A Trusted Platform Module (TPM) is a standardized secure microcontroller for personal and enterprise computers. It provides protected memory for secrets, a hardware random number generator, cryptographic operations, and tamper resistance through a defined interface rather than arbitrary application code. section 13.2.4
A TPM is useful because it:
- Stores secrets in secure memory and performs cryptographic operations. section 13.2.4
- Offers an interface that operating systems and user applications can use. section 13.2.4 section 13.3
- Fits directly into laptops, desktops, and enterprise-server motherboards, often at commodity cost. section 13.2.4
A laptop with a TPM
A laptop can use its motherboard-mounted TPM as a hardware cryptography component instead of implementing a custom secure-element application. The arrangement is standardized, but the communication path between the TPM and processor is usually an interceptable bus, so protection is aimed mostly at software attacks rather than every physical attack. section 13.2.4
Figure 13.3 A chip implementing the TPM 2.0 standard, plugged into a motherboard. This chip can be called by the system’s motherboard components as well as user applications running on the computer’s OS. Photo from Wikipedia (http://mng.bz/Q2je).
Use the motherboard figure to see where a TPM sits and how motherboard components and operating-system applications can call it. section 13.2.4
Figure 13.4 The different hardware solutions you learned in this chapter and an idea of what they look like.
Use the hardware-solutions comparison to distinguish TPMs from smart cards, secure elements, HSMs, security processors, and TEEs. section 13.3
