wolfTPM by wolfSSL is a portable, open-source TPM 2.0 stack with backward API compatibility, designed for embedded use. It is highly portable and has native support for Linux and Windows. RTOS and bare metal environments benefit from a single IO callback for SPI hardware interface, no external dependencies, and compact code size with low resource usage. wolfTPM provides API wrappers for complex TPM operations like attestation and examples for cryptographic processes such as generating a Certificate Signing Request (CSR) using a TPM. Due to wolfTPM's portability, it is generally very easy to compile on new platforms. It provides all TPM 2.0 API compliance with the specification. It includes wrappers for common use cases like Key Generation, NV memory, RSA encrypt/decrypt, ECC sign/verify, ECDH, etc. It provides examples for advanced use cases like Attestation (TPM 2.0 Quote), Certificate Signing Request (CSR), generation of signed timestamp (TPM 2.0 GetTime), and others. Trusted Platform Module (TPM, also known as ISO/IEC 11889) is a standardized secure processor that acts as a dedicated microcontroller alongside the main processor. TPM is present in most modern computer systems and allows computer programs to authenticate hardware devices using a unique and secret RSA key embedded in each TPM chip. Applications can protect their keys and secrets using the TPM as a vault. wolfTPM is built for maximum portability and is easy to compile on new platforms. wolfTPM supports the C programming language as a primary interface. It uses the TPM Interface Specification (TIS) to communicate over SPI. It can also use the Linux TPM kernel interface (/dev/tpmX) to talk with any physical TPM on SPI, I2C and even LPC bus. It includes example code for most TPM2 native APIs, all TPM2 wrapper APIs, PKCS 7 Certificate Signing Request (CSR), TLS Client, TLS Server, use of the TPM's Non-volatile memory, attestation (activate and make credential), benchmarking TPM algorithms and TLS key generation (primary, RSA/ECC and symmetric), loading and storing to flash (NV memory), sealing and unsealing data with an RSA key, time signed or set. It supports parameter encryption using AES-CFB or XOR, salted unbound authenticated sessions, and HMAC Sessions. Testing has been done using TPM 2.0 modules: Infineon OPTIGA SLB9670 and SLB9672, STMicro STSAFE-TPM ST33TPHF2XSPI/2XI2C and ST33KTPM2X, Microchip ATTPM20, Nuvoton NPCT65X and NPCT75x, Nations Tech Z32H330TC. wolfTPM supports chipsets including ARM, Intel, Motorola, mbed, NXP/Freescale, Microchip (PIC32)/Atmel, STMicroelectronics (STM32F2/F4), Analog Devices, Texas Instruments, and more. Supported Operating Environments include Raspberry Pi (Linux), MMIO, STM32 with CubeMX, Atmel ASF, Xilinx, QNX, Infineon TriCore, Barebox. It has native support for Microsoft Windows and Linux.
