Trusted Platform Module (TPM)

The TPM's Root of Trust for Measurement (RTM) creates a cryptographic hash chain during the boot process. Each component—from the BIOS/UEFI firmware to the bootloader and operating system kernel—is measured (hashed) before execution. These measurements are stored in the TPM's Platform Configuration Registers (PCRs). This creates a verifiable log of the system's state, enabling technologies like Secure Boot to detect unauthorized modifications by comparing current PCR values against known-good baselines.

The TPM contains a true hardware random number generator (HRNG) for creating cryptographically strong keys. It can generate and store RSA and ECC asymmetric keys and symmetric keys (e.g., for AES). Crucially, private keys never leave the TPM's protected storage. Keys can be marked as non-migratable, binding them permanently to the specific hardware. This enables features like BitLocker or dm-crypt disk encryption, where the volume encryption key is sealed by the TPM and only released if the platform integrity is verified.

This allows a remote party (e.g., a corporate server or cloud service) to cryptographically verify the software state of a client machine. The TPM uses its Attestation Identity Key (AIK), a special endorsement key, to sign the current PCR values. The verifier receives this signed report and can check it against a Trusted Policy to ensure the device is running authorized, unmodified software before granting network access or releasing sensitive data. This is a cornerstone for Zero Trust architectures and secure cloud provisioning.

The TPM provides a stronger alternative to password-only authentication. It can be used to:

• Bind system login credentials (Windows Hello for Business) to the TPM.
• Act as a virtual smart card for network authentication.
• Store certificates for machine identity in enterprise environments. Authentication relies on proving possession of a key stored inside the TPM, which is resistant to phishing and keylogging attacks. The TPM 2.0 standard also supports Policy-Based Authorization, where key usage can require multiple factors (e.g., a password AND a specific system state).

The TPM includes dedicated circuits to perform cryptographic functions internally, shielding sensitive operations from the main CPU and its potentially compromised software. Core operations include:

• RSA Sign/Decrypt: Using internally stored keys.
• ECC Signatures: (TPM 2.0) for more efficient cryptography.
• HMAC (Hash-based Message Authentication Code): For data integrity.
• Key Wrapping: Encrypting keys for external storage.
• True Random Number Generation: For session keys and nonces. By performing these operations in hardware, the TPM protects against software-based side-channel attacks.

TPM keys are organized in a strict hierarchy, providing isolation and clear provenance:

1. Endorsement Key (EK): A unique RSA key fused into the TPM at manufacture. It identifies the TPM hardware and is used to create AIKs.
2. Storage Root Key (SRK): The root of the user-generated key hierarchy, protected by the TPM owner's authorization.
3. Attestation Identity Keys (AIKs): Derived from the EK, used for privacy-preserving remote attestation.
4. Leaf Keys: User-created keys (signing, encryption, storage) generated under the SRK. This tree structure ensures that compromising a leaf key does not compromise keys higher in the hierarchy.

Secure Boot is a security standard that ensures a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM). It relies on a chain of trust anchored in hardware, often starting with keys stored in a TPM or firmware.

• Boot Process: Each stage of the bootloader (firmware, OS loader) is cryptographically verified before execution.
• TPM Role: The TPM can measure and store hashes of each boot component in its Platform Configuration Registers (PCRs) for remote attestation.
• Critical Function: Prevents rootkits and other low-level malware from persisting by blocking unauthorized or tampered boot code.

Remote Attestation is a process where a trusted platform (client) provides cryptographically verifiable evidence of its software and hardware state to a remote verifier (server). This proof is rooted in a hardware trust anchor like a TPM.

• Mechanism: The TPM signs a quote of its Platform Configuration Register (PCR) values, which represent measured components (BIOS, bootloader, OS).
• Verification: The remote party verifies the TPM's signature and compares the PCR values against known-good baselines.
• Application: Critical for zero-trust architectures, enabling a server to grant access only to clients that prove they are in a known-secure state.

Platform Configuration Registers (PCRs) are special memory locations within a TPM used to store cryptographically hashed measurements of the platform's state. They are fundamental to the TPM's integrity measurement and reporting capabilities.

• Immutable Logging: PCRs do not store normal data; they extend it. Extending a PCR means: PCR[new] = Hash(PCR[old] + new measurement).
• Integrity Evidence: This creates a tamper-evident record of all measured components (e.g., firmware, OS kernel).
• Core Use: PCR values are used in Secure Boot validation and are the basis for Remote Attestation quotes. They are also used to "seal" encryption keys to a specific system state.

A Root of Trust is an inherently trusted component within a computing system from which the trustworthiness of all other components is derived. In a system with a TPM, the TPM chip itself, and specifically its Endorsement Key (EK), serves as a critical root of trust.

• Types: Includes Root of Trust for Measurement (RTM), Storage (RTS), and Reporting (RTR).
• TPM as Anchor: The TPM's unique, factory-installed cryptographic keys provide a verifiable identity and a secure location for cryptographic operations.
• Chain of Trust: Secure Boot builds a chain of trust from this root (the TPM/firmware) up through the operating system, with each step verifying the next.