TPM and TPM 2.0

In short: The TPM (Trusted Platform Module) is a security chip (or a firmware function of the CPU) that keeps cryptographic keys safe and can measure the integrity of system startup. TPM 2.0 is the current version and mandatory for Windows 11.

In more detail: The TPM is a small sealed-off computer for secrets. Keys are created in it and never leave the chip. The chip performs computations with them (sign, decrypt) but never hands out the key itself.

In Depth

What a TPM can do:

• Create and store keys, protected against reading out and guessing (lockout after failed attempts, anti-hammering).
• Measure the boot chain (measured boot): Firmware, bootloader and configuration are hashed at each start and recorded in registers (PCR). The BitLocker key is released only if the measurements match the expected ones.
• Random numbers of high quality.
• Attestation: The device can prove to a server in which state it was started.
• Sign-in: Windows Hello, PINs and passkeys use it so secrets are bound to the device.

Forms:

Kind	Description
Discrete TPM (dTPM)	Separate chip on the motherboard, most secure
Firmware TPM (fTPM)	In the CPU/chipset (Intel PTT, AMD fTPM), no extra hardware
Software TPM	Only for tests, hardly any protection

TPM 1.2 and TPM 2.0:

• 2.0 supports modern algorithms (SHA-256, ECC, AES) instead of only RSA/SHA-1.
• More flexible key hierarchies and policies.
• Windows 11 requires 2.0, as do many features such as Secure Boot and virtualization-based security.

Checking: In Windows Win + R → tpm.msc. In the UEFI it is often enabled under “Security” as “PTT” (Intel) or “fTPM” (AMD).

Limits: The TPM protects keys, not everything. If malware runs in an unlocked system, it can use the TPM too. Privacy concerns (unique device identifier) are reduced in TPM 2.0 by separate keys.

See also: BitLocker, Secure Boot, UEFI