M.: Tcg inside?: a note on tpm specification compliance

The Trusted Computing Group (TCG) has addressed a new generation of computing platforms employing both supplemental hardware and software with the primary goal to improve the security and the trust-worthiness of future IT systems. The core compo-nent of the TCG proposal is the Trusted Platform Module (TPM) providing certain cryptographic func-tions. Many vendors currently equip their platforms with a TPM claiming to be TCG compliant. How-ever, there is no feasible way for application devel-opers and users of TPM-enabled systems to verify this compliance. In practice, manufacturers may ex-ploit the flexibility that the specification itself pro-vides, or they may deviate from it by inappropri-ate design that might lead to security vulnerabilities. Hence, it is crucial to have an independent means for testing the compliance as well as analyzing the security of different TPMs. In this paper, we aim at making the first steps towards fulfilling this re-quirement: We have developed a test strategy as well as a prototype test suite for TPM compliance test-ing. Although our test does not cover the complete TCG specification, our test results show that many TPM implementations do not meet the TCG spec-ification and have bugs. Moreover, we discuss that non-compliance may have crucial impact on security, and point out the corresponding security problems in case of a widespread TPM.