The Trusted Computing Group (TCG) and DMTF have collaborated on updates to DMTF’s open-source libspdm reference implementation, adding support for Trusted Platform Module (TPM) functions as part of ongoing work to align security standards for device authentication and secure communications.
Libspdm is an implementation of DMTF’s Security Protocol and Data Model (SPDM) specification, which defines standard mechanisms for component authentication, measurement reporting, attestation, key exchange, and establishing secured communications between devices.
DMTF said the addition of a TPM backend enables implementations to use TPM-protected key material and platform measurements for selected SPDM operations. The organisations positioned the work as a step toward improving interoperability across platforms that implement SPDM and TCG technologies.
“We welcome DMTF’s decision to integrate TPM capabilities into libspdm,” said TCG President Joe Pennisi. “Not only does it highlight the importance of cooperation between standards organizations, but by bringing the two technologies together in accessible reference code, we can help implementers understand how perfectly they complement one another.”
The update builds on formal cooperation established in 2021, when TCG and DMTF created a work register to identify technical areas for collaboration aimed at improving alignment between SPDM and TCG technologies.
According to the release, the integration is designed to allow private-key operations to be performed without exporting the private key from the TPM, and to provide a reference approach for combining SPDM’s protocol functions with a hardware-backed root of trust.
DMTF’s documentation describes TPM integration for retrieving SPDM certificate chains from TPM non-volatile storage, signing SPDM challenge responses using TPM-resident private keys, providing measurement data derived from TPM Platform Configuration Registers (PCRs), and performing signing operations used during SPDM key exchange.
DMTF also said its spdm-emu reference environment demonstrates the integration using swtpm, a software TPM intended to let developers test TPM-backed SPDM flows without requiring dedicated TPM hardware during early development. The integration layer is intended to connect to either TPM hardware or a software TPM environment.
“We’re pleased to introduce TPM support in libspdm, accompanied by implementation documentation and an emulator-based validation environment,” said DMTF President Jeff Hilland. “This open-source reference implementation helps developers explore and validate interoperable SPDM-based security solutions utilizing TPMs, serving as a demonstration of how industry standard development organizations can work closely together to improve solutions for our members and the industry.”
