Aerospace, defense, industrial, medical, and energy platforms need a hardware Root of Trust, yet a discrete TPM chip is one more component to procure, qualify, and fit on a board that may run for decades. What if the TPM were simply part of the FPGA you already built?
This example runs wolfTPM’s Firmware TPM (fTPM), a complete TPM 2.0 engine on wolfCrypt, bare-metal on a soft MIV_RV32 RISC-V core inside a Microchip PolarFire MPF300 FPGA. There is no hardened CPU and no discrete TPM: the fTPM, its entropy source, and its secure storage all sit in the FPGA fabric.
The host drives TPM 2.0 over UART; the fTPM reaches the PolarFire System Controller for entropy and persistent storage over an APB mailbox.
Post-quantum TPM 2.0 (wolfTPM v1.85)
With wolfTPM v1.85 and its TPM 2.0 PQC spec support, this is a real post-quantum TPM. ML-DSA (Dilithium) signatures and ML-KEM (Kyber) key encapsulation are exposed as native TPM key types with full sign/verify and encapsulate/decapsulate sequences, not merely PQC in the library underneath. Long-lived platforms stay crypto-agile as post-quantum mandates arrive.
wolfCrypt benchmark: PQC vs classical public-key
On the bare 80 MHz MIV_RV32 core, wolfCrypt’s benchmark shows post-quantum public-key operations running well ahead of classical ECC:
| Operation | ops/sec |
|---|---|
| ML-KEM-768 key generation | 21.6 |
| ML-KEM-768 encapsulate | 17.6 |
| ML-DSA-44 verify | 8.5 |
| ML-DSA-44 sign | 1.5 |
| ECC P-256 key generation | 1.27 |
| ECDSA P-256 verify | 0.63 |
ML-KEM-768 key generation runs roughly 17x an ECC P-256 key generation, and ML-DSA-44 verify roughly 14x an ECDSA verify. Post-quantum leans on SHA-3/SHAKE and small polynomial arithmetic, while ECC spends its time in slow big-integer math on a 32-bit core. The full classical and post-quantum results are in the example README.
Root of trust, entropy, and secure storage
- Root of Trust: the fTPM engine runs on the soft core and serves TPM 2.0 commands over UART, so the TPM hierarchy and its keys are part of the FPGA design itself.
- Entropy: the PolarFire System Controller Nonce Service seeds wolfCrypt’s SP800-90A Hash-DRBG – proven non-deterministic across cold boots. The DRBG, not the raw service, produces the TPM’s randomness and reseeds on schedule. On the MPF300T the Nonce Service draws from an SRAM-PUF-seeded iRNG; the security-enabled MPF300TS (“-S”) variant provides a hardware TRNG.
- Secure storage: TPM state persists in on-die secure NVM (sNVM) through the System Controller services, shadowed in RAM with write-through to flash, surviving power cycles with no external memory.
Footprint on the FPGA
The whole design (the soft MIV_RV32 core, its peripherals, and 512 KB of execution RAM) uses about 6.7% of the MPF300T’s logic (20,088 of 299,544 4-input LUTs), 4.2% of its registers, and 27% of its block RAM.
The fTPM image size tracks the algorithm set, and every configuration below fits the 512 KB LSRAM. wolfCrypt and wolfTPM are heavily configurable, so a deployment compiles in only the algorithms it needs:
| fTPM configuration | code | LSRAM image |
|---|---|---|
| Post-quantum (ECC + ML-DSA + ML-KEM) | 229 KB | ~510 KB |
| Full classical (RSA + ECC + AES + SHA-2 + HMAC + CMAC) | 217 KB | ~480 KB |
| Post-quantum only (ML-DSA + ML-KEM, no RSA or ECC) | 170 KB | ~450 KB |
| Classical ECC only (no RSA) | 183 KB | ~430 KB |
The full feature set is the largest of these. Dropping the algorithms a platform will not use shrinks both code and data: a pure post-quantum TPM with no classical RSA or ECC saves about 60 KB over the combined build, freeing LSRAM blocks and with them FPGA logic.
Flash-based FPGA for harsh environments
Flash-based PolarFire FPGAs are valued in aerospace, defense, and industrial systems for their SEU-resistant nonvolatile configuration, low power, and wide temperature range, and a space-grade RT PolarFire family covers the same design. Folding the root of trust into that fabric removes a discrete TPM from the bill of materials and the board.
Built on open, portable wolfSSL and wolfTPM, and validated on MPF300 hardware. The hardware TRNG, power-cycle NV persistence, and full wolfcrypt_test suite, including PQC all pass.
See the example and pull request #5
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now