TPM 2.0 v1.85 Specification Compliance in the fwTPM
The firmware TPM received a broad round of TCG v1.85 conformance work so that it behaves like a certified discrete TPM on the paths used by measured boot and attestation:

• Command-code masking and corrected vendor-bit return codes (PR #556)

• PolicyAuthorize compliance and corrected response codes for the keySign name ticket and approvedPolicy (PRs #567, #572)

• Authenticated object context blobs on ContextSave / ContextLoad (PR #568)

• Rejecting unsupported LoadExternal private types, corrected creation-ticket HMAC ordering, and ML-DSA / ML-KEM template validation in LoadExternal and CreateLoaded (PRs #573, #578)

• NV space authorization validation and v1.85 revision reporting (PR #575)

• Corrected command-attribute reporting, the verified-ticket HMAC algorithm, and SPDM responder version negotiation (PRs #577, #579, #584)

Post-Quantum Authentication for TLS 1.3
v4.2.0 extends post-quantum support from primitives to a complete authentication flow:

• TPM-backed ML-DSA authentication for post-quantum TLS 1.3, with a complete example and tests (PR #559)

• SealSQ QVault post-quantum TPM support (PR #570)

• ML-KEM credential activation and ML-DSA quotes in the fwTPM (PR #592)

The --enable-pqc, --enable-mldsa, and --enable-mlkem build options limit the post-quantum footprint to the operations your product performs.

New Platform and HAL Backends
This release adds two new ways to reach the TPM:

• wolfHAL I2C and SPI backends, enabled with --enable-wolfhal and an application-supplied board.h (PR #562)

• NVIDIA Jetson Orin (Tegra234) OP-TEE firmware TPM, reached through the Linux TPM kernel driver as /dev/tpmrm0 (PR #576)

• Finer per-command-group gating macros in the fwTPM for tighter code-size control (PR #574)

• Caller-supplied policy authorization for firmware upgrade (PR #560)

Also in This Release
ST33 firmware update: corrected Generation 1 manifest sizing with oversized-command rejection (PR #583) and field-upgrade command selection from the TPM command set (PR #586).

Performance: reused transport connections and reduced NV-write and hash-cache overhead (PR #563).

Build and licensing: fixes for AES_BLOCK_SIZE under OpenSSL coexistence (PR #552), TIS-lock builds without wolfCrypt (PR #564), and --enable-pqc with --disable-wolfcrypt (PR #606); refreshed example CA certificates with a refresh script (PR #601); new contribution guidance (PR #569); and a GPLv2 exception allowing wolfTPM combined with U-Boot from Cisco Systems, Inc. to be licensed under GPLv2 (PR #557).

Security Hardening
v4.2.0 includes a security-hardening pass driven by Fenrir, Coverity, static analysis, negative testing, and input-validation review. The changes include hardening of the crypto callback, ASN.1 parsing, parameter encryption, and marshalling (PR #551); bounded response decrypt-parameter sizing with primary-key auth zeroization (PR #555); fixes for a fwTPM response buffer overflow and an SPDM clear-frame command bypass (PR #561); a wolfCrypt refcount race fix in P521 primary derivation and a policy-session authorization-bypass fix (PR #571); transactional fwTPM state changes with hardened PolicyPCR and private-blob wrapping (PR #593); and a further set of fwTPM protocol, key-derivation, zeroization, and bounds fixes (PRs #554, #558, #565, #581, #582, #588, #591, #595, #596, #597, #598, #599, #600, #603, #604, #605, #608).

Getting Started

git clone https://github.com/wolfSSL/wolfTPM.git
cd wolfTPM
git checkout v4.2.0
./autogen.sh
./configure --enable-fwtpm –enable-swtpm
make && make check

The full change log is available in ChangeLog.md.

For commercial licensing, FIPS 140-3 integration, DO-178C DAL A qualification kits, custom HAL ports, or help deploying TPM 2.0 v1.85 post-quantum, contact facts@wolfSSL.com or +1 425 245 8247.

Download wolfSSL Now