New TCG guidance gives buyers a way to test PQC-ready TPM claims
The Trusted Computing Group has published requirements that spell out what a Trusted Platform Module has to do before anyone calls it quantum-safe. A TPM is the chip that holds a machine’s keys and records measurements of its firmware, so the platform can later prove it has not been altered. Buyers can now ask a vendor for evidence against a written baseline.
TCG’s requirements for Trusted Platform Modules (TPMs) enables companies to request evidence from vendors that their products genuinely meet essential Post Quantum Cryptography (PQC) requirements and avoid TPMs that advertise ‘compliance’ yet fail to provide full, end-to-end security capabilities.
“It’s important that organizations gain a full understanding of what a PQC-ready TPM is,” said TCG President Joe Pennisi. “As PQC capabilities emerge, businesses will need to look beyond individual algorithm support and understand the broader requirements for quantum-safe identities, attestation, and hardware-anchored trust.”
With cryptographic requirements continuing to evolve, TPMs play an important role in helping businesses maintain trusted identities, platform integrity, attestation, and hardware-anchored security over time. TCG’s work on PQC readiness helps provide a path for how these capabilities can continue to support long-term trust as industry standards and security expectations advance.
It is important to recognize the risks facing platforms and TPMs that are not yet PQC-ready, and to plan for that risk as part of a broader security lifecycle. Key security elements such as platform identities, attestation keys, and firmware measurements may need to remain secure for decades.
Consequently, organizations should understand where quantum-safe primitives are required, where transition planning is needed, and how TCG guidance can help them make informed decisions about a genuinely quantum-resilient RoT – a critical need given that 90% of businesses still lack a formal PQC roadmap.
Outlined by the TCG, the critical requirement for a PQC-ready TPM is one that implements the TCG PC Client Platform TPM Profile (PTP) 1.07. A foundational document for the industry’s transition toward PQC-capable TPMs, it defines TPM 2.0 implementations that support PQC algorithms to provide quantum-safe cryptographic protection.
PTP 1.07 is the baseline for a PQC-ready TPM, defining the required PQC-specific elements from the recently published TPM 2.0 Library Specification Version 1.85. TCG’s PTP 1.07 outlines the minimum requirements for PQC-ready TPMs, however, vendors developing TPMs may choose to implement additional optional PQC algorithms in their designs.
As part of the organization’s efforts to bring structure to the ongoing transition to PQC, TCG has defined two TPM transition designations describing a platform’s ability to adopt the PQC capabilities specified by PTP 1.07:
- ‘TCG PQC-ready TPM’
- ‘TCG PQC-upgradable TPM’
At a high level, a TPM that implements PTP 1.07 is defined as a ‘TCG PQC-ready TPM’. A ‘TCG PQC-upgradable TPM’ is one that does not presently support PTP 1.07, but has the capability to be upgraded to this support.
TCG has also announced plans to enhance its certification programs to certify TPMs that meet the requirements of PTP 1.07. Once completed, the organization will define and provide the requirements for a TCG-certified ‘TCG PQC-ready TPM’.