TPM Software Stack (TSS)

Mission

The mission of the Trusted Computing Group's (TCG) TPM Software Stack (TSS) workgroup is to provide a standard set of APIs that allows software developers to easily access and utilize the Trusted Platform Module (TPM).

The Work Group's primary objectives include:

• Vendor-Neutrality: Producing specifications that abstract underlying hardware differences, allowing applications to function seamlessly regardless of the hardware, operating system, or environment.
• Simplified Integration: Providing a straightforward software interface for TPMs to encourage the development of tamper-resistant computing applications.
• Local & Remote Access: Enabling applications to communicate with TPMs, whether the chip is located on the local machine or accessed remotely over a network.

What the group does

The Work Group's specifications abstract hardware differences, enabling developers to build secure, interoperable software regardless of the operating system or environment.

Specifically, the Work Group defines several layers of software to streamline TPM access:

• System API (SAPI) / Enhanced System API (ESAPI): Translates complex, raw TPM commands into easier-to-use C functions.
• Feature API (FAPI): The highest-level layer designed to drastically reduce programming complexity for common TPM operations like key generation, sealing, and encryption.
• Access Broker and Resource Manager (TAB/RM): Coordinates access to the physical TPM, allowing multiple applications to securely share the hardware without conflicts.
• Transmission Interface (TCTI): Provides the specific communication protocols (e.g., for local, remote, or simulator instances) between the software stack and the TPM.

Why it matters

The TCG TPM Software Stack (TSS) Work Group defines the standardized middleware and APIs that allow applications to seamlessly interact with a Trusted Platform Module (TPM). It eliminates hardware lock-in and drastically simplifies development, making robust, hardware-rooted security accessible to standard software. Historically, writing software that utilized hardware security was complex and required deep, vendor-specific expertise. For developers and end-users alike, the TSS is the bridge that allows everyday software to take advantage of advanced security.

Who participates

TPM providers, device and platform implementors.

Key deliverables

• Feature API (FAPI): The highest abstraction layer. It simplifies programming by managing TPM contexts, sessions, and keys for high-performance systems, virtualization, and enterprise applications.
• Standardized JSON Mapping: Converts native, complex TPM 2.0 binary data types (such as TPM2B byte buffers, TPML lists, and TPMS structures) into straightforward JavaScript Object Notation (JSON) equivalents.
• Declarative Policy Language: Replaces the need for developers to manually program multi-step cryptographic calculations and TPM2_Policy* commands. Instead, they write a simple, declarative JSON file to outline conditions.
• Enhanced System API (ESAPI): Adds cryptographic data protection directly into the stack to secure the data stream from software to the TPM, helping to stop side-channel and hardware probing attacks.
• System API (SAPI): Provides direct access to the full command set of the TPM, handling the marshaling and unmarshaling of parameters while remaining lightweight enough for resource-constrained IoT environments.
• TPM Command Transmission Interface (TCTI): The foundational layer that abstracts the physical connection to the TPM. It allows applications to switch between communication methods (e.g., local hardware, firmware TPM, simulator, or virtual TPM) at runtime.
• Access Broker (TAB): Manages concurrent access to the TPM so multiple applications can utilize hardware security functions simultaneously without stepping on each other.
• Resource Manager (RM): Manages volatile memory inside the TPM. It temporarily evicts contexts to system memory and loads them back on demand when needed by the CPU.

Technology the group develops

The TCG TPM Software Stack (TSS) acts as a universal API, allowing developers to communicate with diverse, vendor-specific security hardware through a standardized interface rather than custom code. By removing the need to write custom drivers for every different hardware chip, this abstraction layer enables widespread TPM usage throughout the industry.

It standardizes how security is implemented, allowing software vendors, device manufacturers, and cloud providers to integrate hardware-rooted security into their products at scale. Ultimately, this ensures that software remains portable and interoperable across different hardware platforms, while allowing industries to securely store keys and verify system integrity within the TPM.