What is a TPM?

A Trusted Platform Module (TPM) is a dedicated hardware security chip that generates, stores, and safeguards cryptographic keys, and that measures and verifies boot firmware before an operating system loads. Physically or logically isolated from the main processor, it gives a device a hardware-anchored identity that software alone cannot forge or extract.

Key takeaways

• A TPM is a chip that generates and protects cryptographic keys.
• Keys sealed to a TPM never leave the chip in usable form.
• It measures firmware and boot components to detect tampering.
• TPM 2.0 is current; older TPM 1.2 devices are largely obsolete.
• Versa’s CSG and CSX appliances build in TPM 2.0 by default.

On this page: Why it matters · How it works · Types · TPM & Versa · FAQ

Why is a TPM important?

Software-only key storage has a weakness: any secret an operating system can read, an attacker who compromises that system can read too. A TPM breaks that link by keeping private keys inside a chip that never exposes them, even under root-level compromise of the host.

That isolation underpins device identity that can’t be spoofed by cloning a disk or VM image, and secure boot that detects firmware tampering before an operating system loads. Full-disk encryption, credential storage, and remote attestation all lean on a TPM’s ability to bind a secret to verified hardware state.

For network appliances, a TPM anchors zero-touch provisioning: a device proves its identity to a management plane using a key an attacker can’t extract, even with physical access to the box.

What is a TPM?

A TPM is a microcontroller – built to the Trusted Computing Group’s TPM specification – that provides cryptographic primitives in hardware: a random number generator, key generation and storage, hashing, and signing, all performed inside the chip’s own protected memory rather than on the host CPU.

Two properties define it. Keys generated or sealed inside the TPM can be marked non-exportable, so private key material never exists outside the chip in plaintext. The TPM also maintains registers that record measurements of firmware and boot state; software can later ask it to release a secret or attest to that state, but only if the measurements still match what was recorded – tampering breaks the chain.

Physically, a TPM can be a discrete chip, a function inside an existing chipset, or a virtualized instance for a VM.

Types of TPMs

Implementations fall into four categories, distinguished by where the trust boundary lives. Discrete TPM (dTPM) is a dedicated chip, physically separate from the CPU – the highest assurance level, since compromising it means attacking a distinct component. Firmware TPM (fTPM) runs as a protected function inside the CPU or chipset – cheaper, but sharing its trust boundary with the processor’s firmware. Integrated TPM is built into another chip’s silicon as a discrete, non-removable function. Virtual TPM (vTPM) is a software-emulated TPM a hypervisor presents to a VM, useful where dedicated hardware isn’t available.

TPM 2.0 is the current specification; earlier TPM 1.2 devices used a narrower, SHA-1-only algorithm set and are largely obsolete in new hardware.

TPM & Versa

Versa builds TPM 2.0 into its physical appliance line – the CSG and CSX series gateways and switches – as the hardware root of trust beneath device identity and secure boot. The CSX2000 Series integrates a TPM chip with cryptographic acceleration to protect encryption and authentication keys, alongside secure BIOS and secure boot; the CSG5000 Series lists a TPM 2.0 module among its standard specifications.

The TPM is what makes zero-touch provisioning trustworthy: each VOS appliance ships with a Versa-signed certificate, and the TPM holds its private key in hardware rather than in a file the operating system could expose. A device powering on at a new site proves its identity using a key that never left the chip, so a cloned disk image can’t impersonate it. See the CSG5000 Series Appliance Specifications for the full spec table.

Frequently asked questions

What is the difference between TPM 1.2 and TPM 2.0?

TPM 2.0 supports modern algorithms, including SHA-256 and elliptic-curve cryptography, plus a more flexible policy model, while TPM 1.2 is limited to SHA-1 and RSA and is considered outdated. Virtually all current hardware, including Versa’s appliances, ships with TPM 2.0.

Can a TPM’s keys be extracted or copied?

No, not by design. Keys generated inside the TPM, or sealed to it, are marked non-exportable: operations happen inside the chip, and private key material never leaves it in plaintext, even if the host operating system is fully compromised or the device is stolen.

Is a TPM the same as a hardware security module (HSM)?

They’re related but not equivalent. Both are hardware key stores, but an HSM is a higher-throughput, often external device built for many concurrent operations, while a TPM is a low-cost chip built into a single device to anchor that device’s own identity and boot integrity.

Does a TPM encrypt my hard drive automatically?

No. A TPM doesn’t perform full-disk encryption itself; it stores and protects the key that a separate disk-encryption feature uses, and releases that key only after verifying the boot chain hasn’t been tampered with since the last known-good measurement was recorded.

Can a TPM be added to a device that doesn’t have one?

Sometimes, via a discrete module added to a compatible motherboard header, but many modern devices instead rely on a firmware TPM built into the existing CPU. Versa’s CSG and CSX appliances ship with TPM 2.0 built in as a standard hardware component.

More on TPM

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about TPMs, these are worth looking at next.