcr:content/translations/en.STSAFE-TPM-Flyer.pdf | title = STSAFE-TPM}}</ref> includes discrete devices with several interfaces supporting [[Serial Peripheral Interface]] (SPI) and [[I2C|I²²C]] and different qualification grades (consumer, industrial and automotive). The TPM products are [[Common Criteria]] (CC) certified EAL4+ augmented with ALC_FLR.1 and AVA_VAN.5, [[FIPS 140-2]] level 2 certified with physical security level 3 and also [[Trusted Computing Group]] (TCG) certified.

There are also hybrid types; for example, TPM can be integrated into an [[Ethernet]] controller, thus eliminating the need for a separate motherboard component.<ref>{{cite web | url = https://www.trustedcomputinggroup.org/files/temp/4B551C9F-1D09-3519-AD45C1F0B5D61714/TPM%20Overview.pdf | title = Replacing Vulnerable Software with Secure Hardware: The Trusted Platform Module (TPM) and How to Use It in the Enterprise | year = 2008 | access-date = June 7, 2014 | publisher = Trusted computing group | archive-date = July 14, 2014 | archive-url = https://web.archive.org/web/20140714233816/https://www.trustedcomputinggroup.org/files/temp/4B551C9F-1D09-3519-AD45C1F0B5D61714/TPM%20Overview.pdf | url-status = live }}</ref><ref>{{cite web | url = http://www.broadcom.com/products/Ethernet-Controllers-and-Adapters/Enterprise-Client-Controllers/BCM5752 | title = NetXtreme Gigabit Ethernet Controller with Integrated TPM1.2 for Desktops | date = May 6, 2009 | access-date = June 7, 2014 | publisher = Broadcom | archive-date = June 14, 2014 | archive-url = https://web.archive.org/web/20140614134124/http://www.broadcom.com/products/Ethernet-Controllers-and-Adapters/Enterprise-Client-Controllers/BCM5752 | url-status = live }}</ref>

Line 273:

|{{Yes}}

|{{Yes}}

|Maybe{{efn|There is an application note{{r|r={{Cite web|last=AG|first=Infineon Technologies|title=OPTIGA™OPTIGA TPM SLI 9670 A-TPM board - Infineon Technologies|url=https://www.infineon.com/cms/de/product/evaluation-boards/optiga-tpm-sli9670-a-tpm/|access-date=2020-11-20|website=www.infineon.com|archive-date=August 6, 2020|archive-url=https://web.archive.org/web/20200806175036/https://www.infineon.com/cms/de/product/evaluation-boards/optiga-tpm-sli9670-a-tpm/|url-status=live}}}} about an example project for the AURIX 32-bit SoC using the tpm2-tss library.}}

|-

|ibmtss<ref>{{Cite web|title=IBM TSS for TPM 2.0|url=https://sourceforge.net/projects/ibmtpm20tss|access-date=June 2, 2021|archive-date=June 29, 2021|archive-url=https://web.archive.org/web/20210629081044/https://sourceforge.net/projects/ibmtpm20tss/|url-status=live}}</ref><ref>{{Cite web|title = IBM TSS for TPM 2.0|website = [[GitHub]]|url = https://github.com/kgoldman/ibmtss|access-date = June 2, 2021|archive-date = June 29, 2021|archive-url = https://web.archive.org/web/20210629081026/https://github.com/kgoldman/ibmtss|url-status = live}}</ref>

Line 313:

{{noteslist}}

These TPM libraries are sometimes also called TPM stacks, because they provide the interface for the developer or user to interact with the TPM. As seen from the table, the TPM stacks abstract the operating system and transport layer, so the user could migrate one application between platforms. For example, by using TPM stack API the user would interact the same way with a TPM, regardless if the physical chip is connected over SPI, I2CI²C or LPC interface to the Host system.

== See also ==