A Trusted Platform Module (TPM) is a dedicated security chip or firmware component that securely generates and stores cryptographic keys and records measurements of the boot process.
How a TPM works
The TPM is specified by the Trusted Computing Group and standardised as ISO/IEC 11889. It exists as a separate chip on the motherboard, as firmware running in the processor’s secure environment (fTPM, Intel PTT) or integrated into the CPU, such as Microsoft Pluton. Its main functions are:
- Key protection – keys are created inside the TPM and the private parts never leave it in plain form.
- Measured boot – UEFI firmware, bootloader and kernel are hashed into Platform Configuration Registers (PCRs).
- Sealing – a secret is released only if the PCRs show the expected, untampered boot chain.
- Attestation – the device can prove its boot state to a remote server.
- a hardware random number generator and protection against PIN guessing.
Why the TPM matters
The TPM anchors many security features: BitLocker full disk encryption stores its key in it, Windows Hello protects credentials with it, and companies use it for device health checks. Microsoft made TPM 2.0 a requirement for Windows 11. Because it measures early boot code, it helps detect bootkits and firmware tampering.
The TPM is not invulnerable. The ROCA flaw (2017) in Infineon’s RSA key generation produced keys that could be factored, TPM-Fail (2019) recovered keys through timing side channels, and researchers have repeatedly sniffed BitLocker keys from the bus between a discrete TPM and the CPU on laptops configured without a pre-boot PIN.
Best practices
- Keep TPM firmware updated along with BIOS/UEFI.
- For sensitive laptops, combine the TPM with a pre-boot PIN.
- Use attestation in device compliance policies.
