TPM Software Stack (TSS)
TSS is TCG's standardized TPM software access layer, providing vendor-neutral APIs that let applications use TPM capabilities for keys, policies, secure storage, attestation, and platform integrity without depending on a specific TPM, OS, or hardware environment.
Core capabilities
What TSS delivers
A single, published interface through which software reaches every TPM capability.
Applications work the same way regardless of which vendor supplied the TPM.
The same application code runs across platforms without being rewritten for each one.
Applications built on TSS interoperate across the wider trusted computing ecosystem.
Developers write against the API rather than against low-level TPM commands.
Provides the software path that makes TPM-backed security features usable in practice.
[ 01 ]
A single, published interface through which software reaches every TPM capability.
Applications work the same way regardless of which vendor supplied the TPM.
The same application code runs across platforms without being rewritten for each one.
Applications built on TSS interoperate across the wider trusted computing ecosystem.
Developers write against the API rather than against low-level TPM commands.
Provides the software path that makes TPM-backed security features usable in practice.
Endpoint security and compliance software.
Enterprise enrollment and provisioning tools.
vTPM-enabled virtualization stacks.
Platform integrity and measured boot evidence collection.
Primary features
Key capabilities of the TSS specification
[ 01 ]
Standardized TSS APIs
[ 02 ]
Vendor-neutral software abstraction
[ 03 ]
TPM command access through software layers
[ 04 ]
Support for interoperable client applications
[ 05 ]
Hardware-independent application development
[ 06 ]
OS and environment abstraction
[ 07 ]
Foundation for TPM application ecosystems
Standardized TSS APIs
A published set of interfaces that every compliant implementation exposes identically.
Vendor-neutral software abstraction
No vendor-specific code paths, so software is not tied to a single TPM supplier.
TPM command access through software layers
Layered access from high-level convenience functions down to raw TPM commands.
Support for interoperable client applications
Client software built on TSS works across different platforms and TPM implementations.
Hardware-independent application development
Developers build without needing to know which TPM the target device carries.
OS and environment abstraction
The same API surface across operating systems and execution environments.
Foundation for TPM application ecosystems
Provides the common base on which third-party TPM-enabled software is built.
capability 01
Work Groups
Related TCG Work Groups that leverage TSS
TPM Software Stack (TSS)
Owns the TSS specifications and standard APIs for using TPM functions.
Trusted Platform Module (TPM)
Defines the TPM functions that TSS exposes to software.
PC Client
Uses TSS-relevant TPM access models for client platforms.
Infrastructure
Can use TSS in infrastructure, enrollment, and attestation workflows.
Attestation
Can rely on TSS as a software access path for TPM-based evidence, quotes, keys, and platform measurements.
Virtualized Platform
Can use TSS concepts for vTPM access and virtualized TPM workflows.
Other Work Groups
Server, Mobile, Network Equipment, IoT, Vehicle Services, Storage, Data Center, and CyRes Work Groups can use TSS wherever software needs standardized access to TPM capabilities.
Reference sources
Explore the TSS documentation
Reference sources
Explore the TSS documentation
Explore other Technologies
Trusted Platform Module (TPM)
TCG's standardized hardware Root of Trust for protecting keys, recording platform measurements and supporting attestation across every class of device.
Block Integrated Trust (BIT)
TCG's component-level hardware Root of Trust for constrained devices, giving integrated components their own identity and attestation.
Storage Security
TCG's architecture for interoperable security on trusted storage devices: self-encrypting drives, access control, locking and Opal, Ruby and Opalite classes.
Explore other Technologies
Trusted Platform Module (TPM)
TCG's standardized hardware Root of Trust for protecting keys, recording platform measurements and supporting attestation across every class of device.
Block Integrated Trust (BIT)
TCG's component-level hardware Root of Trust for constrained devices, giving integrated components their own identity and attestation.
Storage Security
TCG's architecture for interoperable security on trusted storage devices: self-encrypting drives, access control, locking and Opal, Ruby and Opalite classes.
Become part of TCG
Membership is open to corporations, start‑ups, government, academia, and non‑profits. Join to influence specs in Work Groups, access drafts, network with experts, and submit products for TCG Certification.