The Trusted Computing Group (TCG) and DMTF have combined their security technologies in an open-source implementation that allows devices to use Trusted Platform Modules (TPMs) for hardware-backed authentication and attestation.
DMTF has added a TPM backend to libspdm, its open-source implementation of the Security Protocol and Data Model (SPDM) specification. The integration enables SPDM implementations to use TPM-protected keys and platform measurements when authenticating components and establishing secure communications.
SPDM provides a standardised framework for authenticating devices and components, reporting measurements, performing attestation and exchanging cryptographic keys. It is designed to establish trust between components before they communicate securely.
The TPM integration allows private-key operations to be performed inside the TPM without exposing the underlying private key to the host system. It also provides a mechanism for SPDM implementations to use measurements stored in a platform’s TPM when establishing trust.
DMTF’s documentation identifies four initial applications for the integration: retrieving SPDM certificate chains from TPM non-volatile storage, signing SPDM challenge responses using TPM-resident private keys, providing measurement data derived from TPM Platform Configuration Registers (PCRs), and performing signing operations during SPDM key exchange.
The organisations said the work could help developers build interoperable security implementations combining a protocol-level root of trust with hardware-backed security.
Developers can also test the integration without dedicated TPM hardware. DMTF’s spdm-emu reference environment uses swtpm, a software TPM that allows TPM-backed SPDM workflows to be developed and validated in an emulated environment.
The work follows a formal cooperation between TCG and DMTF established in 2021 to improve alignment between SPDM and TCG technologies.
“By bringing the two technologies together in accessible reference code, we can help implementers understand how perfectly they complement one another,” said Joe Pennisi, President of TCG.
Jeff Hilland, President of DMTF, said the open-source implementation would allow developers to explore and validate interoperable SPDM security solutions using TPMs.
TCG says its technologies are incorporated into more than one billion devices.
