It's said that TPM is proposed to address issues that software alone cannot. To my understanding, this means TPM cannot be simulated using software. For example, as far as I know, TPM comes with a hardware-based random number generator. I think it's able to generate genuine random numbers, which is something software cannot do. Software is only able to generate pseudo-random numbers.

I believe there are more critical distinguishing features of TPM from software solutions, and understanding them is crucial to learning TPM. Could someone give a list of the most critical ones along with a brief description for each?

For now, I simply cannot get a clear mind of how TPM is so special. Is it because its root private key is exclusively for TPM-internal use and cannot be read otherwise even by its owner, which is hardly possible without hardware support?

1 Answer 1


The three principle benefits of a TPM are:

  1. Anti-hammering
  2. Isolation
  3. Non-exportability

Anti-hammering is noticed when the incorrect matching credentials for a key are supplied one too many times, causing a temporary lock. The lock is released automatically after a minimum amount of time transpires. It can also be released by the admin entering a PIN unlock key.

Isolation reflects the fact that the TPM operates in a memory space that cannot be read by software or the operating system. Only limited and specifically formatted input is allowed to go into a TPM, and the response is also highly specific and limited. Isolation is beneficial to security in that it prevents monitoring or altering with internal TPM operations.

Non-exportability is a configurable quality of keys that are born on a TPM. Not all TPM-generated keys need be non-exportable; if configured to be exportable, the TPM enables a key to be exported. One benefit of non-exportability is that you can tie a key pair to a specific hardware device, effectively making that hardware required in order for the private key to be utilized.

A practical step-by-step guide for establishing an SSH connection to a server with a key pair, and with the private key safely isolated within a virtual smart card on a TPM, is here:


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .