TPM Software Stack - Enabling the TPM2.0 Ecosystem in Linux

## Overview

This talk covers the TPM2 Software Stack (TSS2), an open-source, TCG-compliant implementation enabling TPM support in Linux and Windows. The speakers—Peter Weaver (Infineon), Joshua (Intel Open Source Technology Center), and presenting slides from Philip Trickett—discuss the userspace components of TSS2, its architecture, community-driven development, and practical use cases.

## Key Topics

**Architecture and Design Philosophy** TSS2 follows a layered, modular design as specified by the Trusted Computing Group (TCG). The stack separates the TPM device driver (non-standardized, flexible) from upper layers via an abstraction called the TCG I/TPM common interface. This allows support for different transports: direct device access, simulators, the kernel-based access broker/resource manager, and Windows TBS. The design provides flexibility for both synchronous and asynchronous programming models, and allows experts fine-grained control while offering convenience abstractions for general users.

**Three API Levels** 1. **System API**: Expert-level, one-to-one mapping of TPM commands to C functions; requires manual session and encryption handling; minimal dependencies. 2. **Enhanced System API**: Mid-level abstraction; automates session management, encryption, and dependency tracking; requires a crypto library; significantly improves usability for intermediate developers. 3. **Feature API**: High-level abstraction currently under TCG standardization; not yet widely implemented; promised to reduce complex workflows to a few lines of code.

**Implementation Components** The lower layers include libTPM2 (type marshalling), libtss2 (marshalling/unmarshalling compressed TPM wire format), and the Enhanced System API layer. The project uses standard autotools for portability and semantic versioning to signal API compatibility clearly.

## Technical Details

**Resource Management** A TPM is a resource-constrained device with limited key slots and storage. TSS2 provides both userspace and kernel-space resource managers to handle object loading, saving, and flushing. Recent kernels (4.14+) support kernel-based resource management; a userspace daemon can add access brokering for multi-user systems, isolating users' TPM objects.

**Open-Source Development** Philip Trickett inherited a poorly maintained internal Intel project and systematically improved it by: - Restructuring for maintainability and debugging (added logging frameworks) - Converting to autotools-based builds for portability and distribution packaging - Replacing an unmaintainable 3000-line monolithic test suite with independent unit tests using Cmocka - Achieving >85% code coverage with automated CI/CD (Travis CI for Linux, now including Windows) - Adopting static analysis tools (scan, coverity) - Rewriting fundamentally broken components (e.g., the original resource manager)

**Cross-Platform Support** A 650-line patch from Facebook enabled Windows TBS support, allowing the Linux-designed stack to build and run on Windows. Windows CI now validates every commit.

## Project Scope and Use Cases

**Distributed Development** The project is vendor-neutral (GitHub: tpm2-software) with maintainers from Intel, RedHat, Infineon, Facebook, Alibaba, and other contributors—demonstrating genuine community ownership beyond single-company control.

**Tools and Integrations** - **TPM2 tools**: Command-line utilities for TPM interaction and education; one-to-one mapping of TPM commands; recent releases simplify workflows (reduced example from 11 to 7 commands). - **OpenSSL engine**: Enables RSA decryption, RSA/ECDSA signatures via TPM (e.g., signing/verifying with TPM-stored certificates). - **PKCS#11 provider** (beta): Modern cryptographic interface for OpenSSL and IETF libp11; actively seeking user feedback and patches. - **Full-disk encryption**: Integration with cryptsetup/LUKS2 (cryptsetup-led work) to enable BitLocker-like capabilities in Linux. - **VPN/IPSec**: strongSwan and openconnect are using TSS2. - **Web-based education**: Google's TPM JavaScript implementation uses this stack to provide interactive tutorials.

## Takeaways

TSS2 is a mature, well-engineered open-source project that abstracts TPM complexity through layered APIs. Its success stems from prioritizing maintainability, testing, and community contribution over rapid feature development. The distributed vendor support and recent cross-platform achievements (Windows CI, tool usability improvements) position it as the reference implementation for TPM2 in open-source ecosystems. For developers, the Enhanced System API is recommended over raw System API; learning resources include training materials and Google's interactive tutorials rather than the 3000-page TCG specification.