wolfTPM now includes support for the Infineon OPTIGA™ SLB9678, bringing hardware-based post-quantum cryptography (PQC) and the TCG TPM-over-SPDM binding to embedded systems. Merged in October 2026 and shipping in our upcoming release, the integration was recently demonstrated at OktoberTech in Mountain View, California.
The live demonstration paired the SLB9678 over I2C with an Infineon PSoC™ Control C3 (C3M6 evaluation kit). Cryptographic operations ran directly on the hardware:
- Post-Quantum Signing: On-chip Hash-ML-DSA signature generation and tampered signature rejection.
- Platform Integrity: Reading PCR measurements across all 24 indices, alongside measurement-gated secret sealing and unsealing.
- Identity & Attestation: Retrieval of on-chip TPM endorsement certificates.
- PQC-Enabled TLS 1.3: Complete TLS 1.3 handshake utilizing ML-KEM-768 key establishment on the host with delegated ML-DSA signing on the TPM.
Standards & Protocol Integration
This release tracks the latest TCG TPM 2.0 specifications:
- v1.84: SPDM transport policy support and the TCG TPM-over-SPDM binding.
- v1.85: PQC (Quantum-Resistant algorithms), including ML-DSA digital signatures and ML-KEM key exchange.
wolfTPM leverages our wolfSPDM library to handle protocol messaging, including capability negotiation, status queries, and SPDM-only mode controls (tested against SLB9678 firmware 45.91).
End-to-End Secure Boot with wolfBoot
To provide complete root-of-trust protection, wolfBoot acts as the secure bootloader on the PSoC Control C3. It validates the signed demo application prior to execution and was verified with seamless A/B firmware updates.
Resources
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now