Trusted Platform Module (TPM)

The TPM contains a true random number generator (TRNG) to create high-entropy asymmetric key pairs directly on the chip. Private keys are sealed within the TPM's shielded location and are never exposed to the system bus, memory, or hard drive. All cryptographic operations using these keys occur inside the TPM's boundary, preventing exfiltration by malware. This capability is the foundation for hardware-backed keystores and offline token generation, ensuring identity credentials cannot be cloned in software.

The TPM enforces a measured boot process by acting as a tamper-proof repository for integrity measurements. Before executing any component of the boot chain, the firmware hashes the next component and extends the hash into a Platform Configuration Register (PCR). This creates an immutable, verifiable log of the exact software state. Any modification to the bootloader or OS kernel results in a different PCR value, allowing for remote attestation to detect rootkits or bootkits before secrets are released.

The TPM can encrypt data and bind it to a specific platform configuration. Using the TPM2_Seal operation, data is encrypted not just with a key, but with a policy that specifies the exact PCR values required for decryption. If the platform state has changed—indicating a compromise or unauthorized software—the TPM will refuse to unseal the data. This is critical for BitLocker Drive Encryption and protecting secrets in air-gapped model deployment scenarios where physical access is the primary threat vector.

The TPM can produce a signed quote of its current PCR values using an Attestation Identity Key (AIK). A remote verifier can cryptographically validate this quote to confirm the exact software stack running on the machine. This enables Zero Trust Architecture (ZTA) principles by proving a node is healthy before allowing it to join a secure cluster or receive sensitive data. In confidential computing enclaves, this is the mechanism that proves the enclave is running the correct, unmodified code.

PCRs are the TPM's volatile memory slots that store integrity measurements. They cannot be written to arbitrarily; they are updated exclusively through a cryptographic extend operation: New_PCR = Hash(Old_PCR || New_Hash). This chaining mechanism ensures that the order of events is preserved and that no measurement can be deleted without resetting the platform. PCRs are the core mechanism enabling supply chain integrity verification, as they record every firmware and software component loaded from power-on.

The TPM enforces hardware-level authorization logic that resists brute-force attacks. It implements dictionary attack protection by exponentially increasing the lockout time after repeated failed authorization attempts, a defense impossible to bypass via software manipulation. Furthermore, keys can be created with specific usage constraints, such as requiring a physical presence confirmation or limiting the number of times a key can be used, providing robust defense against automated malware.

A process where each component of the boot chain cryptographically measures the next component before loading it, storing the resulting hashes in the TPM's Platform Configuration Registers (PCRs). This creates an immutable, verifiable log of the exact software state.

• Core Platform Root of Trust for Measurement (CRTM) is the first immutable piece of code executed
• Each stage (UEFI firmware → bootloader → OS kernel) extends a PCR with its hash
• PCR values cannot be erased or overwritten; they can only be extended via cryptographic hash chaining
• Enables remote attestation where a verifying party can cryptographically confirm the boot state
• Critical for detecting bootkits and firmware-level implants in air-gapped systems

A mechanism that allows a verifying party to cryptographically confirm the exact software stack and configuration running on a remote machine. The TPM signs a quote containing the current PCR values with its Attestation Identity Key (AIK), proving the system's integrity.

• Challenge-Response Protocol: Verifier sends a nonce; attester returns TPM-signed PCR quote + nonce
• Prevents replay attacks by including the fresh nonce in the signed response
• Used in air-gapped clusters to verify nodes haven't been compromised before joining the mesh
• Enables sealed storage: TPM only releases encryption keys if PCR values match a known-good state
• Foundation for Zero Trust Architecture in disconnected environments—trust is continuously verified, never assumed

The end-to-end verification that hardware components, firmware, and software artifacts have not been maliciously altered during manufacturing, transit, or storage. TPMs anchor this verification by providing a hardware-based immutable identity that can be traced to the silicon foundry.

• Platform Certificate: A signed document from the manufacturer binding the TPM's Endorsement Key to the device serial number
• Enables verification that a server's motherboard hasn't been intercepted and implanted with rogue chips
• Bill of Materials (BOM) Verification checks every software dependency against known vulnerability databases
• Critical for defense contractors receiving hardware that transits through untrusted logistics chains
• Combined with tamper-evident packaging and photographic documentation of shipping configurations

A secure storage mechanism where cryptographic keys are generated and stored within a tamper-resistant hardware module, ensuring they are never exposed in plaintext to the host operating system memory. The TPM provides a limited form of this with its shielded locations.

• TPM Key Hierarchy: Endorsement Key (EK) → Storage Root Key (SRK) → Application Keys
• Private keys are wrapped (encrypted) by the parent key and can only be unwrapped inside the TPM
• Prevents cold boot attacks and memory scraping malware from extracting keys
• Used to protect model weight signing keys in air-gapped deployment pipelines
• Contrast with HSM-backed keystores which offer higher throughput for bulk signing operations
• Android's StrongBox and Apple's Secure Enclave are consumer-grade implementations of this concept

A root certificate authority that is kept powered down and physically secured, only brought online in a controlled environment to issue or revoke subordinate certificates. The root CA's private key is often protected by a TPM or HSM in a safe.

• Two-Tier PKI Hierarchy: Offline root CA signs intermediate CAs; only intermediates issue end-entity certificates
• Root CA is air-gapped by design—requires physical access and multi-person integrity ceremonies
• Key Signing Ceremony: A rigorously audited process with multiple trusted administrators present
• Used to establish the internal PKI for air-gapped Kubernetes clusters and mTLS service meshes
• If the root CA is compromised, the entire trust fabric of the disconnected environment collapses