Unveiling Security: A Comparative Analysis of TPM 1.2 and TPM 2.0

Trusted Platform Module (TPM) is a crucial hardware-based security feature that plays a key role in securing computing platforms. TPM comes in different versions, with TPM 1.2 and TPM 2.0 being two significant iterations. In this comparison, we’ll explore the differences between TPM 1.2 and TPM 2.0, focusing on security, performance, and compatibility.

TPM Evolution History

1999-2000: Inception

The concept of a hardware-based security module for computers was first proposed in the late 1990s. The Trusted Computing Group (TCG), a consortium of industry leaders, was formed in 1999 to develop and promote open industry standards for hardware security. This laid the foundation for the development of the TPM.

2003: TPM 1.2 Specification

The first version of TPM, known as TPM 1.2, was released in 2003. It provided a standardized way to perform cryptographic operations, store cryptographic keys securely, and measure the integrity of a computing platform. TPM 1.2 became a widely adopted security feature in various computing devices, including desktops, laptops, and servers.

2009: TCG Updates

The TCG (Trusted Computing Group) continued to refine and enhance the TPM specifications. Updates and revisions were made to address security concerns, improve functionality, and adapt to changing technology landscapes. These updates helped ensure that TPM technology remained relevant and effective in the face of evolving threats.

2014: TPM 2.0 Specification

TPM 2.0, the next major iteration, was released in 2014. This version introduced several significant improvements over TPM 1.2. Notably, TPM 2.0 provided enhanced cryptographic capabilities, better support for modern cryptographic algorithms, and increased flexibility in terms of features and functionality.

Post-2014: Adoption and Integration

Following the release of TPM 2.0, the adoption of TPM technology increased. Many modern computing devices, including PCs, laptops, and embedded systems, began incorporating TPM 2.0 to strengthen security measures. The increased focus on secure boot processes, data protection, and system integrity contributed to the widespread integration of TPM 2.0 in various computing platforms.

It’s important to note that the history of TPM is intertwined with the broader evolution of computer security, and its future will likely involve continued collaboration and adaptation to address the ever-changing landscape of cybersecurity threats.

Security

TPM 1.2 operates with a single “owner” authorization, employing an RSA 2048-bit Endorsement Key (EK) for signing/attestation and a sole RSA 2048-bit Storage Root Key (SRK) for encryption. This implies that a singular user or entity, denoted as the “owner,” possesses control over both the signing/attestation and encryption functionalities within the TPM. Typically, the SRK serves as the parent for any keys generated within TPM 1.2. Notably, TPM 1.2 was specified as an opt-in device.

In TPM 2.0, the same functionalities represented by the EK for signing/attestation and SRK for encryption, as found in TPM 1.2, exist. However, control is distributed across two distinct hierarchies in TPM 2.0—the Endorsement Hierarchy (EH) and the Storage Hierarchy (SH). Beyond EH and SH, TPM 2.0 encompasses a Platform Hierarchy (PH) for maintenance functions and a Null Hierarchy. Each hierarchy possesses its own unique “owner” for authorization. Consequently, TPM 2.0 supports four authorizations, which can be likened to the single TPM 1.2 “owner.”

TPM 1.2

• Cryptographic Algorithms:
  • Primarily supports older cryptographic algorithms.
• Key Features:
  • Basic security functions such as key generation, storage, and attestation.
  • Limited support for cryptographic agility.
• Complexity:
  • Simpler design compared to TPM 2.0.

TPM 2.0

• Cryptographic Algorithms:
  • Supports modern cryptographic algorithms, providing greater flexibility.
• Key Features:
  • Enhanced support for cryptographic agility, allowing the use of advanced algorithms.
  • Improved attestation capabilities.
  • Enhanced authorization mechanisms.
• Complexity:
  • More complex design compared to TPM 1.2.

Performance

TPM 1.2

• Generally considered to have acceptable performance for its supported functionalities.

TPM 2.0

• The increased complexity may impact performance, but this is often outweighed by the added security features and flexibility.

Compatibility

TPM 1.2

• Backward Compatibility:
  • Systems that support TPM 2.0 are often backward compatible with TPM 1.2.
  • TPM 1.2-only systems may not support TPM 2.0 features.

TPM 2.0

• Forward Compatibility:
  • TPM 2.0 may not be fully compatible with TPM 1.2 systems.
• Platform Configuration Registers (PCR):
  • TPM 2.0 introduces more PCRs, providing detailed measurement and attestation of system state.

Comparing TPM 1.2 with TPM 2.0 - Evaluation of Cryptographic Capabilities

The following chart summarizes the encryption algorithms for TPM 1.2 and TPM 2.0.

TPM Versions Support in Windows and Linux

TPM Versions Support in Windows

• TPM 1.2:

  • Windows 7 and later versions support TPM 1.2.
  • Windows Server 2008 and later versions support TPM 1.2.

• TPM 2.0:

  • Windows 8 and later versions, including Windows Server 2012 and later, support TPM 2.0.
  • Windows 10 and Windows 11 also include TPM 2.0 support.

TPM Versions Support in Linux

• TPM 1.2:

  • The kernel supports TPM 1.2, and various Linux distributions offer TPM 1.2 integration.
  • Commands like tpm-tools and trousers are commonly used for TPM 1.2 management.

• TPM 2.0:

  • Linux kernel versions 4.12 and later provide native support for TPM 2.0.
  • Users can utilize tools like tpm2-tools for TPM 2.0 management.
  • TPM 2.0 is well-supported in modern Linux distributions.

Upgrade TPM Firmware 1.2 to TPM 2.0

HP and Dell computers can use upgrade TPM firmware from 1.2 to 2.0 with software update.

You can obtain the software and updated TPM firmware by visiting the provided link. It’s important to be aware that the upgrade procedure must be carried out in a Windows environment, as upgrading the TPM in Linux is not supported.

• Dell Computers That Can Upgrade from TPM Version 1.2 to 2.0
• HP Desktops, Notebooks, and Workstations - HP TPM Configuration Utility With Windows 10 Anniversary Edition Compatible TPM Firmware

Conclusion

In summary, both TPM 1.2 and TPM 2.0 serve as vital components for enhancing the security posture of computing devices. TPM 2.0 represents an evolution with improved cryptographic capabilities, enhanced attestation features, and increased flexibility. While TPM 1.2 remains relevant and widely used, the choice between the two versions may depend on specific use cases, compatibility requirements, and the desired level of security.

The decision to adopt TPM 1.2 or TPM 2.0 should be based on a careful consideration of the security features needed, performance considerations, and compatibility requirements within the context of the computing environment. As technology evolves, TPM 2.0 is likely to become more prevalent, offering a more robust and adaptable solution for securing modern computing platforms.

References

• http://www.trustedcomputinggroup.org/resources/tcg_algorithm_registry
• http://www.trustedcomputinggroup.org/resources/pc_client_platform_tpm_profile_ptp_specification