Virtual TPM (vTPM)

A vTPM extends the concept of measured boot into the virtual layer. It cryptographically hashes each component of the VM's boot sequence—firmware, bootloader, OS kernel—and stores the measurements in Platform Configuration Registers (PCRs). This creates an immutable, verifiable log of the boot state. A remote attestation service can then query these PCR values to confirm the VM booted into a known-good, untampered state before releasing secrets or granting network access.

The vTPM acts as a secure key store isolated from the guest OS. It can generate, store, and manage asymmetric key pairs where the private key is non-exportable. Key operations include:

• Key Generation: RSA and ECC key creation within the TPM boundary
• Key Attestation: Proving a key resides in a genuine TPM without exposing it
• Sealing: Binding data to specific PCR states, ensuring secrets are only released when the VM is in a trusted configuration This prevents attackers from extracting keys even with full root access to the VM.

vTPMs can be implemented in two distinct architectures:

• Software vTPM: Emulated entirely in the hypervisor or a dedicated VM. Provides full TPM 2.0 functionality but lacks a physical root of trust. Suitable for development and non-compliance workloads.
• Hardware-Backed vTPM: Leverages a physical TPM on the host or a processor TEE like Intel SGX or AMD SEV to anchor the vTPM's trust chain. The vTPM's state is encrypted and integrity-protected by the hardware root, making it resistant to hypervisor compromise.

A critical design challenge for vTPMs is maintaining trust across live migrations. The vTPM's internal state—including keys, PCR values, and monotonic counters—must be securely transferred with the VM. Solutions include:

• vTPM State Encryption: The entire vTPM state is encrypted with a migration key known only to the source and destination platforms
• Attested Migration: The destination platform attests its identity and integrity before receiving the vTPM state
• Sealed Migration Blobs: The vTPM state is sealed to the destination's TPM identity, preventing interception

vTPMs are a foundational component of Confidential VMs. When combined with hardware TEEs like AMD SEV-SNP or Intel TDX, the vTPM provides the attestation vector that proves the VM is running inside a genuine, hardware-protected environment. The workflow:

1. The hardware TEE encrypts VM memory and generates a launch attestation report
2. The vTPM measures the boot chain and extends PCRs
3. A combined attestation verifies both the hardware TEE integrity and the guest OS state This dual-layer attestation is essential for Confidential AI workloads processing regulated data.

A vTPM must implement the full TCG TPM 2.0 Library Specification to be interoperable with standard tools and APIs. Key command categories include:

• Startup and Self-Test: Initialization and health verification
• Session Management: Encrypted and salted command sessions to prevent replay attacks
• Hierarchy Management: Platform, Storage, and Endorsement hierarchies for key isolation
• Dictionary Attack Protection: Lockout mechanisms that prevent brute-force attacks on TPM authorization values Compliance ensures that software like LUKS, BitLocker, and tpm2-tools function identically with vTPMs as with physical TPMs.