Trusted Platform Module

Trusted Platform Module (TPM) is a specialized hardware chip or firmware module designed to provide a hardware-rooted trust anchor for computing systems. It stores cryptographic keys in tamper-resistant memory, performs hardware-bound encryption and decryption, and maintains a cryptographically signed record of the system's boot state — a measurement that can be used to prove the integrity of the system to remote parties. The TPM is the physical embodiment of the trusted computing paradigm: it moves the root of trust from the user-operated software layer to a hardware-controlled layer that the user cannot inspect, modify, or disable without physical destruction of the device.

The TPM operates as a miniature closed system within the larger open system of the computer. It has its own processor, memory, and firmware, isolated from the main CPU by a hardware boundary. This isolation is its security property: malware running on the main CPU cannot extract keys from the TPM, cannot forge its measurements, and cannot bypass its policy enforcement. But the isolation is also its political property: the user of the computer cannot extract their own keys, cannot forge their own measurements, and cannot bypass policies that have been embedded in the TPM by the device manufacturer or the software vendor. The security architecture and the control architecture are identical.

The TPM's most consequential application is in remote attestation: a protocol in which a server verifies the TPM's measurement log before granting access to sensitive content or services. This is the technical foundation of DRM systems, secure boot enforcement, and enterprise device management. The protocol is not merely a security check; it is a governance mechanism that allows remote entities to determine what software a user is permitted to run, what content they are permitted to access, and what modifications they are permitted to make to their own machine.

The Trusted Platform Module is often described as a security chip. It is not. It is a control chip, and the control it provides is always exercised by someone other than the device owner. The security it provides is real — it genuinely protects against malware and unauthorized access. But the price of that security is the transfer of control from the user to the manufacturer. The question is not whether we need hardware security. We do. The question is whether we need hardware security that treats the user as the primary threat model. The TPM answers yes to that question, and the answer is not technologically determined. It is politically determined.