It's said that TPM is proposed to address issues that software alone cannot. To my understanding, this means TPM cannot be simulated using software. For example, as far as I know, TPM comes with a hardware-based random number generator. I think it's able to generate genuine random numbers, which is something software cannot do. Software is only able to generate pseudo-random numbers.

I believe there are more critical distinguishing features of TPM from software solutions, and understanding them is crucial to learning TPM. Could someone give a list of the most critical ones along with a brief description for each?

For now, I simply cannot get a clear mind of how TPM is so special. Is it because its root private key is exclusively for TPM-internal use and cannot be read otherwise even by its owner, which is hardly possible without hardware support?


The three principle benefits of a TPM are:

  1. Anti-hammering
  2. Isolation
  3. Non-exportability

Anti-hammering is noticed when the incorrect matching credentials for a key are supplied one too many times, causing a temporary lock. The lock is released automatically after a minimum amount of time transpires. It can also be released by the admin entering a PIN unlock key.

Isolation reflects the fact that the TPM operates in a memory space that cannot be read by software or the operating system. Only limited and specifically formatted input is allowed to go into a TPM, and the response is also highly specific and limited. Isolation is beneficial to security in that it prevents monitoring or altering with internal TPM operations.

Non-exportability is a configurable quality of keys that are born on a TPM. Not all TPM-generated keys need be non-exportable; if configured to be exportable, the TPM enables a key to be exported. One benefit of non-exportability is that you can tie a key pair to a specific hardware device, effectively making that hardware required in order for the private key to be utilized.

A practical step-by-step guide for establishing an SSH connection to a server with a key pair, and with the private key safely isolated within a virtual smart card on a TPM, is here:


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.