Trusted Platform Module (TPM)
TPM is TCG's standardized hardware Root of Trust for protecting keys, recording platform measurements, supporting attestation, and enabling device identity, measured boot, secure storage, and platform integrity decisions across client, server, embedded, mobile, virtualized, and infrastructure environments.
Core capabilities
What the TPM delivers
A tamper-resistant chip that anchors trust in silicon, independent of the operating system.
Keys are created and stored inside the TPM, never exposed to software or memory.
Platform Configuration Registers record integrity measurements that cannot be altered or rolled back.
Each boot component is measured before execution, producing a verifiable record of the boot sequence.
The TPM signs platform measurements so a verifier can confirm the device is in a known state.
Unique cryptographic identities bound to the hardware, resistant to cloning and extraction.
Data is released only when the platform matches a defined state or policy condition.
Cryptographic operations run inside dedicated hardware rather than in software.
Profiles set expected TPM behavior for PCs, servers, mobile, and embedded platforms.
[ 01 ]
A tamper-resistant chip that anchors trust in silicon, independent of the operating system.
Keys are created and stored inside the TPM, never exposed to software or memory.
Platform Configuration Registers record integrity measurements that cannot be altered or rolled back.
Each boot component is measured before execution, producing a verifiable record of the boot sequence.
The TPM signs platform measurements so a verifier can confirm the device is in a known state.
Unique cryptographic identities bound to the hardware, resistant to cloning and extraction.
Data is released only when the platform matches a defined state or policy condition.
Cryptographic operations run inside dedicated hardware rather than in software.
Profiles set expected TPM behavior for PCs, servers, mobile, and embedded platforms.
Measured boot and firmware integrity verification.
Key protection for disk encryption.
Enterprise endpoint health and compliance checks.
Secure credential storage.
Remote attestation for fleet, cloud, edge, and infrastructure systems.
Secure Boot policy reinforcement and boot-state reporting.
Primary features
Key capabilities of the TPM 2.0 specification
[ 01 ]
Standardized TPM 2.0 command and data model
[ 02 ]
Algorithm agility compared with TPM 1.2
[ 03 ]
Protected nonvolatile storage
[ 04 ]
PCR-based measurement model
[ 05 ]
Endorsement Key (EK) and attestation key support
[ 06 ]
Policy-based authorization
[ 07 ]
Standard software access through TSS
[ 08 ]
Firmware and OS integration
Standardized TPM 2.0 command and data model
A single command set and data structure that every compliant TPM implements identically.
Algorithm agility compared with TPM 1.2
Support for multiple cryptographic algorithms, so implementations can evolve without a new chip generation.
Protected nonvolatile storage
On-chip storage that retains keys and data across power cycles, isolated from the host.
PCR-based measurement model
A standard way to record and extend integrity measurements that cannot be reversed.
Endorsement Key (EK) and attestation key support
Factory-provisioned identities that prove a TPM is genuine and enable trusted attestation.
Policy-based authorization
Access conditions expressed as policies rather than fixed passwords, allowing flexible control.
Standard software access through TSS
A vendor-neutral API layer so applications work across TPM implementations.
Firmware and OS integration
Defined integration points with UEFI, bootloaders, and operating systems.
capability 01
work groups
Related TCG Work Groups that leverage TPM
Trusted Platform Module (TPM)
Owns the TPM architecture, structures, commands, and core TPM Library Specification.
PC Client
Defines TPM behavior and integration requirements for client endpoint platforms.
TPM Software Stack (TSS)
Defines standard software APIs for applications and services that use TPM functions.
Attestation
Aligns attestation terminology, architecture, references, and guidance across TCG work groups.
Infrastructure
Supports adoption and integration of trusted platform capabilities into Internet and enterprise infrastructure.
Virtualized Platform
Addresses TPM and vTPM usage in virtualized systems.
Other Work Groups
Server, Mobile, Network Equipment, IoT, Vehicle Services, Storage, and CyRes Work Groups use TPM-related trusted computing primitives where applicable for identity, measurement, attestation, secure storage, provisioning, and resilience.
Reference sources
Explore the TPM documentation
Trusted Platform Module
The Work Group that owns the TPM architecture and maintains the core TPM Library Specification.
View moreTPM Library Specification
The core specification defining TPM commands, structures, and behavior across all implementations.
View morePC Client Platform TPM Profile (PTP) Specification
Defines how the TPM is integrated and behaves specifically on client endpoint platforms.
View moreReference sources
Explore the TPM documentation
Explore other Technologies
Block Integrated Trust (BIT)
TCG's component-level hardware Root of Trust for constrained devices, giving integrated components their own identity and attestation.
Storage Security
TCG's architecture for interoperable security on trusted storage devices: self-encrypting drives, access control, locking and Opal, Ruby and Opalite classes.
Cyber Resilient Technologies (CyRes)
TCG's cyber-resilience technology for protecting persistent code, detecting unexpected states and recovering platforms to a known trusted state.
Explore other Technologies
Block Integrated Trust (BIT)
TCG's component-level hardware Root of Trust for constrained devices, giving integrated components their own identity and attestation.
Storage Security
TCG's architecture for interoperable security on trusted storage devices: self-encrypting drives, access control, locking and Opal, Ruby and Opalite classes.
Cyber Resilient Technologies (CyRes)
TCG's cyber-resilience technology for protecting persistent code, detecting unexpected states and recovering platforms to a known trusted state.
Become part of TCG
Membership is open to corporations, start‑ups, government, academia, and non‑profits. Join to influence specs in Work Groups, access drafts, network with experts, and submit products for TCG Certification.