wolfTPM now supports being a TPM as a firmware implementation. Instead of a discrete chip on the board, the TPM runs as software inside a trusted execution environment on the host processor.
The appeal is that you get TPM functionality without a board respin. If your design has no TPM header and no room for one, an fTPM gets you measured boot, key storage, and attestation on hardware you already shipped.
Performance is the other benefit. A discrete TPM talks over SPI or I2C and runs a modest internal core, so command latency is dominated by the bus and the chip. An fTPM executes at host processor speed with no external bus in the path.
Because the implementation is backed by wolfCrypt, it inherits the algorithms already in the library, including the post-quantum work as TCG adds PQC to the TPM 2.0 v1.85 specification.
The tradeoff is physical security. A discrete TPM is a tamper-resistant package with its own certifications. An fTPM is only as isolated as the TEE it runs in. For threat models that include physical attackers with board access, discrete still wins. For everything else, firmware is often the better fit.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now