A laptop or server may include a small security component that stores secrets and performs cryptographic operations without running arbitrary applications. TPM 2.0 is the standard defining the interface and behavior for compatible Trusted Platform Modules; it is not itself a particular chip. section 13.2.4
A TPM-compliant implementation typically provides:
- A hardware random number generator. section 13.2.4
- Secure memory for storing secrets. section 13.2.4
- Cryptographic operations performed by a tamper-resistant secure microcontroller. section 13.2.4
- A well-defined interface that motherboard components and applications running on the operating system can call. section 13.2.4
Unlike a smart card or general secure element, a TPM does not run arbitrary code. It offers standardized services to a larger system, making it a practical alternative for personal and enterprise computers. section 13.2.4 section 13.5
A motherboard-mounted security component
A TPM may be soldered to or plugged into a laptop, desktop, or enterprise-server motherboard. The placement is convenient and the component is usually inexpensive, but an exposed processor-to-TPM bus can be intercepted by an attacker with temporary physical access. This makes TPMs especially useful for defending against software attacks, rather than every physical attack. section 13.2.4
Figure 13.3 A chip implementing the TPM 2.0 standard, plugged into a motherboard. This chip can be called by the system’s motherboard components as well as user applications running on the computer’s OS. Photo from Wikipedia (http://mng.bz/Q2je).
Shows a chip implementing TPM 2.0 plugged into a motherboard and reachable by system components and operating-system applications. section 13.2.4
