Trusted Computing Group

With some 200 million+ Trusted Platform Modules (TPMs) deployed, TCG often gets asked about certification. Many standards groups provide certification programs because certification often is an important checklist item on RFPs and other purchasing tools. TCG has spent a lot of time looking at certification, because it is a complex issue. It is challenging for TCG because of our wide scope, from specifications for chips to those for infrastructure in the enterprise.  A particular challenge was that TCG specifications define so-called roots of trust, such as the TPM, where confidence in the security of an implementation is central to its value proposition.

TCG is delighted to announce that it is putting in place a formal TCG Certification Program for TPM. TCG will publish a certified products list on the TCG website, providing a reference for customers to help ensure security and correctness of TPM implementations. Based on feedback from our membership, TCG believes that the certification "seal of approval" will also help companies market their products, since many buyers look for some type of certification when evaluating vendors.

The program is initially open to TCG member products only.  The TPM certification program in particular will allow members to do the compliance functional testing themselves, using TCG provided test suites, and submit the results of those test suites to the TCG.  On the other hand, TPM security evaluation will require the use of a Common Criteria Lab for the product to be certified against a protection profile published by the TCG. TCG also recognizes that many organisations use TCG specifications who are not yet TCG members. Therefore TCG is considering how to work with non-members to certify their products, should there be sufficient interest. TCG will keep you posted on that important issue.

Looking beyond TPMs, the TCG is planning a certification program which will be launched in the fall of 2009 for a set of Trusted Network Connect specifications.  

TCG will list certified products on its website and will help promote these products through its marketing activities. Look for more information on this new program in coming months here and at our website,  http://www.trustedcomputinggroup.org/certification.